PostNot

Local-first desktop API client for people who want a fast desktop tool for APIs without living in a browser tab.

PostNot is a fully AI-generated software project. The codebase was produced end-to-end by AI agents, with no human-written code in the repository.

PostNot is built for working with HTTP APIs on your own machine, with local persistence, collections and folders, environments, secret handling, import/export, and a focused desktop workflow.

Website

Live site: post-not.com — product overview, platform downloads, privacy model, scripting reference, and links to the public project. It is served through GitHub Pages from the docs/ folder on the default branch, with the post-not.com custom domain configured in the repository Pages settings.

What It Does

• Compose and send HTTP requests from a desktop-native UI, including body-bearing RFC 10008 QUERY requests
• Work across multiple request tabs with restored local workspace state between launches
• Save requests into collections and nested folders
• Reuse standalone WebSocket and Socket.IO connection profiles while selecting and sending multiple collection messages through one live tab session
• Browse those folders in the sidebar and collections page with aligned tree guides and folder icons
• Search collections, folders, and saved requests from the sidebar
• Reorder saved requests and folders, and move them across folders or collections with drag-and-drop from the sidebar and collections page
• Build and run playbooks that execute saved requests in order with per-step delays, stop-on-failure behavior, and grouped run logs
• Work with environments and {{variable}} substitution
• Use built-in dynamic variables like Postman-style $guid and $timestamp
• Store secret environment values in the OS credential store
• Inspect request history locally
• Collapse the Requests page history panel when you want less noise, with that preference restored on the next launch
• Restore a past request from history into a new request tab
• Preview the resolved outgoing request before sending, with private values masked
• Import from Postman collections and environments
• Import collections or single requests from OpenAPI 3 JSON or YAML
• Import from cURL, including common flags for URL selection, query/body data, multipart forms, cookies, compression, redirects, and shell continuations
• Export the active request as redacted-by-default cURL or PostNot request JSON, with optional non-secret environment variable inclusion
• Export collections and environments back to Postman-compatible JSON
• Attach local files to multipart requests
• Run inherited collection, folder, and saved-request pre-request and test scripts (worker-backed JavaScript around each send)
• Call helper HTTP requests from scripts with await pn.http.send(...)
• Read and persist active environment variable updates from scripts, including secret writes
• Fetch OAuth2 client-credentials bearer tokens from the request editor and optionally persist them into the active environment
• Inspect large responses with full body reads and JSON-friendly rendering
• Use floating notifications, persisted settings, and signed in-app update checks with download progress
• Autosave environment edits by default, with keyboard saves via Ctrl+S / Cmd+S on requests and environments
• Connect local MCP-compatible agents so they can inspect collections, safely create or update HTTP requests, and manage standalone realtime connection profiles and messages for later manual use
• Follow MCP-authored changes in the MCP Integration view with persistent audit records, live collection refresh, and stale-draft protection

Why PostNot

• Local-first: request data and app state live on your machine
• Desktop-native: Rust request execution and Tauri packaging instead of a browser-only shell
• Practical portability: bring data in from Postman, OpenAPI 3, or cURL and export collections and environments back out in Postman-compatible JSON
• Safer secret handling: environment secrets are kept out of SQLite, stored history snapshots preserve unresolved secret variables, and single-request exports redact credential-looking values by default

Privacy And Storage

• SQLite-backed app data is stored under the Tauri app data directory.
• Secret environment variables are stored in the operating system credential store instead of SQLite.
• When requests use secret environment variables, PostNot keeps the unresolved {{variable}} references in history snapshots rather than persisting the resolved secret values.
• Single-request cURL and PostNot JSON exports redact credential-looking values by default, including bearer tokens, OAuth2 access tokens, client secrets, API keys, cookies, and basic-auth passwords; the export dialog can include active non-secret environment variables while keeping secrets redacted.
• MCP runs locally over stdio via the installed PostNot executable. Secret environment values are omitted from discovery, saved credential literals are redacted on reads, and the MCP Integration audit log stores metadata rather than request or realtime values.

Agent Integration (MCP)

Open MCP Integration → Configure MCP to copy configuration for Codex, Claude Desktop, Cursor, or another stdio MCP client. The generated configuration launches the installed PostNot executable with --mcp; the desktop window does not need to remain open.

MCP is intentionally authoring-only. Agents can list, search, inspect, preview, and create collection content; update saved HTTP requests with revision checks; and create, update, or delete standalone realtime profiles and messages with optimistic revisions. MCP does not execute requests or scripts, open realtime connections, send traffic, import specifications, modify environments, move collection items, or delete HTTP requests.

Building From Source

Prerequisites:

• Node.js
• Rust
• Tauri system dependencies for your platform

Install dependencies:

npm install

Run the desktop app in development:

npm run tauri dev

Validate the project:

Frontend:

npm run check
npm run docs:validate
npm run docs:test-site
npm run docs:check-screenshots

Rust:

source "$HOME/.cargo/env"
cargo check --manifest-path src-tauri/Cargo.toml

Rustup automatically uses the repository's pinned toolchain from rust-toolchain.toml.

Releases

• The changelog is tracked in CHANGELOG.md.
• Signed release artifacts are published through GitHub Releases.
• The in-app updater currently checks the latest stable GitHub Release.

License

PostNot is licensed under the Apache License 2.0.

For Contributors And Agents

• Implementation and workspace guidance now lives in AGENTS.md.
• Architecture and deeper technical notes live in docs/tech-design.md.