A model writing `.bru` by hand gets the shape right and the details wrong, and Bruno does not complain — it reads the keys it recognises and ignores the rest, so a request that looks complete can test nothing. This server imports Bruno's own grammar package, and every file it writes is parsed back with Bruno's own reader in the test suite. Edits are partial merges, so a field the writer does not model yet is not silently dropped on the next change.
An independent MCP server for Bruno collections that authors them as well as running them. It writes `.bru` and `.yml` files through Bruno's own grammar package rather than from a model's memory, and runs the requests in-process — no `bru` CLI, no Bruno GUI, no shelling out.
- Requests written by the server instead of guessed: `create_request`, `modify_request` with partial-merge so untouched fields survive, `delete_request`, and `read_request` returning structured JSON identical for both formats
- Environments as a first-class thing — `create_environment`, `update_environment` merging into what exists, `set_environment_variable`, `remove_environment_variable`, and `read_environment` with each variable's disabled and secret flags
- Scripts attached to a request: `add_test_script` for pre-request, post-response or tests, and `remove_script` to take one back off without touching the rest
- Whole suites in one call — `create_crud_requests` writes list, get, create, update and delete inheriting the collection's auth, and `create_test_suite` builds related requests with dependency ordering
- `run_collection` executes the requests and their test scripts, takes an ordered subset if you pass one, and reports per-request pass or fail
- Collections and inventory: `create_collection`, `list_collections` from Bruno's `workspace.yml`, `list_requests` returning absolute paths, `get_collection_stats` with counts by method and per-request detail
- Execution groups inside a single run — separate identities, environments, variable stores and cookie jars, serial or concurrent, with no leakage between them
- Auth exchanged in memory: bearer, basic, api-key, digest, OAuth 2.0 client-credentials and password grants, or inherited from the collection or folder
Node.js 22 or newer — CI tests 22.x and 24.x — and somewhere on disk for the collection. No account and no key. `npx -y @ostico/bruno-mcp` over stdio is the whole install; `npm install @ostico/bruno-mcp` pins a version instead. Both Bruno formats work and the server detects which one it is looking at: `.yml` opencollection and legacy `.bru`. What it leaves behind is a normal Bruno collection — `bru run` reads it in CI and the Bruno app opens it. Requests are SSRF-checked on every redirect hop, file paths are confined, and scripts run in a forked sandbox with a scrubbed environment.
One command — npx -y @ostico/bruno-mcp