Kong Inc. today added an ability to test clients and servers based on the Model Context Protocol (MCP) to its open source Insomnia tool for designing, debugging and testing application programming interfaces (APIs).

Developed by Anthropic to provide artificial intelligence (AI) applications with a consistent method for accessing data, MCP is rapidly becoming a de facto standard as more of these applications are deployed.

Kong CTO Marco Palladino said adding native support for MCP to the latest Insomnia 12 edition of the platform now makes it possible to build and test MCP clients and servers using the same workflows DevOps teams are today using to manage other types of APIs.

In many cases, the pace at which MCP clients and servers are being deployed often outpaces the ability of DevOps teams to validate them, said Palladino. The result is a lot of misconfigurations that potentially create an opportunity for cybercriminals to exfiltrate massive amounts of often highly sensitive data, he added.

Insomnia 12 addresses that issue by now making it possible to connect directly to MCP servers, manually invoke any tool, prompt or resource with custom parameters, and inspect protocol-level and authentication messages and responses, said Palladino.

Additionally, DevOps teams can also create fully functional mock servers in seconds by describing requirements in natural language along with a URL, JSON sample, or OpenAPI specification.

Finally, Insomnia 12 also makes it possible to automatically generate clear, descriptive commit messages along with logical file groupings that, when needed, can be easily analyzed. A Git Sync capability ensures version control across multiple instances of MCP clients and servers.

The overall goal is to make it simpler to build and test MCP servers and clients that access multiple large language models (LLMs) in a way that still enables organizations to meet compliance requirements using, for example, role-based access controls (RBAC), he added.

The MCP protocol itself is still rapidly evolving, with updates being made on a quarterly basis. Kong is promising to ensure Insomnia compatibility across those updates as they continue to be made. That approach eliminates the need for the teams to test APIs and MCP to track those changes on their own, said Palladino.

It’s not clear just yet which teams within an IT organization will assume responsibility for managing MCP servers and clients, but in time, they will be programmatically managed in much the same way most APIs are managed today. The challenge is that as more organizations deploy artificial intelligence (AI) agents, the number of MCP servers and clients being deployed is going to rapidly increase. Arguably, it’s only a matter of time before significant mistakes are made that will be exploited by malicious actors who are starting to appreciate how MCP might provide a means to access large amounts of data throughout an enterprise.

Hopefully, best practices for deploying MCP servers and clients will soon be defined and adopted, but if history is any guide, there may be a number of significant incidents before organizations fully appreciate the full extent of the risk.