Show HN: Gostman – Open-source API client with Git-friendly YAML collections

Tests, the command line, Git, mocks, captured traffic, sharing and your coding agent all work from the same files.

Add checks as plain rows, or write a script with test() and expect(). The results sit beside the response, so a broken contract shows up on the request that broke it.

Checks on status, headers, body and response time

Pre-request and post-response scripts, run in a sandbox

A runner in the app for a whole folder at once

The same checks in CI, from one binary

gostman run sends every request in a folder with its scripts, variables and cookies, prints what failed and why, and exits non-zero so the pipeline stops. There is no runtime to install.

Text, JSON and JUnit reports

Secrets passed from the environment, never stored in the collection

Linux, macOS and Windows builds on every release

Terminal

$gostman run orders-api --var-from-env PASSWORDPASS POST Auth/Sign in 200 OK 88 ms 2/2 checksPASS GET Account/Current user 200 OK 46 ms 3/3 checksPASS GET Items/List items 200 OK 46 ms 1/1 checksFAIL GET Items/Export items 500 Internal Server Error 91 ms 0/1 checks FAIL res.status equals 200 The value was 500Requests 3 passed, 1 failedChecks 6 passed, 1 failedDuration 290msexit 1

A collection you can read in a pull request

Open a folder and every request becomes a small YAML file: one file per request, one directory per folder. Commit it next to the code it tests and review changes line by line.

Tokens, cookies and history never reach the folder

A cloned folder runs no scripts until you trust it

The app, the command line and your agent all read the same files

orders-api/account/current-user.yaml

id: r-current-username: Current usermethod: GETurl: '{{base_url}}/me'assertions: - expression: res.status operator: eq value: "200" - expression: res.body.session operator: isStringpostScript: |- test('the session cookie was sent', () => { expect(res.body.cookieHeader).to.contain('session=') })

A mock server from the responses you saved

Save any response as an example, then start a local server that answers each route with it. Build the frontend before the API exists, and watch every request it makes arrive in the log.

Pick which example each route returns while the server runs

Optional delay and CORS for browser clients

Also available as gostman mock and to agents over MCP

Turn real traffic into a collection

Point your app at a local address and Gostman forwards every call to your API while listing each one live. Save any of them as a request, with its response kept as an example. There is no certificate to install.

Works for any app whose API base URL you can change

Authorization and cookie headers are never saved

In the desktop app and as gostman capture

Share it or publish it without an account

Send a folder as an encrypted link or file that is built in your own window and never uploaded, or turn the collection into a single documentation page you can host anywhere.

Variable values and saved responses stay out unless you include them

The recipient sees what is inside before importing

One self-contained HTML file, from the app or gostman docs

Hand the same collection to your coding agent

Claude Code, Codex and Cursor can call Gostman through MCP in place of curl. They use the collection you already have, and variable values and credentials are filled in inside Gostman and replaced with their names in everything the agent reads.

Cookies, tokens and variables carry across calls in a session

Responses are capped and can be narrowed to the fields that matter

Agents reach only the hosts your collection already uses, unless you allow more

Set up once, then ask in plain words

Create a workspace and register it with your agent$gostman init orders-api$claude mcp add gostman -- gostman mcp --workspace orders-api --var-from-env PASSWORDYouSign in, then send Current user, then run the Items folder. Quote the exact password value if you can see it anywhere.Claude CodeSign in returned 200 and set the session and theme cookies plus user_id. Current user returned Ada (id 42, roles admin and buyer). The Items folder ran 2 requests: List items passed, and Export items failed with a 500.I can't quote a password because none of these results contain one. Sign in's body wasn't returned, and the cookie values are redacted.

Everything is in the download

Gostman is open source. Every feature below is included, with no licence key and no seat count.