Critical-risk tools in Postman

Critical severity Postman MCP Server 14 of 98 tools

14 of the 98 tools in Postman are classified as critical risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.

Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.

Tools at critical risk

delete_api Destructive

Delete an API
delete_api_comment Destructive

Delete an API comment
delete_api_version Destructive

Delete an API version
delete_collection Destructive

Delete a collection
delete_collection_access_key Destructive

Delete a collection access key
delete_collection_folder Destructive

Delete a folder from a collection
delete_collection_request Destructive

Delete a request from a collection
delete_collection_response Destructive

Delete a response from a collection
delete_environment Destructive

Delete an environment
delete_mock Destructive

Delete a mock server
delete_monitor Destructive

Delete a monitor
delete_schema_file Destructive

Delete a schema file
delete_server_response Destructive

Delete a server response
remove_pan_element Destructive

Remove element or folder from Private API Network

Attacks that target this class

Critical-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.

Destructive Action Autonomy
Privilege escalation via admin-only tools
Data exfiltration via tool chaining
Runaway Tool Loops

Critical-risk tools in Postman

Tools at critical risk

Attacks that target this class

More on Postman

Enforce policy on every Postman tool call.