Agent-native API testing

API testing for the era of AI coding agents.

An MCP server that lets AI agents perform API testing autonomously - REST, GraphQL, WebSocket, SSE, and gRPC - without any GUI, manual clicking, or heavyweight desktop app. A lightweight, token-efficient alternative to Postman and Bruno.

Quick start Read the docs

npx -y @thupham/volley-mcp · cursor / windsurf / claude / vscode

mcp · tools/call · http_request (assert + extract)

{
  "tool": "http_request",
  "input": {
    "method": "POST",
    "url": "https://api.example.com/login",
    "body": { "user": "a", "pass": "{{secret_pass}}" },
    "assert": [
      { "status": 200 },
      { "jsonpath": "$.token", "exists": true },
      { "timeMs": { "lt": 500 } }
    ],
    "extract": { "token": "$.token" }
  }
}

→ {
  "status": 200,
  "timeMs": 142,
  "assertions": { "passed": 3, "failed": 0 },
  "extracted": { "token": "***redacted***" },
  "responseHandle": "resp_a1b2"
}

Design pillars

Built for agents, not clickers

Four principles that shape every tool, every response, and every byte on the wire.

Agent-native

Designed for LLM tool calls, not human UIs. Every tool returns a small, structured summary the agent can act on immediately.

Token-efficient

Every response is filtered, truncated, and summarized. Full payloads are spilled to a store and referenced by handle so the context window stays small.

Fast & portable

A Rust core (execution + protocols + summarization) exposed to a thin TypeScript MCP layer via napi-rs. One local binary, every platform.

Ad-hoc + reusable

Agents can fire one-off requests or create, save, and re-run declarative collections stored as plain, git-friendly YAML/JSON files.

Declarative testing

Agent emits JSON, not JavaScript

Postman agent mode makes you write pm.test scripts. Volley assertions are structured data the model can emit directly — no code generation, no JS to parse, no verbose output.

Postman agent mode

Imperative JS

pm.test("login ok", () => {
  pm.expect(res.code).to.equal(200);
  pm.expect(res.json().token)
    .to.be.a("string");
  pm.expect(res.responseTime)
    .to.be.below(500);
});
pm.variables.set("token",
  res.json().token);

Agent must generate valid JS, the runner evaluates it, and output is human-readable prose — expensive on the context window.

Volley assert

Declarative JSON

"assert": [
  { "status": 200 },
  { "jsonpath": "$.token", "exists": true },
  { "timeMs": { "lt": 500 } }
],
"extract": { "token": "$.token" }

Agent emits structured JSON. The Rust core evaluates it and returns a compact pass/fail summary. Same assertion power, a fraction of the tokens.

Matchers: equals, notEquals, in, contains, matches (regex), exists, gt/gte/lt/lte, length, plus not: negation and schema: JSON Schema validation.

Protocols

One server, every protocol

Stop juggling Postman, a WS client, an SSE inspector, and a GraphQL playground. Volley covers them all behind a single MCP tool surface.

REST / HTTP

Shipped

Every method, every body type

GET/POST/PUT/PATCH/DELETE/HEAD/OPTIONS + custom verbs. JSON, form, multipart, raw, binary bodies. Query params, headers, cookies, redirects, timeouts, retries.

GraphQL

Shipped

Queries, mutations, introspection

Queries, mutations, and variables over HTTP. Schema introspection returns an enriched, token-efficient summary so the agent can discover operations without pasting docs.

WebSocket

Shipped

Bounded + persistent sessions

Bounded ws_session: connect → send → collect until stop condition. Persistent handles (ws_open / ws_send / ws_recv / ws_close) for interactive flows. Subprotocols, auth headers, per-frame assertions.

SSE

Shipped

Server-Sent Events collector

Subscribe to an SSE endpoint and collect events until a stop condition. Parses event, id, data, retry; auto-parses JSON data. Last-Event-ID resume support planned.

gRPC

Planned

Unary + streaming

Unary and streaming calls with reflection or .proto / descriptor input. Deferred to a later phase.

Why this exists

Postman without the Postman

The tools agents already use are GUI-first and verbose. Volley is the inverse: a small, open, token-thin tool surface designed for the model context.

Pain with Postman / Bruno	Volley approach
Require human clicking in a GUI	Agent-native: everything is an MCP tool call
Postman is heavy, enterprise features are paywalled	Small, open, single local binary + thin MCP layer
Verbose responses blow up the LLM context window	Rust core summarizes/compresses output before it reaches the agent
Tests are JS scripts you write (pm.test / pm.expect)	Tests are declarative JSON the agent emits (assert + extract)
Collections are locked into proprietary formats	Plain YAML/JSON files, git-friendly
Separate tools per protocol	One server for REST/GraphQL/WS/SSE/gRPC

Ship API tests from your editor.

Install Volley once and every agent you run gets a full API testing toolkit - no GUI, no copy-paste, no context bloat.

$npx -y @thupham/volley-mcp