hoppscotch-mcp-server
The Hoppscotch MCP Server implements the Model Context Protocol (MCP) to connect AI agents and coding assistants including Claude Code, Cursor, VS Code Copilot, GitHub Copilot CLI, and Gemini CLI directly to your Hoppscotch workspaces, collections, specifications, and environments.
Emerging. No concerning findings. Grades remain capped until the project builds reputation through adoption. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
hoppscotch
Source: github_repo_search
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock
HOPPSCOTCH_ACCESS_TOKENA Hoppscotch JWT to skip browser login (e.g. for headless/CI). A pat-… PAT does not work (REST-only).HOPPSCOTCH_ALLOW_PRIVATE_HOSTSSet true to disable SSRF protection so execute_request can reach loopback/private/self-hosted targets. Only on trusted input.HOPPSCOTCH_AUTH_TIMEOUT_MSHow long a tool call waits for browser sign-in before returning retry guidance (with the login URL once it is available). The local callback stays open ~5 min regardless, so a slower sign-in still completes.HOPPSCOTCH_DEFAULT_TEAM_IDDefault team ID for team-scoped tools when omitted from the call.HOPPSCOTCH_FIREBASE_API_KEYeither at build time (it gets baked into the bundle) orHOPPSCOTCH_MAX_RESPONSE_BYTESCap on the response body execute_request buffers; a body that would exceed it is cut off and flagged truncated. Two limits apply: the raw read stops at the cap plus a small internal redaction margin (bytes), and the returned redacted text is additionally capped at the same number of UTF-16 code units — byte-exact for ASCII bodies; a non-ASCII body can be cut below the byte figure by the raw read, or come back somewhat larger than it after redaction. (Raw bytes that only spill into the internal redaction margin but shrink back under the cap after redaction are complete, not flagged.)HOPPSCOTCH_SECRET_ALLOWED_ORIGINSComma-separated origins (e.g. https://api.example.com) allowed to receive secret environment values via {{var}} substitution in execute_request/validate_response. Unset ⇒ no restriction (secrets substitute freely). Set it to opt in: only the listed origins may then receive secrets; a secret referenced in a request to any other origin is refused.HOPPSCOTCH_SERVER_URLinstance, pass through the host's env flag (-e for Claude Code,HOPPSCOTCH_STRICT_ENVSet true to harden against a hostile working-directory .env: trust-sensitive vars (auth target/token, tool profile, SSRF/secret-egress toggles, default team) that a .env introduces are then ignored and must come from the real environment. Off by default; a .env is honoured in full.HOPPSCOTCH_TIMEOUTRequest timeout (ms).HOPPSCOTCH_TOOL_PROFILETool surface: minimal (22), core (default, 39), standard (38), or full (53). core covers CRUD + request execution + codegen + read-only team discovery; standard swaps in team administration + advanced collection ops; full is everything. core and standard are separate branches of full, not a ladder. An unknown value falls back to core with a stderr warning.[](https://m8ven.ai/mcp/hoppscotch/hoppscotch-mcp-server)?variant=verified to the badge URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check