CEO and Founder, Postman (https://xitter.cf/t.co/1ygwZGcDcJ)
San Francisco, CA
Joined March 2008
- Tweets3.2K
- Following767
- Followers13.3K
- Likes2.9K
Pinned Tweet
.@getpostman is now natively available in your favorite coding agent!
The new Postman CLI is designed to bring API engineering for agents:
1️⃣ Works in Git and your code repo - Just drop Postman where your agent lives and works.
2️⃣ No GUI - Work in your coding agent. Bring up the Postman UI for review and approval.
3️⃣ No sign-up - Get started right away. Sign-up when you have to save your work and want more.
Install once, work in your agent. Run npm install -g postman-cli, then postman init. This loads Postman's skills into your coding agent so it can create collections, write tests, and much more. Available as a plugin for all coding agents!
The skills cover the API lifecycle: find APIs your org already has, generate tests that catch regressions, mock an API before it exists, watch live endpoints for downtime and drift, run checks in CI on every commit, and run performance tests.
You can also extend the abilities of your agent with the Context Graph. An agent often sees only the code that is accessible to them. The Context Graph API gives it a map of your team's infrastructure, APIs, and services, and how they depend on each other.
As your agent works, you stay the reviewer. Your agent does the work from the command line. Open Postman when you want to review or approve it.
Check out more at postman.com!
Seeing people shit on human developers who “hand-wrote” code to build working software as security issues come to light. (Of course, the fact that code is fed to LLMs to train is conveniently forgotten).
I am assuming the same people will also hold LLMs accountable when issues appear in code that nobody is apparently reading anymore.
Many people figuring out what API keys mean and how to rotate them. Better to just usepassport.ai
Abhinav Asthana retweeted
We just raised a $60M Series B at a $1B valuation to build @daytonaio into the Agent Cloud.
@FirstMarkCap led the round, with all key existing investors and angels doubling down.
We're also thrilled to welcome the founders of some generational companies aboard, including @patrickc (Stripe), @tobi (Shopify), @AravSrinivas (Perplexity), @BrendanFoody (Mercor), @oliveur (Datadog), @adamdangelo (Quora) and @ericsyuan (Zoom)
We're a 35-person team. But that's about to change; we're hiring across the board, and we'd love for you to join us.
Sucks to hear. Avoids this and usepassport.ai
API keys need to stay inside vaults and never be in circulation.
FINALLY found how my key got leaked and got the $90,000 bill from google
Opus 5.5 said codex had PUBLISHED MY ****ING .ENV TO CLOUDFALRE PAGES ‼️
Meanwhile codex couldn't find anything, refused to explain itself and flagged my chat for cybersecurity risk lol
How Postman governs AI agent access to 42 production systems. Check out how we use Passport at Postman: app.usepassport.ai/customer-…
If you don’t control your agents, agents control your company. Reiterated at postman.ai
Or start with Passport from @getpostman - usepassport.ai
Every vibe coder's pre-launch prompt:
"Claude, before I launch, do these 20 things:
1. Hide every API key. Nothing in the frontend, nothing in git
2. Rotate any key that was ever committed
3. Turn on rate limiting so one user can't burn my bill
4. Check auth on every route not just the UI
5. Lock down database rules so users only see their own data
6. Validate every input on the server
7. Add a spending cap on my AI provider
8. Make sure errors don't leak stack traces
9. Set up error tracking so I know before users tweet
10. Back up the database and actually test a restore
11. Add a 404 and a 500 page that don't look broken
12. Make it work on a cheap Android phone
13. Fix anything that takes more than 3 seconds to load
14. Add meta tags + OG image so links look good on X
15. Add privacy policy + terms (yes, really)
16. Set up analytics so I know where people drop off
17. Test signup, payment and password reset end to end
18. Make sure emails don't land in spam
19. Add a way for users to contact me
20. Write a rollback plan in case launch day goes wrong
Make no mistakes."
Funny thing is, this is genuinely the whole checklist.
Bookmark this + send it to a friend launching this week.
If you are building or using agents, you are likely dealing with credential sprawl. With Passport, not only did we fix credential sprawl and eliminated risk, we also found out who is using which API across humans, machines, and agents.
Read on to find out what we encountered at Postman and how we solved:
1. Building an inventory of secret sprawl
2. Identify human and agentic access
3. Control and enforcement through agentic workflows
blog.postman.com/credential-…
I am all for new ideas and innovation but performative efficiency on productivity is tiring and a disservice to everyone.
Real questions to ask people peddling the newest non-revenue metric on their efficiency through agents on building things:
1. How is this different?
2. How much money do you make from this?
3. Are you paying API pricing for tokens or maximizing subsidized tokens?
4. What happens when your thing breaks?
Tests that are not verified by humans are not tests. Eventually something will break in reality and that is the actual test. The cost of that failure is what teams need to walk back from and determine what’s worth doing or not doing.
Also, you are still liable for the stuff your agent wrote.
IMO the only tests you should have in the age of coding agents are, in order of priority:
1. Full E2E tests. Nothing mocked out at all. Can even be something that runs in prod on test accounts via Playwright or equivalent.
2. Integration tests. Agents make more mistakes as things bleed between data/API boundaries where schemas can drift.
3. Golden tests. This helps ground the code with real examples of data, and can be used as regressions against edge cases.
Unit tests are bloat 99% of the time if you’re using a frontier model since they’re smart enough now to get the implementation (and subsequent iterations) right on the first shot, so they only add bloat at this point.
Abhinav Asthana retweeted
Super pumped that @getpostman runs thier context graph ingestion in Daytona.
Amazing to work together @a85 !
I am excited to announce the launch of the Postman Context Graph API!
The Context Graph API lets an agent see your API ecosystem as a connected system. You do not need to replace your model, agent, or IDE. You give the tools you already use access to the graph, and they can reason across services, APIs, deployments, runtime calls, and external systems that were previously invisible to them.
I am excited to announce the launch of the Postman Context Graph API!
The Context Graph API lets an agent see your API ecosystem as a connected system. You do not need to replace your model, agent, or IDE. You give the tools you already use access to the graph, and they can reason across services, APIs, deployments, runtime calls, and external systems that were previously invisible to them.
The model also did less work to get there. Across the benchmark, Opus cost 27% less with the Context Graph and Astra cost 20% less. On the HTTP-endpoint question, Opus went from $37 per run to $10, used about a quarter of the input tokens, and made half as many tool calls. Once the graph pointed it in the right direction, it did not need to burn time and tokens rediscovering the ecosystem one search at a time.
Checkout the Context Graph API here along with instructions to integrate your agents: postman.com/context-graph/