Gostman, the open source API client.No account. No paid tier.
Gostman is a free Postman alternative for REST, GraphQL, gRPC and WebSocket. Collections are YAML files in Git, and secret values stay out of them.
Open source · macOS, Windows, Linux, and the web
Every protocol in one window
Any method, with JSON, form, multipart or file bodies, and the response as a tree, raw text or a preview.
Imports collections and specs from
- Postman
- Insomnia
- Bruno
- OpenAPI
- curl
- Hoppscotch
- HTTPie
- HAR
- .http
One YAML file per request, reviewed in pull requests. Diff, commit and push from the app, free.
Mark a variable as secret and only its name is saved. The value stays in your keychain or vault.
- 01
Reference
The YAML file holds only the variable's name, so Git never sees the value.
- 02
Resolve
At send time the value comes from your keychain or vault, on your machine.
- 03
Redact
Coding agents, run reports and share links see it masked.
Point your app at Gostman, watch each call arrive and save the ones you need.
Open the web app without signing up, and share a folder as an encrypted link or one HTML docs page.
Send and inspect
Variables and secrets
Test and automate
Your data and tools
From their public pricing and docs, October 2026.
- Included: Included
- Not included: Not included
| Feature | Gostman | Postman | Bruno | Insomnia |
|---|---|---|---|---|
| Price | Free and open source. | Free plan; paid from $9 a month. | Free plan; Pro $6, Ultimate $11 a month. | Free plan; Pro $12, Enterprise $45 a month. |
| Git push, data files, vaults | All free. | Shared Vault from Solo; vault integrations on Enterprise. | Git push and data files on Pro; secret managers on Ultimate. | Git Sync free for up to 3 users; vaults on Enterprise. |
| Share without Git | Included: Encrypted link or file. | On the Team plan. | Export a file. | Cloud sync with an account, or export a file. |
| Load testing | Included: Built in. | Included: Local runs free. | Not included: Not documented. | Not included: Not documented. |
| Socket.IO, MQTT, MCP | Included: All three. | Included: All three. | Not included: Not documented. | Socket.IO and MCP. |
| Web version | Included: No account needed. | Needs an account. | Not included: None. | Not included: None. |
| CLI for CI | Included: One binary. | Included: Postman CLI. | Included: Node.js package or Docker image. | Included: Inso CLI. |
| VS Code extension | Included: Yes, runs collections through the CLI. | Included: Yes. | Included: Yes. | Not included: Not documented. |
Something else? Ask on GitHub.
Who is Gostman for?
Developers and testers who want their API collections kept as files next to the code: backend developers checking their own endpoints, frontend developers working against a mock before the API exists, QA engineers running API tests in CI, and teams that review request changes in pull requests. It also suits teams that cannot keep collections in a vendor's cloud, and people who want their coding agent to use the same requests. It is not the right tool if you need hosted collaboration, single sign-on or scheduled cloud monitors, because Gostman has no accounts.
Is Gostman free?
Yes. Gostman is open source. Every feature is in the download, with no account, no licence key and no seat count.
What happens to my collections if Gostman stops being developed?
They keep working. A folder workspace is plain YAML in your own repository, the desktop app and the command line need no Gostman server, and collections export to Postman, Bruno, OpenAPI, HAR and .http files. The code is open source, so anyone can fork it and carry it on.
Where do my secrets and tokens go?
Mark a variable as secret and its value is kept in your operating system keychain on desktop, or in the browser's storage on the web. Only its name is written to the YAML file, so the value is never committed, exported or put in a share link. A variable you do not mark is saved as plain text in the environment file, so mark every token; a value that looks like a credential gets a warning with a one-click Mark as secret. A new workspace folder also gets a .gitignore that keeps .env files out of Git. OAuth tokens, cookies and history are never written to the folder, and Scan for secrets (also gostman scan) flags a credential typed into a variable before you commit or share.
Does the web version send my requests through a server?
By default, yes, and that includes any API token in the request. Browsers cannot call most APIs directly, so the web version relays each request through a small hosted proxy. Its code is open source in api/proxy.go and does not store the request or the response. It cannot reach localhost or private addresses. If you would rather your tokens never pass through a server you do not run, start gostman relay on your computer and choose it in the web app's preferences, or use the desktop app, which sends requests from your own machine.
Can I bring my Postman or Bruno collections?
Yes. Import Postman, Bruno (.bru files or the YAML format), Insomnia, OpenAPI, HAR, .http files and curl. Common pm.* and bru.* script calls are rewritten to Gostman's script API. An import only adds data, and it lists any scripts it carries before you accept them.
Can it run in CI?
Yes. gostman run sends a folder with its scripts and assertions, prints what failed and exits non-zero, with text, JSON, JUnit and HTML reports. The repository includes a GitHub Action and a Dockerfile.
Import from other clients, read secrets from your vault, run checks in any CI and hand requests to your coding agent.
Download the desktop app for Windows, macOS or Linux, or open the web version now. There is nothing to sign up for.
Open source · macOS, Windows, Linux, and the web
Desktop appbrew install --cask kunalgoesbyken/tap/gostmanCommand linebrew install kunalgoesbyken/tap/gostman-cli