Kurlo

The open-source API client with an agent inside. Bring any model, Claude Code or Codex. No account, no paid plan, no telemetry. Collections live as YAML in your Git repo.

Download · Website · Docs · Agent mode · MCP server · Compare

New in 3.0: Agent mode

Ask in plain words and the agent runs your requests and collections, explains why a call failed, writes requests and tests and imports your specs, right inside Kurlo. Pick the Kurlo agent on your own model (OpenRouter, an API key, Ollama or LM Studio), or connect the Claude Code or Codex you already use. Every change and every call other than GET, HEAD or OPTIONS waits for your approval, and the model never sees your secrets.

Agent mode on kurlo.dev · Agent guide

Related MCP server: Reqly

Why Kurlo

• An agent that asks first. The Kurlo agent, Claude Code or Codex works on your collections inside the app. It shows every change before it is written, can follow a plan you approve and work on its own Git branch, and keeps chats on your machine.

• Free for a team of any size. There is no paid plan to grow into and no account to create. A team shares a workspace through any Git host, and every request is a readable YAML file that gets reviewed in the same pull request as the API change.

• Your Postman collections keep working. Import a Postman, Insomnia, Bruno, OpenAPI or HAR file. pm.test, pm.expect with chai, pm.sendRequest and require('lodash') run as they were written.

• Or drive it from your terminal. kurlo mcp lets Claude Code, Cursor, Codex and any other MCP client run your saved requests with their auth and tests, write new requests and tests, and explain why the last call failed. Secrets are sent to the API but never shown to the model.

• Small and native. Built with Go and the system WebView instead of Electron, so the macOS download is 25.1 MB and the Linux one is 13.3 MB.

Checked against vendor pricing pages on 15 October 2026. Details and sources: vs Postman, vs Insomnia, vs Bruno.

If Kurlo saves you time, a ⭐ helps other people find it.

Download

Grab the latest build from the releases page.

Every release ships SHA256 checksums and minisign signatures, and the in-app updater refuses any binary that fails either check.

The command line (kurlo run for CI, kurlo mcp for AI agents) is also on npm as @kurlo/cli, with prebuilt binaries for macOS, Linux and Windows on x64 and arm64. It does not need the desktop app:

npx -y @kurlo/cli --version

Guides, the scripting reference, and the YAML workspace format live in the documentation site.

Features

Requests

• All HTTP methods: GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS

• Query params, headers, body (JSON, form-data, x-www-form-urlencoded, raw text/XML/HTML, binary file)

• cURL import — paste a curl command into the URL field, it parses automatically

• Bulk edit for params, headers and form fields — switch the table to a key: value text area and back

• Suggestions while you type — the rest of a URL from history and saved requests, and the next JSON key from saved examples

• GraphQL, Server-Sent Events, WebSocket, Socket.IO, gRPC, and MCP request types — an MCP call discovers the server's tools, resources and prompts, seeds the arguments from the tool's schema, and shows the raw JSON-RPC exchange

• Postman, Insomnia, Bruno/OpenCollection, OpenAPI/Swagger, HAR, cURL, and all-data backup import paths

• OpenAPI/Swagger imports from a link as well as a file — paste the spec URL and Kurlo fetches it and builds the collection

• Postman, OpenAPI, OpenCollection, and all-data backup export paths

Authentication

• Bearer Token

• Basic Auth

• NTLM (NTLMv2)

• Digest Auth — MD5, SHA-256 and SHA-512-256 plus their -sess variants, with qop=auth and auth-int

• API Key — in header or query string

• OAuth 2.0 — Client Credentials, Authorization Code (with PKCE), Password, and Device Code grants; loopback browser sign-in, refresh tokens, and automatic token refresh before each send

• AWS Signature v4

• Client certificates (mutual TLS), per request or inherited from a collection

• Per-request and collection defaults with inheritance

Scripting — pre-request and test scripts in sandboxed JavaScript, with legacy Tengo support:

// pre-request: inject a header
pm.request.headers.set("X-Client", "kurlo")

// pre-request: rewrite and sign the body
pm.request.body.update(JSON.stringify({ ...pm.request.body.json(), nonce: pm.crypto.randomHex(8) }))

// test: assert status and shape
pm.test("status is 200", () => pm.response.to.have.status(200))
pm.test("has an id", () => pm.response.to.have.jsonSchema({ type: "object", required: ["id"] }))

require resolves bundled stand-ins for lodash, ajv, tv4, uuid, crypto-js, and chai, so imported Postman scripts keep working. pm.sendRequest makes an HTTP call from a script, and pm.execution.skipRequest() skips the send.

Environments & Variables

• Multiple environments per workspace, switch with one click

• Environments inherit the variables they do not set from another environment, such as Staging from Base

• Matrix view — every variable as a row, every environment as a column, edited in place

• {{variable}} template syntax in URLs, headers, params, body, auth fields

• Set variables from test scripts (pm.variables.set, pm.environment.set)

• Manual-save and autosave modes both cover request and environment edits

Workspaces & Collections

• Multiple workspaces for separate projects or clients

• Collections with nested folder hierarchy and empty-folder preservation

• Folder defaults — headers, auth, scripts and tests on a folder apply to every request inside it

• Drag-and-drop organisation

• Request history — every send on its own page, request and stored response side by side, reopenable in the editor (14-day retention, 1000 entries)

• Collection runner — sequential or parallel, data files, iterations, an HTML report, and the last run of every collection kept

• Load testing with k6 — collection flows with extraction and checks, virtual users or iteration rates, thresholds, CSV/JSON data, script export, local runs and last-run reports

• Git-backed YAML workspaces with diagnostics, conflict helpers, and local-only secrets; branch, commit, pull, push and open a pull request from the app

• CLI runner — npx -y @kurlo/cli run ./workspace --env CI executes requests and their test scripts for CI, with data-driven iterations (--data), pretty/JSON/JUnit reporters, variable export, and a non-zero exit code on failure. kurlo load list|export|run lists collection load tests, exports k6 scripts or runs local k6 with threshold results and reports

Agent mode — new in 3.0. Pick the Kurlo agent on your own model (OpenRouter, an API key, or Ollama and LM Studio), or connect the Claude Code and Codex CLIs you already use with their own accounts, and ask in plain words. The agent runs requests and collections, explains failures, writes requests and tests, imports OpenAPI, Postman and HAR files, and reads a connected project folder. It asks before every change and every call other than GET, HEAD or OPTIONS, can follow a plan you approve, work on its own Git branch and call your own MCP servers. Trusted hosts and sandbox environments run without asking, protected environments are off limits, and secrets reach the API while the model sees [secret]. Chats stay encrypted on your machine, and Activity lists every tool call with the files it changed and a way to restore them. See the agent guide.

AI agents (MCP server) — the Kurlo binary is also a Model Context Protocol server, so Claude Code, Codex, Cursor, Claude Desktop or any other MCP client can list your collections and environments, run saved HTTP, GraphQL, unary gRPC, MCP and AI requests, run collections with CSV or JSON data, and send one-off calls with your {{variables}}. It can start and compare k6 runs and serve saved examples from a local mock. In the desktop app, Agent Mode can also exchange messages on live connections. It can also keep the workspace up to date: add and change requests with their pm.* tests, save responses as examples and set environment variables, in the same YAML the app writes, never storing a secret. It can preview and apply imports, read a connected project folder, edit Markdown docs and generate snippets. It reads the last request you sent from the app, so "why did that fail?" needs no copying. Secret values are sent to the API but masked as [secret] in everything the model sees, and environments you mark protected are off limits. One command sets up every client on the machine:

npx -y @kurlo/cli mcp install --env Staging

Add --project to write a repository's shared .mcp.json and .cursor/mcp.json instead, so the whole team gets the server by cloning. Manual setup, the tools and the flags are covered in the MCP server guide.

Response examples — save any response as a named example on its request: the status, headers and body it came back with, alongside the request that produced it. Secrets are redacted on capture, a clean body is stored byte for byte, and examples ride along through Postman, OpenCollection, HAR and OpenAPI imports and exports. A response can be diffed against an example instead of against the previous send.

Cookies — a per-workspace cookie jar with a per-domain editor, disableable per request.

• Cookie sync: pair Kurlo with the in-repo browser extension (apps/desktop/extension, Chromium + Firefox) and the session you already have in the browser is the session Kurlo sends with. A loopback-only bridge that stays off until you turn it on, an approval you give in Kurlo by matching a six-digit code, and a per-domain allowlist enforced on both sides. Cookies travel one way: browser into Kurlo.

Mock server — serve a collection's saved examples over HTTP on a local port, so a client can be built against an endpoint that does not exist yet. Routing is by method and the example's path template (/orders/:id), a recorded query narrows which example answers, and a live log shows what the client asked for and which example replied. Loopback only; CORS preflight is answered for any origin.

Response viewer

• Syntax-highlighted body with line numbers

• Paginated rendering for large responses (512 KB pages, once a response exceeds 10 MB)

• Full-text search with match navigation

• Save response to file, copy to clipboard

• Headers table, test results, script logs — all in one panel

• Preview tab for HTML, images and PDFs; binary bodies are detected rather than rendered as mojibake

• Diff against the previous response or a saved example

• Timeline with connection details and the request as it went on the wire, secrets masked, one block per redirect hop

• Realtime panels for SSE, WebSocket, Socket.IO, and gRPC responses, with saved WebSocket and Socket.IO messages kept in the request

• Filter JSON responses with JSONPath or jq-style paths such as .items[].id

Code generation — copy the current request as a runnable snippet in one of 14 targets: cURL, HTTPie, JavaScript fetch, Node.js fetch, Axios, Python requests, Go net/http, Java OkHttp, C# HttpClient, PHP cURL, Ruby Net::HTTP, Swift URLSession, Kotlin OkHttp, and Rust reqwest. Secret variables stay as {{name}} placeholders.

Browser request emulation — send with a browser's rules instead of a client's: an Origin header, CORS preflight and response checks, and Content Security Policy enforcement, so a request can reproduce what the browser will do before the frontend is written.

Settings per request: HTTP version (auto / 1.1 / 2), SSL verification, redirect policy (follow, preserve method, preserve auth), cookie jar, timeout, proxy, URL encoding.

Keyboard-first: all actions have configurable shortcuts. A command palette (Cmd/Ctrl K) finds requests and runs commands, quick send (Cmd/Ctrl Enter), focus the URL (Cmd/Ctrl L), tab switching (Cmd/Ctrl 1–8, with 9 for the last tab). Kurlo shows Cmd on macOS and Ctrl on Windows and Linux.

Dark and light themes, with multiple built-in variations.

Local-first storage — the local Kurlo profile and its secrets are encrypted at rest with AES-256-GCM. The key is stored in the OS credential store when available and also kept as a 0600 recovery file in Kurlo's app-data directory. Git-backed workspace YAML is intentionally human-readable; secret values are replaced with local placeholders.

Building from source

Prerequisites

• Go 1.25+

• Node.js 22.12+

• Wails v2 — go install github.com/wailsapp/wails/v2/cmd/wails@latest

• macOS: Xcode Command Line Tools

• Windows: NSIS (for installer builds) and Windows SDK (for MSIX packaging/signing tools)

• Linux: libgtk-3-dev, libwebkit2gtk-4.1-dev

Dev mode (hot-reload frontend + Go backend):

git clone https://github.com/stormhop/kurlo
cd kurlo
npm install
make dev

Production build for the current platform:

make build

All platforms (requires each platform's toolchain):

make build-all

Run everyday checks — lint, frontend types, unit tests and Go tests run concurrently, with Go's test cache enabled:

make check

Run the full test suite, including the Go race detector and Chromium/WebKit:

make check-full

Browser tests run against a production build of the frontend that Playwright builds and serves on each run, so they do not keep a dev server compiling modules for every page. Locally they record no video or trace; set KURLO_E2E_TRACE=1 to keep them for failures (npm run test:e2e:failed does), and KURLO_E2E_SERVER=dev to test against the Vite dev server, which the --ui and --debug modes use. Browser tests use up to four workers locally and two in CI. Override this with --workers=2; use --workers=1 for isolated performance comparisons. Screenshot-generation and profiling modes default to one worker. On a memory-constrained machine, make check CHECK_JOBS=1 runs the independent checks sequentially. Go tests already run packages in parallel; tests sharing process-wide environment variables stay sequential within a package. Go caches successful runs; add GO_TEST_FLAGS='-count=1' only when a fresh run is needed.

See make help for every available target.

Project layout

apps/desktop/               Wails v2 desktop application
apps/desktop/main.go        Entry point, window config, native menus
apps/desktop/cmd/kurlo/     Headless CLI (run, load, mcp) published to npm as @kurlo/cli
apps/desktop/internal/
  api/                      HTTP executor, auth, request store, state
  api/auth/                 Bearer, Basic, Digest, API Key, OAuth2, AWS SigV4
  model/                    Shared Go types (request, response, auth config)
  script/                   JavaScript/Tengo scripting engines + pm.* API
apps/desktop/frontend/src/
  App.svelte                Root shell and layout
  lib/stores/app.svelte.ts  Composed app view-model
  lib/stores/features/      Feature slices for requests, collections, Git, import/export, etc.
  lib/components/           UI components
  lib/backend.ts            Wails bridge type definitions
apps/desktop/extension/     Cookie Sync browser extension (MV3 + Firefox event page)
apps/web/                   Astro Starlight documentation site
npm/cli/                    The @kurlo/cli npm launcher; scripts/build-npm-packages.mjs adds the binaries
schemas/                    Public Git/YAML workspace JSON Schema
perf/                       Generated performance fixtures (ignored by Git)

Scripting API reference

Scripts run in a sandboxed JavaScript environment by default, or in the legacy Tengo engine for existing requests. Imports, filesystem, process, and network access are disabled. Execution timeout: 2 seconds by default, configurable per request up to 60.

The full surface — every method, the variable-scope precedence rules, and the Chai-style assertion aliases — is in the scripting API reference. The short version:

require resolves bundled stand-ins for lodash, ajv, tv4, uuid, crypto-js, and chai. There is no event loop: setTimeout, async and await are not available, and pm.sendRequest's callback runs immediately.

Contributing

Bug reports, feature requests, and pull requests are welcome. Start with CONTRIBUTING.md — it covers the dev setup, what CI enforces, and how to scope a change. Everyone taking part is expected to follow the Code of Conduct.

Found a security problem? Please don't open a public issue — see SECURITY.md for private reporting instead.

License

MIT