Kurlo MCP server

Kurlo

A fast, local-first desktop API client. No accounts, no cloud sync, no telemetry — just you and your APIs.

Built with Go, Svelte 5, and Wails.

Download

Grab the latest build from the releases page.

Every release ships SHA256 checksums and minisign signatures, and the in-app updater refuses any binary that fails either check.

The command line (kurlo run for CI, kurlo mcp for AI agents) is also on npm as @kurlo/cli, with prebuilt binaries for macOS, Linux and Windows on x64 and arm64. It does not need the desktop app:

npx -y @kurlo/cli --version

Guides, the scripting reference, and the YAML workspace format live in the documentation site.

Features

Requests

• All HTTP methods: GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS
• Query params, headers, body (JSON, form-data, x-www-form-urlencoded, raw text/XML/HTML, binary file)
• cURL import — paste a curl command into the URL field, it parses automatically
• Bulk edit for params, headers and form fields — switch the table to a key: value text area and back
• GraphQL, Server-Sent Events, WebSocket, Socket.IO, gRPC, and MCP request types — an MCP call discovers the server's tools, resources and prompts, seeds the arguments from the tool's schema, and shows the raw JSON-RPC exchange
• Postman, Insomnia, Bruno/OpenCollection, OpenAPI/Swagger, HAR, cURL, and all-data backup import paths
• OpenAPI/Swagger imports from a link as well as a file — paste the spec URL and Kurlo fetches it and builds the collection
• Postman, OpenAPI, OpenCollection, and all-data backup export paths

Authentication

• Bearer Token
• Basic Auth
• Digest Auth — MD5, SHA-256 and SHA-512-256 plus their -sess variants, with qop=auth and auth-int
• API Key — in header or query string
• OAuth 2.0 — Client Credentials, Authorization Code (with PKCE), Password, and Device Code grants; loopback browser sign-in, refresh tokens, and automatic token refresh before each send
• AWS Signature v4
• Client certificates (mutual TLS), per request or inherited from a collection
• Per-request and collection defaults with inheritance

Scripting — pre-request and test scripts in sandboxed JavaScript, with legacy Tengo support:

// pre-request: inject a header
pm.request.headers.set("X-Client", "kurlo")

// pre-request: rewrite and sign the body
pm.request.body.update(JSON.stringify({ ...pm.request.body.json(), nonce: pm.crypto.randomHex(8) }))

// test: assert status and shape
pm.test("status is 200", () => pm.response.to.have.status(200))
pm.test("has an id", () => pm.response.to.have.jsonSchema({ type: "object", required: ["id"] }))

require resolves bundled stand-ins for lodash, ajv, tv4, uuid, crypto-js, and chai, so imported Postman scripts keep working. pm.sendRequest makes an HTTP call from a script, and pm.execution.skipRequest() skips the send.

Shortened. The full README is on GitHub.