API Man is a 5 MB native Mac and iOS Postman-like client in Objective-C, with an MCP server that never shows AI agents your Keychain secrets

Sending one GET request should not cost 500 MB of disk. A developer posting on November 12, 2026 put it more politely: “I recently decided I didn’t need a 500 MB application to make API requests and made API Man for iOS and Mac.”

The post’s own title is “API Man: A native iOS/Mac Postman-like client without Electron,” which tells you which kind of app the developer was leaving. Electron apps ship a whole browser engine inside each install, which is how a request tool ends up the size of a small game.

API Man weighs in at “about 5MB of pure Obj-C code,” by the developer’s count. That is one hundredth of the figure it was reacting to. The same sentence carries the catch: “It lacks Grpc but beyond that it should be close ot parity with Postman.” (The typo is the developer’s, and so is the claim.)

The feature list backs up the parity talk. It sends REST, GraphQL, WebSocket and server-sent events requests, with several auth types including OAuth 2.0, JWT and AWS Signature V4. It has collections, variables, response chaining, assertions and a Collection Runner, and it keeps run history on the device. Responses open as JSON, XML or HTML, with JSONPath and jq filtering. Proxies, client certificates (mTLS) and cookie jars per environment are in there too.

Moving in is the cheap part. The post lists imports from Postman, OpenAPI 3 and Swagger, Bruno, OpenCollection, HAR files and cURL. Your data syncs over iCloud only “if you decide to turn that on.”

The part aimed at this year’s workflow is the MCP support. API Man can connect to MCP servers over HTTP. On the Mac, you can “turn on a built-in MCP server so AI agents can create and edit your requests and read your run history.” The server is fenced in: “The Mac server stays on your computer and requires a token.” Secret values sit in the Keychain, and per the post, agents “never see your secret values and can’t send requests or change auth.”

So an agent can rewrite a request and read how the last run went, but it can’t fire the request or touch the credentials. That is a sensible split for a tool whose whole job is holding API keys.

It is “currently in public beta on TestFlight,” so anyone with an iPhone or a Mac can join through the link in the post. The post says nothing about a price, which leaves what the app costs once the beta ends as the one open question.

Expect API clients to split into two camps: the ones that bundle a browser and the ones that use the system’s own frameworks. The Keychain is the reason a native client can offer agents a safe lane at all, since the operating system already guards the secrets and the app only has to withhold them.

The agent angle will probably spread. Once one client lets an agent edit a request but not send it, the rest face an obvious question about why their own agent hooks can fire calls with live credentials. A review step between “agent wrote it” and “request went out” costs almost nothing to build in.

The gRPC gap is the thing to watch before anyone switches a team over. A client that skips it suits a REST shop and shuts out one that talks gRPC all day, whatever the app weighs.

Same GET request, 495 MB lighter.