Secrets are redacted
Variables prefixed with a tilde (~) in Tiger environment files are treated as secrets. Their values are never sent to the MCP client. The AI sees the variable name, confirming the slot exists, but cannot read the value.
Tiger ships a built-in Model Context Protocol server. Point any MCP-compatible AI assistant at your collection and it can list, inspect and execute your requests without leaving its own interface.
Model Context Protocol (MCP) is an open standard that lets AI assistants call external tools in a structured, auditable way. Instead of asking an AI to guess how to invoke something, you expose a typed set of actions it can call directly.
Three steps from zero to an AI assistant that can explore and run your API collection autonomously.
Clone the repo that holds your .tiger files, or import an existing Postman export. The MCP server starts automatically when Tiger launches; no separate process or configuration needed inside the app.
Drop a single JSON block into your Claude Desktop, Cursor or other MCP-compatible client configuration. Point it at Tiger's compiled server file and the collection path you want to expose.
The AI can now list every request in the collection, read the full definition of any request including headers, body schema and variable references, and fire a request against your target environment with a single tool call.
Response status, headers and body are returned directly to the AI's context window. It can interpret the response, chain follow-up requests, or surface errors without you switching windows.
Add the following block to your claude_desktop_config.json (macOS: ~/Library/Application Support/Claude/claude_desktop_config.json). Adjust the two paths to match your machine.
The command field points to the Node.js binary on your machine. The first argument is the path to Tiger's compiled MCP server module (inside the app bundle or the project's out/mcp/ folder). The second is the path to the Tiger collection directory you want the AI to access.
Secrets held in environment files are redacted before values are returned to the AI. The AI sees variable names, not secret values. If you want to allow the AI to actually send requests, set allowRun to true in the args.
Restart Claude Desktop after saving. The Tiger tools will appear in the model's tool list on the next conversation.
{ "mcpServers": { "tiger": { "command": "node", "args": [ "/Applications/Tiger.app/Contents /Resources/out/mcp/server.mjs", "/path/to/your/collection" ] } } }
The MCP server registers exactly four tools. Each has a typed input schema so the AI model can call them without guessing argument names or shapes.
| Tool name | What it does | Returns |
|---|---|---|
| list_requests | Returns every request in the collection grouped by folder, including name, method and path. | JSON array of request summaries |
| get_request | Returns the full definition of a single request: method, URL, headers, body, auth config and variable references. Secret values are redacted. | Full request object (secrets stripped) |
| run_request | Executes a request against the active environment and returns the response status, headers and body. Honors variable substitution and auth flows. | HTTP response (status, headers, body) |
| list_environments | Lists the environments available in the collection with their non-secret variable names, so the AI can confirm which environment is active before running requests. | Array of environment names and variables |
The MCP server is designed around least privilege. Here is exactly what is and is not exposed.
Variables prefixed with a tilde (~) in Tiger environment files are treated as secrets. Their values are never sent to the MCP client. The AI sees the variable name, confirming the slot exists, but cannot read the value.
The four tools cover reading collection structure and executing requests. There are no tools to write, delete or modify requests. The AI can explore and invoke, but cannot change your collection files.
The MCP server process runs on your machine. No data is sent to any Tiger cloud service because there is no Tiger cloud service. Communication is only between your AI client and the local Node.js process.
When run_request executes a call, the HTTP request travels directly from your machine to your target API, exactly as if you had pressed Send in the Tiger UI. No proxy, no intermediary. TLS, client certificates and proxy settings from Tiger's configuration apply as normal.
The collection path you pass in the config determines the scope. The MCP server can only access requests inside that directory. Other collections or files on your machine are not reachable.
Allowing an AI to execute real API requests carries the same risk as allowing any tool to do so. Review which environment is active before pointing an AI assistant at a production collection. Use a staging or sandbox environment for exploratory AI workflows.
Tiger's MCP server does not add authentication between the AI client and the server process. Anyone who can reach the local port can call the tools. This is standard practice for local MCP servers today, and consistent with how all other MCP tools in the ecosystem operate.
Cloud-based API clients cannot safely expose an MCP server because their collections live in a vendor cloud behind authentication. A local process with read access to your collections only makes sense when the collections are local. Tiger's git-native, file-based approach is what makes the MCP server practical.
| Client | Collections stored locally | MCP server included | AI can run requests locally |
|---|---|---|---|
| Tiger | YesNEW | Yes | Yes |
| Postman | Cloud-primary (local collections on paid tier) | No | No |
| Bruno | Yes | No | No |
| Insomnia | Cloud-primary, local mode available | No | No |
Table reflects publicly documented features as of June 2026. If any entry is wrong, let us know.
Download Tiger, open your collection, add the config snippet, and your AI client can start listing and running requests in under five minutes.