# api_newman_run Run a Postman/Newman collection against API endpoints. Agent View of the PolicyLayer registry record for `api_newman_run`. HTML page: https://policylayer.com/tools/zebbern-zebbern-kali-mcp/api-newman-run ## Facts - Tool: `api_newman_run` - Server: Zebbern Kali MCP (`zebbern/zebbern-kali-mcp`) — https://policylayer.com/tools/zebbern-zebbern-kali-mcp.md - Homepage: https://github.com/zebbern/zebbern-kali-mcp - Risk category: Execute (High risk) - Registry record: grade F, identity unverified - Server rate-limited: no - Parameters: 0 - Recommended policy verdict: Rate-limited ## Example call (MCP tools/call, JSON-RPC 2.0) ```json { "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "api_newman_run", "arguments": {} } } ``` ## Why api_newman_run is rated High This tool executes network operations and API calls whose side effects depend entirely on the contents of the Postman collection and target endpoints provided. An AI agent could use this to invoke arbitrary API actions (create accounts, modify data, trigger workflows, exfiltrate information) against any reachable endpoint. From the tool's own definition: "Tool name 'api_newman_run' with description 'Run a Postman/Newman collection against API endpoints' indicates execution of HTTP requests against external systems based on provided collection/endpoint arguments." ## Use case AI agents invoke api_newman_run to trigger actions in Zebbern Kali MCP. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call: builds kicked off, notifications sent, workflows started. ## Recommended policy (PolicyLayer) Verdict: **Rate-limited**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Zebbern Kali MCP: ```json { "version": "1", "default": "deny", "tools": { "api_newman_run": { "limits": [ { "counter": "api_newman_run_rate", "window": "minute", "max": 10, "scope": "grant" } ] } } } ``` ## Other tools on Zebbern Kali MCP (132) - `callback_clear` — Destructive — https://policylayer.com/tools/zebbern-zebbern-kali-mcp/callback-clear.md - `hosts_clear` — Destructive — https://policylayer.com/tools/zebbern-zebbern-kali-mcp/hosts-clear.md - `hosts_remove` — Destructive — https://policylayer.com/tools/zebbern-zebbern-kali-mcp/hosts-remove.md - `msf_session_destroy` — Destructive — https://policylayer.com/tools/zebbern-zebbern-kali-mcp/msf-session-destroy.md - `msf_session_destroy_all` — Destructive — https://policylayer.com/tools/zebbern-zebbern-kali-mcp/msf-session-destroy-all.md - `pivot_remove` — Destructive — https://policylayer.com/tools/zebbern-zebbern-kali-mcp/pivot-remove.md - `ad_asreproast` — Execute — https://policylayer.com/tools/zebbern-zebbern-kali-mcp/ad-asreproast.md - `ad_bloodhound_collect` — Execute — https://policylayer.com/tools/zebbern-zebbern-kali-mcp/ad-bloodhound-collect.md - `ad_kerberoast` — Execute — https://policylayer.com/tools/zebbern-zebbern-kali-mcp/ad-kerberoast.md - `ad_ldap_enum` — Execute — https://policylayer.com/tools/zebbern-zebbern-kali-mcp/ad-ldap-enum.md - `ad_password_spray` — Execute — https://policylayer.com/tools/zebbern-zebbern-kali-mcp/ad-password-spray.md - `ad_psexec` — Execute — https://policylayer.com/tools/zebbern-zebbern-kali-mcp/ad-psexec.md - `ad_secretsdump` — Execute — https://policylayer.com/tools/zebbern-zebbern-kali-mcp/ad-secretsdump.md - `ad_wmiexec` — Execute — https://policylayer.com/tools/zebbern-zebbern-kali-mcp/ad-wmiexec.md - `api_auth_bypass_test` — Execute — https://policylayer.com/tools/zebbern-zebbern-kali-mcp/api-auth-bypass-test.md - `api_ffuf_fuzz` — Execute — https://policylayer.com/tools/zebbern-zebbern-kali-mcp/api-ffuf-fuzz.md - `api_fuzz_endpoint` — Execute — https://policylayer.com/tools/zebbern-zebbern-kali-mcp/api-fuzz-endpoint.md - `api_graphql_fuzz` — Execute — https://policylayer.com/tools/zebbern-zebbern-kali-mcp/api-graphql-fuzz.md - `api_jwt_crack` — Execute — https://policylayer.com/tools/zebbern-zebbern-kali-mcp/api-jwt-crack.md - `api_kiterunner_scan` — Execute — https://policylayer.com/tools/zebbern-zebbern-kali-mcp/api-kiterunner-scan.md - `api_nuclei_scan` — Execute — https://policylayer.com/tools/zebbern-zebbern-kali-mcp/api-nuclei-scan.md - `api_rate_limit_test` — Execute — https://policylayer.com/tools/zebbern-zebbern-kali-mcp/api-rate-limit-test.md - `callback_check` — Execute — https://policylayer.com/tools/zebbern-zebbern-kali-mcp/callback-check.md - `callback_generate` — Execute — https://policylayer.com/tools/zebbern-zebbern-kali-mcp/callback-generate.md - `callback_latest` — Execute — https://policylayer.com/tools/zebbern-zebbern-kali-mcp/callback-latest.md - `callback_start` — Execute — https://policylayer.com/tools/zebbern-zebbern-kali-mcp/callback-start.md - `callback_stop` — Execute — https://policylayer.com/tools/zebbern-zebbern-kali-mcp/callback-stop.md - `callback_wait` — Execute — https://policylayer.com/tools/zebbern-zebbern-kali-mcp/callback-wait.md - `ctf_connect` — Execute — https://policylayer.com/tools/zebbern-zebbern-kali-mcp/ctf-connect.md - `ctf_submit_flag` — Execute — https://policylayer.com/tools/zebbern-zebbern-kali-mcp/ctf-submit-flag.md - …and 102 more: https://policylayer.com/tools/zebbern-zebbern-kali-mcp.md ## For agents This record is a snapshot. Live verdicts and the full registry: - Check every server in your MCP config at once: `npx -y policylayer stack` - Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md) - Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events` --- Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=zebbern-zebbern-kali-mcp · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/zebbern-zebbern-kali-mcp