Bruno MCP Studio

Add pre-request, post-response, or tests scripts to a Bruno request. Canonical scriptType values are pre-request/post-response/tests; the aliases before-request (→ pre-request) and after-response (→ post-response) are also accepted. Appends to any existing script of that type by default — pass scriptMode:"replace" to overwrite it, or use remove_script to clear it. Assertions must be wrapped in test("name", function() { ... }) to be reported. Scripts run as async functions: top-level await works, and bru.sleep(ms), setTimeout and setInterval spend the script timeout (settings.timeout, default 5000ms), which write_request's settings argument raises.

Create a new Bruno API testing collection with configuration. outputPath is the PARENT directory and name is appended to it: outputPath "/work/apis" with name "Billing" creates the collection at /work/apis/Billing. Do not put the collection name in outputPath as well. The new collection is also added to the workspace registry that `list_collections` reads rather than the disk, so a collection missing from it is invisible to that tool and to the Bruno app. The result says whether it was registered and, if not, why.

Create an environment file for a Bruno collection. Writes the WHOLE file, so it REFUSES a name that already exists rather than overwriting it — the error names the existing variables and which ones a replace would delete, so you can merge with update_environment, pick another name, or retry with overwrite: true.

Permanently delete a Bruno collection: the collection directory and everything inside it is removed from disk, and its workspace registry entry with it. Nothing here can be recovered through this server. Only a directory that is itself a collection root — one holding opencollection.yml or bruno.json — can be deleted. To keep the files and only stop the collection being listed, use unregister_collection instead.

Permanently delete request files from a Bruno collection. One confirm covers the whole list. Each file is unlinked and cannot be recovered through this server. Only .yml/.bru files inside a detected collection can be deleted. Every path is checked before the first unlink, so one unusable path deletes nothing. The result names each file's outcome. To clear a script and keep the request, use remove_script.

Get statistics about a Bruno collection — request counts by method, folders, environments, and per-request details including each request's file path and URL. environmentDetails lists each environment with the NAMES of the variables it declares, values withheld, so what an environment already defines is visible before merging into it with set_environment_variable. Use filePath values as entries in the requests list of run_collection. SIZE: the per-request array is the bulk of the response and grows with the collection — a few hundred requests run to tens of kilobytes. Narrow it with folder, method or nameContains, or pass includeRequests: false for counts only. The counts always describe the WHOLE collection; a filtered call adds matchedRequests so the two cannot be confused.

List the Bruno collections REGISTERED IN workspace.yml, with their names and paths. This is a registry listing, not a filesystem scan: a collection that exists on disk but is not registered will NOT appear, and registered entries that no longer exist are returned with "exists": false. A known absolute path works in the other tools without appearing here. Use the returned path as collectionPath in get_collection_stats, list_requests and run_collection.

List all request files (.yml/.bru) in a Bruno collection. Returns absolute file paths, each usable as an entry in the requests list of run_collection, or of one of its groups.

Relocate a request file to another folder, or to another collection entirely. Pass copy:true to duplicate it instead of moving it. The bytes are moved verbatim, nothing is parsed and rewritten, so seq arrives unchanged and may tie with a request already there; that is reported, and Bruno breaks such a tie by filename. The file keeps its name: use write_request with filename to rename it. The new path comes back in the response.

Read an environment back as structured JSON: every variable with its value, plus its disabled and secret flags. Omit "name" to list the collection's environments instead. Secret variables are returned by name only — no file format stores a secret's value, so there is none to return.

Read a single request file back as structured JSON: method, url, headers, query and path params, body, auth mode, scripts, assertions, vars, settings and docs. Both .bru and .yml return the same shape, so the on-disk format stays invisible. Use this before write_request to see current state, and after it to confirm what was written. A websocket or grpc request also carries its stored messages in full — title, content, and for a websocket the type and whether the runner will send it — under websocket.messages or grpc.messages, keyed as write_request accepts them. A "notes" array reports anything the file declares that the runner will not act on.

Remove a single variable from an existing Bruno environment. MERGES into the environment — all other variables are preserved.

Delete a pre-request, post-response, or tests script from a Bruno request, leaving the rest of the request intact, including duplicate blocks accumulated by appending. Canonical scriptType values are pre-request/post-response/tests; the aliases before-request and after-response are accepted. Removing all scripts also drops the now-empty script container.

Execute requests in a Bruno collection and run their test scripts. SUBSET: requests is an ORDERED list of .yml/.bru paths, absolute or relative to collectionPath; a directory expands recursively. Duplicates allowed, and run twice. Omit to run the whole collection. Pass requests OR groups, never both. GROUPS: one call, more than one identity or configuration. Each group owns its OWN variable store and cookie jar, so nothing a group sets — a bru.setVar, a session cookie — is visible to any other group. That is what makes running the same five requests as alice and as bob in one call safe. ITERATIONS: data or dataFile runs a group once per row, the row bound as variables. Each row is its own group — same name, own index, own iterationIndex — with that same isolation. Rows are independent: a failing row does not stop later rows. Ceiling 1000 rows per scope. PARALLELISM: parallel on the run fans groups out; parallel on a group fans that group's requests out. A group is serial unless it says otherwise, whatever the run does. seq no longer constrains execution — default order and reporting order only — so two requests in one parallel group run at the same moment and may contend on the store they share. startAfter holds a group until a named group has completed a given number of its requests, connecting a listener before a trigger fires; needs parallel on the run. Chains allowed; cycles, and gates that can never open, are refused before anything runs. If the group waited on ends early, the waiting group reports that as its error instead of starting. RESULTS are group-shaped: each groups[] entry carries its own summary, results, capturedVariableNames and capturedVariables; the top-level summary is the run. Run-wide warnings are top-level, so a captureVariables name is reported unset only when NO group set it. There is no top-level results array, not even with no groups. A crashed group reports error and counts as one failure. RESPONSE DATA: every result carries the response body (response_body, response_content_type, response_body_truncated) unless includeResponseBody is false; maxResponseBodyBytes caps it. Every result also carries response_headers, no test script needed; includeResponseHeaders false omits them, maxResponseHeaderBytes bounds one value, and includeResponseBody false bounds the body only, never the headers: credential-named values are masked, and set-cookie is a LIST — one entry per cookie — whose entries keep every attribute (HttpOnly, Secure, SameSite, Path, Max-Age) and withhold only the cookie value, so a cookie-flag or HSTS check is one call. A websocket result's response_headers hold its handshake response (the 101), the only place a session cookie or a negotiated sec-websocket-protocol is visible for that transport; a gRPC result reports metadata under grpc instead. ORDER: within a group, the order given; a directory expands by seq scoped to its own folder, subfolders before that folder's loose requests, ties by filename. An unparseable file is skipped when DISCOVERED (whole collection, or directory expansion): parseErrors counts them, parseFailures names each with its reason. A file you NAMED is not skipped: it fails the group that named it, reported as that group's error, and other groups still run. A named request that does not exist goes to that group's missingRequests and fails nothing. TRANSPORTS: http, graphql, grpc, websocket. Any other kind is refused per-request with status 0 and a named reason, leaving the rest of the group alone. A gRPC result carries grpc: status code (0 is OK and is NOT the refusal sentinel — status 0 with an error and no grpc detail is a refusal), method, redacted metadata. A websocket result carries websocket: transcript, stop_reason (count, timeout, bytes, closed, error) and truncated, true for the three that cut a session short. Frame contents are recorded only when websocket.includePayloads is on. ASSERTING ON A TRANSPORT: on a websocket result res.getBody() IS the transcript array and res.getStatus() is ALWAYS 0 — a session has no status, so a test on it asserts a constant and cannot fail. The outcome is res.getStopReason() (also res.stopReason and res.statusText, same string), res.getCloseCode() for the peer's close code (null when it sent none, ordinary for a session stopped by its own bound), and res.getSessionTruncated(). Each returns what that result's websocket detail reports. On a gRPC result res.getStatus() is the gRPC code, res.statusText the server details or code name, res.getBody() the parsed message. SIMULTANEITY IS PER CALL: groups plus parallel are the only way to make two things happen at the same moment. Two separate calls are not serialised by this server, and nothing here decides when the second starts: that is the client's scheduling, typically seconds apart. One identity listening while another triggers must be ONE call with parallel groups. Every result carries the path of the request file it came from. STOPPING EARLY: bail stops the run at the first request that fails or whose tests fail. Everything after comes back skipped: true, skipReason "bail", counted in summary.skipped and in neither passed nor failed; the run carries a bail object naming the reason, the request it stopped at and how many were skipped. Nothing cancels a request in flight, so under parallel the ones already started still finish and are reported normally. REPORT FILES: report also writes the run to disk — JUnit XML for CI, HTML for a person — at a path inside the collection; what was written comes back under reports. Outbound requests are SSRF-filtered: targets resolving to private, loopback, link-local or otherwise reserved addresses are refused unless the server operator has allowlisted them, and a refusal is reported per-request as an "SSRF blocked" error with status 0.

Set (add or update) a single variable in an existing Bruno environment. MERGES into the environment — all other variables are preserved.

Remove a collection from the workspace registry, leaving every file on disk untouched. list_collections reads that registry, so this is how an entry stops being listed, including a stale entry whose directory is gone. To delete the collection itself, use delete_collection.

Partially update an existing Bruno environment by MERGING the provided variables into the existing ones. Variables not listed are preserved, unlike create_environment, which replaces the whole file.

Create a request file or change an existing one (.bru and .yml). The locator decides which: collectionPath plus name creates, filePath changes what is already there. Creating never overwrites — an existing file is refused, so address it by filePath. Changing is a partial merge: only provided fields are updated and every other field is preserved. Pass requests to write a whole set in ONE call, not one call per request. Authors HTTP requests by default, WebSocket requests with kind "websocket" (url plus websocket.messages) and gRPC requests with kind "grpc" (url plus grpc.method, grpc.protoPath and grpc.messages); neither takes an HTTP method or a body. Supports multipart/form-data with file uploads and per-part contentType (body.type "form-data" with formData entries of type "file"), and inline scripts (pre-request/post-response/tests) so no separate add_test_script call is needed. Scripts run as async functions: top-level await works, and bru.sleep(ms)/setTimeout/setInterval spend the script timeout (settings.timeout, default 5000ms) — raise it via the settings argument. Inline scripts REPLACE the existing script of the same type by default, so repeated calls do not accumulate duplicate blocks; scriptMode:"append" concatenates instead, and remove_script clears one. RENAMING: name and filename are independent, as they are in Bruno itself — name changes the request's name inside the file and filename moves the file. Pass both to keep them in step, and read the new path back from the response.