Save a request once and use it three ways: send it from the app, check it on every pull request with gostman run, and let a coding agent call it through gostman mcp without seeing your secrets. Requests, collections and environments are plain files on your machine, and there is nothing to sign in to. New here? The tutorial builds a tested collection step by step, and the documentation covers every feature.
Gostman is a native desktop application built with Go and Wails, with the same interface in the browser at gostman.com.
Why not Bruno or Postman?
Both are good tools. Gostman is for people who want the paid-tier workflow without a paid tier or an account.
- Nothing to sign in to. Collections are plain YAML files in a folder you can commit. The desktop app and the browser version both work without an account.
- No telemetry. No analytics or crash reporting in the apps or the command line; they contact only the hosts you send to and the services you set up. Only the home page at gostman.com counts visits, without cookies. What Gostman connects to lists every network call.
- No tiers. Data-driven runs, parallel runs, HTML reports, secret managers (Vault, AWS, Azure, Google Cloud, 1Password, Bitwarden, Bitwarden Secrets Manager, KeePassXC), the Git panel and any number of collections are all in the download. Bruno documents several of these under its Pro and Ultimate plans, and Postman lists custom data files in the Collection Runner on its paid plans.
- Sharing without Git. Send a folder to a teammate as an encrypted link or file that is built on your machine and never uploaded.
- More in the same download. Load testing, Socket.IO, MQTT, SignalR, GraphQL subscriptions, MCP servers, raw TCP and UDP, NATS, importers for Postman, Bruno, Insomnia, Hoppscotch, Thunder Client, HTTPie, Hurl and Firecamp, scheduled runs with a history, snapshot and negative tests, OpenAPI coverage, spec diff and fuzzing, traffic capture with rules and held calls, a secret scanner and a mock server, a VS Code extension, plus a command line that is one binary with no Node.js to install.
Prices and plans change, so check their pages before you decide. Gostman has no accounts, so it has no hosted collaboration, SSO or cloud monitors. What is free in Gostman compares the paid features of Postman, Bruno and Insomnia with Gostman. Moving from Postman, Bruno or Insomnia? Coming from Postman, Coming from Bruno and Coming from Insomnia cover importing a collection, its scripts and the matching gostman run flags.
Will Gostman add a paid tier?
Gostman has no paid tier, no account and no licence key, and every feature is in the free download. It is released under the MIT licence, so the published code stays free to use, change and fork whatever happens to the project.
Quick start
- Browser: open gostman.com/web, paste a URL and press Send. Requests go through a hosted proxy; run
gostman relay to use your own.
- Desktop: download the installer from Install and open it.
- Command line: send a request, or run a collection you saved to a folder in the app.
go install github.com/kunalgoesbyken/gostman/cmd/gostman@latest
gostman send GET https://example.com -H 'Accept: text/html'
gostman run path/to/collection
Try a working collection
The examples folder holds collections that call public test APIs, so they run as soon as you clone the repository:
git clone https://github.com/kunalgoesbyken/gostman && cd gostman
gostman run examples/todo-api --env Public
PASS GET Todos/List todos 200 OK 99 ms 3/3 checks
PASS GET Todos/Get one todo 200 OK 13 ms 3/3 checks
PASS POST Todos/Create a todo 201 Created 286 ms 3/3 checks
Requests 3 passed
Checks 9 passed
Duration 412ms
Open the same folder in the desktop app with Open folder to see the requests, the checks and the variable passed from one request to the next.
Learn
- Tutorial: test an API builds that collection step by step: variables, folders, assertions, chaining, scripts and a data-driven run.
- Tutorial: run your API tests in CI runs it on every pull request with secrets kept out of the files.
- Guides by task: migrate from Postman, mock a backend before it exists, record real traffic, load test, publish docs, let a coding agent call your API.
- Script reference and examples: JSON Schema checks, request signing, fetching a token, polling.
- Fault-test your API with seedfall: run a collection's checks against a Go service while seedfall, a sibling project, crashes it and partitions its network.
- Troubleshooting
Features
- Protocols: REST, GraphQL (schema browser), gRPC (reflection or
.proto), WebSocket, Socket.IO, MQTT over WebSocket, SignalR, GraphQL subscriptions, Server-Sent Events, SOAP, MCP servers, and raw TCP and UDP and NATS (desktop), over HTTP or, on the desktop, as a local command (stdio).
- Auth: Basic, Bearer, API key, OAuth 2.0 (with PKCE and automatic renewal), OAuth 1, Digest, AWS SigV4, NTLM, Akamai EdgeGrid, JWT Bearer, Atlassian ASAP and Hawk.
- Workflow: collections with nested folders, environments and variables, extraction rules to chain requests, a cookie jar, history, earlier responses with a side-by-side compare, and a command palette.
- Checks: assertions plus pre-request and post-response scripts with
test() and expect() in a sandbox, and snapshot checks, and a collection runner with CSV, JSON or XLSX data files, parallel runs and HTML, JUnit and JSON reports.
- Scheduled runs:
gostman run --every and the Monitors dialog repeat a run, keep a history (gostman history) and post to a webhook when it starts failing.
- Local load testing with
gostman load: latency percentiles, thresholds and staged ramps.
- API testing from a spec:
gostman negative sends altered copies of saved requests, gostman fuzz sends schema-derived inputs for every operation of an OpenAPI document, gostman diff lists breaking changes between two specs, and gostman run --contract --coverage lists operations a run did not reach.
- Secret scanner:
gostman scan and an in-app check find credentials typed into a collection before you commit or share it.
- Collections as files: plain YAML in a folder with a Git panel (diff, commit, push, branches, stash, conflicts) on the desktop.
- Mock server and capture: serve saved examples or an OpenAPI spec locally, and record traffic from your own app.
- OpenAPI: import, sync with a remote spec, and a spec viewer with a linter (
gostman lint).
- Docs: generate one HTML page with Markdown descriptions and an optional Try it panel.
- Secret managers: HashiCorp Vault, AWS, Azure and Google Cloud; the password managers KeePassXC, 1Password and Bitwarden, and Bitwarden Secrets Manager; and your OS keychain for stored values. Fields that read from a connection are tinted with its colour.
- Themes: light and dark, eight palettes, accent colours, and your own background and text colour for each part of the window, with a contrast check.
Install
Download the latest build from the releases page.
The builds are not code-signed yet, so the operating system asks for confirmation the first time:
- Windows: SmartScreen shows "Windows protected your PC". Choose More info, then Run anyway.
- macOS: right-click Gostman in Applications and choose Open, then confirm.
Windows needs the WebView2 runtime, which ships with Windows 10 and 11; the installer fetches it when it is missing.
VS Code extension and MCP server
Set up with your coding agent
Install the Gostman Agent Skill for the coding agents on your machine:
npx skills add kunalgoesbyken/gostman --skill gostman
Or copy this prompt into your coding agent, from your project:
Set up Gostman in this project so you can call and test its APIs without curl.
1. If `gostman version` fails, install the gostman command with `go install github.com/kunalgoesbyken/gostman/cmd/gostman@latest`, or download the gostman-cli archive for this platform from https://github.com/kunalgoesbyken/gostman/releases/latest.
2. Run `gostman init --skill` in the project root. Note the workspace folder and the `mcp` registration command it prints.
3. Register that command with your MCP client, using the absolute workspace path.
4. If the project has an OpenAPI spec, run `gostman import <spec> --out <workspace>`. Otherwise ask me which API to call.
5. Send one request with the gostman tools, run the workspace with `gostman run <workspace>`, and tell me what passed.
Never pass --reveal. Keep credentials in {{variables}}, and ask me before calling a host that my saved requests do not already use.
Secrets and Git
A folder workspace is meant to be committed. What goes where:
- Safe to commit:
gostman.yaml, folder.yaml, the request files, environments/ and flows/. They hold names, URLs, bodies and the values of variables you did not mark secret, so read a diff before you push.
- Marked secret: the value lives in the OS keychain on desktop (IndexedDB in the browser). Only the variable name is written to the YAML, so a token never lands in the folder. Mark every token: a variable you do not mark is plain text in the environment file, and the app warns when an unmarked value looks like a credential.
- Never written to the folder: OAuth tokens, cookies, request history and secret values.
- Keep out of Git: a
.env file next to gostman.yaml is read as {{process.env.NAME}} and never written back. A new workspace gets a .gitignore for .env, .env.* and the .gostman-*.tmp leftovers of an interrupted save; gostman init adds it to an older workspace, and an existing .gitignore is never changed.
- Check before you share:
gostman scan <folder> and the Scan for secrets command flag credentials typed into requests and variables.
See Variables for the details.
Web version
gostman.com runs the same interface in the browser. Browsers cannot call arbitrary APIs directly, so requests are relayed through a small proxy, and that includes any API token in the request. The proxy's code is open source in api/proxy.go and does not store requests or responses; this repository cannot speak for the logs of the host it runs on. To keep tokens off a server you do not run, start gostman relay on your computer and choose it under Preferences, Privacy, or use the desktop app. It differs from the desktop app in these ways:
- The hosted proxy cannot reach
localhost or private network addresses. Use the desktop app for local APIs, or run gostman relay and choose it under Preferences, Privacy.
- The web app has no proxy, CA certificate or client certificate settings. Use the desktop app, or start
gostman relay with --proxy, --cacert or --client-cert.
- A gRPC stream is collected and shown when it ends; messages for a client stream are written up front as a JSON array.
- Responses larger than 3 MB are truncated. The desktop app reads up to 50 MB.
Data in the web version is kept in the browser's IndexedDB.
Documentation
The same pages are published at gostman.com/docs. The tutorials and guides are listed under Learn; the reference pages are:
- Start: Getting started, What is free in Gostman, and coming from Postman, Bruno or Insomnia
- Requests: Requests and responses, Protocols
- Variables and secrets: Variables, Secrets and network settings
- Testing and automation: Scripts and checks, Running, load testing and scanning, Gostman in CI, Fault testing with seedfall
- Collections and Git: Collections, tabs and Git, Folder and collection settings, , ,
Translations
Gostman is translated on Weblate. The first drafts of each language are checked by native speakers over time. To ask for a language, offer to translate or report a wrong translation, use issue #15. Translating Gostman explains how the translation files work and how to send changes.
Contributing
Issues and pull requests are welcome. For anything larger than a small fix, please open an issue first to agree on the approach. See CONTRIBUTING.md for how to build, test and release.
