39633c2217
Connector catalog, setup guides, and shared access documentation, followed by a final code-accuracy repair pass. This PR does not change application behavior. ## Final accuracy pass Checked against shipped Paperclip `v2026.916.0`, commit `dffc2b3ca1b9e88fa21cb17493083e682dffd1ca`, rather than the dirty local checkout or the earlier canary baseline. - Corrects connector/method-specific identity choices, human audiences, and managed GitHub versus PAT scope and verification. - Explains that **Always allow** covers different arguments for the same agent/action/connection, with project scope when present; uses actual button labels and removes the test-panel control from review instructions. - Qualifies new-action quarantine, including safe-default read exceptions. Removes unconditional approval guarantees. - Separates provider channel/repository reach from Paperclip sender authorization. - Completes sandbox sign-in and model credential-selection instructions from the current UI implementation. - Repairs Notion's hub summary, removes incomplete optional Notion/Sentry client-registration procedures, and corrects Linear's provider-versus-Paperclip attribution. - Removes unsupported Postman tier claims, contradictory Cloudinary/Mem0 verification assertions, API-equivalence claims, and overbroad successful-test assurances. - Retains Supabase's required project reference: both released method definitions explicitly require it. An earlier review suggested otherwise; release code is authoritative here. - Updates the release baseline and removes draft commit chronology from the public introduction. ## Availability and remaining runtime gates - **Google:** Verification is pending. Per the product-owner clarification, authorization can continue where Google offers an Advanced option; this is not available for every account and does not override Workspace policy or other Google prerequisites. Notices on the hub and all Google guides now distinguish an unverified-app warning from blocked authorization. - **Slack is available but not yet fully functional; follow-up fixes are planned.** For agent tools, the released OAuth endpoint/scope defaults differ from Slack's documented MCP contract. The page now warns against treating that route as production-ready and removes the misleading bot-scope walkthrough. Chat-channel bot setup remains separate. Engineering must reconcile the integration and run OAuth plus one read before removing this warning. Source: https://docs.slack.dev/ai/slack-mcp-server/ - No credentialed connector run was performed in this pass. Code consistency, provider documentation, UI rendering, and successful live execution are separate evidence levels. No claim of runtime certification for all connectors. ## Validation - Root build: 253 crawlable documentation pages. - Full `docs:test`: all eight suites passed locally, including root/subpath routes, sitemap history, fingerprints, navigation, skill source blocks, crawlable links, doc-link resolution, and SEO metadata. - Internal-link lint: 258 Markdown files; no broken internal links. - Latest cleanup: full build, all eight docs:test suites, internal-link lint and diff whitespace checks passed; 1,878 link-resolution checks. - Fixed the Calendar MCP reference URL; browser-checked the five inconclusive external destinations (Miro article loads; Asana, Google Cloud, OpenAI and xAI reach sign-in/console screens). Authenticated destinations were not tested beyond those screens. - Replaced the Sandbox providers editorial TODO with a scope note and removed the CLI overview's unfinished-guide announcement. - Browser client navigation: 687 checks passed using installed Chrome. Initial launch lacked the downloaded Playwright browser; rerun used `DOCS_CHROMIUM_PATH` without changing the tests. - Nine representative connector/shared pages at 1440px and 390px: HTTP 200, one article H1, no page-level horizontal overflow. Mobile screenshot inspected; approval page opened in the Codex browser. - Navigation audit reports three existing non-connector orphan files; this patch does not alter those files or their navigation. The previous revision's provider-page expansion, Google shared setup guide, navigation additions, and accidental node_modules-symlink cleanup remain in this PR. Internal review ledgers remain outside the publication branch. No merge or production deployment authorized. --------- Co-authored-by: DevRel Gemini <[email protected]> Co-authored-by: Paperclip <[email protected]> Co-authored-by: Claude Opus 5 (1M context) <[email protected]> Co-authored-by: Michael Nguyen <[email protected]>
5.5 KiB
seo_title: Postman Connector seo_description: Connect Postman's hosted MCP server. Choose your region first, then a capability group: Minimal, Code, or Full. Setup, access, and a read test.
Postman
Agents can work with your Postman workspaces, collections, and environments — reading API definitions, and on the fuller capability groups generating code and making changes.
Two decisions come before credentials, and getting either wrong means starting over.
Decide region and capability group first
Region determines both the endpoint and how you authenticate:
| Region | Authentication |
|---|---|
| US | Browser sign-in |
| EU | API key — browser sign-in is not available on EU endpoints |
Capability group determines how many tools the connection exposes:
| Group | What it covers |
|---|---|
| Minimal | The smallest tool catalog — core workspace, collection, environment, mock and spec tools |
| Code | A toolset focused on generating code from API definitions |
| Full | The complete Postman API tool catalog |
Warning: Minimal is a smaller catalog, not a read-only one. Postman's own documentation describes it that way, and its published minimal list includes
createCollection,createWorkspace,putCollection,updateWorkspace,publishMock,duplicateCollectionandrunCollection. Choosing Minimal does not stop an agent creating, changing, publishing or running things. If you want a read-only posture, that comes from Paperclip's action settings, not from the group.
Start with Minimal anyway — a smaller catalog is easier for both you and the agent to reason about — but set the write actions it does contain to Ask first or Off when you finish setup.
The region and group are fixed on the connection. To change either, make a new connection.
Before you connect
- A Postman account with access to the workspaces you want agents to use.
- For the EU region, a Postman API key.
Connect Postman
- Open Connectors and select Postman.
- On the Access step, choose the identity and which agents may use the connection.
- Choose the option matching your region and capability group.
- For US, complete Postman's browser sign-in. For EU, paste your Postman API key.
Choose access
Workspace, collection, and environment reach comes from Postman: the connection sees what the authenticating account or key can see. Paperclip has no workspace picker, so narrow access by authenticating with an account that has access to fewer workspaces.
Warning: Postman environments commonly hold API keys, tokens, and passwords as variables. An agent that can read an environment can read those values. The controls that actually help here are authenticating with a limited account and keeping secrets out of shared Postman environments — alongside the discovered tool list and Paperclip's action permissions.
Toolsets differ by purpose; do not assume they form progressively broader permission tiers. Inspect the discovered actions for your selected endpoint. Review generated code before using it, and set permissions for each available action separately.
One tool deserves separate attention: runCollection is present in the Minimal list, and running a collection means issuing its requests against whatever the collection targets. Decide explicitly whether an agent should be able to do that, and set it to Off if not.
Set write and destructive actions to Ask first or Off on the Permissions tab. On this connector that is the read-only control. See Set action permissions.
Try it
List the Postman collections you can see and tell me how many requests are in the first one. Do not change anything.
Compare the collection list against what you see in Postman. This confirms the credential, the region endpoint, and the agent's permission at once.
Note: Illustrative task, not a recorded test result.
Troubleshooting and limitations
| Problem | Likely cause | Fix |
|---|---|---|
| Browser sign-in is not offered | You selected an EU option; EU endpoints require an API key | Use the EU key option, or the US region if the account is hosted there |
| Authentication succeeds but nothing is visible | The account is in the other region | Connect with the option matching where the Postman account is hosted |
| A tool you expected is missing | The connection uses a narrower capability group | Make a new connection with Code or Full |
| Writes are refused | The action is set to Ask first or Off | Check the Permissions tab. Do not expect the capability group to be the cause — Minimal contains write tools too |
| An agent changed or published something on Minimal | Minimal is a smaller catalog, not a read-only one | Set the write actions to Off on the Permissions tab |
| A workspace is missing | The authenticating account cannot see it | Grant access in Postman; no reconnect needed |
| Needs attention | The API key was revoked, or the sign-in expired | Select Reconnect |
Limitations: one region and one capability group per connection. No workspace selection in Paperclip. Do not infer read-only access from a capability group's name. Postman's own plan limits apply.