RestRuno

Desktop REST client (Windows & macOS) — Postman/Bruno style, with 100% local collections, variables, scripts, a data-driven runner and CSV generation.

Free and Pro

RestRuno is free for everyday work: collections, requests, environments, variables, scripts with tests, Postman/Bruno import/export, cookies and console. Two advanced features are part of RestRuno Pro (one-time payment, license for 2 devices):

Buy RestRuno Pro — $20 — one-time payment, updates included, 2 devices. The purchase is processed by Polar and you receive your license key by email; activate it in the app with the Upgrade button in the top bar. Terms of use in the license (EULA).

For your team? RestRuno Enterprise — $149: one-time payment, 25 seats (a single key for the whole team, 50 activations), simple rollout and priority email support.

Installation and updates

Install (the buttons on restruno.com detect your system, or download from the latest release):

• Windows: restruno-X.Y.Z-setup.exe — one-click installer (Windows will show "unknown publisher" since the app is unsigned: More info → Run anyway).
• macOS: restruno-X.Y.Z-arm64.dmg for Apple Silicon (M-series chips) or restruno-X.Y.Z-x64.dmg for Intel Macs — open the dmg and drag RestRuno to Applications.

Updates:

1. Automatic and silent: shortly after you open the app (once it has finished loading, so startup is never slowed down) it checks this repository; if there is a new version it is fully downloaded in the background.
2. When the download is ready, an orange Update button appears in the bottom-right corner: click it → it installs and the app restarts. If you never click it, the update installs itself when the app closes.
3. Check manually: click the version number (vX.Y.Z) in the bottom-right corner. It tells you right away if there is a new version (and starts the background download), if you are up to date, or the error if there is no connection.
4. The Docs button (top bar) opens this documentation in your browser.

Collections

A collection is a folder on your disk that you choose. Every request is a readable *.rr.json file; subfolders are folders. You can version them with Git or back them up by copying the folder.

Requests

• URL and Params in sync: add params in the Params tab and they appear in the URL (and the other way around — type ?a=1&b=2 in the URL and the table fills in).
• Auth: None, Bearer Token or Basic (accepts {{variables}}).
• Body: JSON, XML (SOAP), GraphQL (query + JSON variables), plain text, form-url-encoded or multipart form (text fields and files). Visible Content-Type selector, Beautify button for JSON/XML, and the exported cURL uses -F for multipart.
• Send: Send button or Ctrl+Enter · Save: Save or Ctrl+S (the orange dot on the tab means unsaved changes).
• Copy as cURL: cURL button — copies the command with every variable resolved to its current value.
• Paste a cURL: paste any curl command into the URL field and the method, URL, params, headers, auth and body are configured automatically.
• Response: status, time, size, date/time and final URL (both hideable with the ⏱ and URL buttons), formatted body, headers, test results and console. The panel can sit below or to the side (⬓/◨ button in the top bar).

Variables

{{variable}} syntax in URL, params, headers, auth and body. Precedence (highest wins):

runtime (scripts) → data file row → collection → environment → globals

• Globals: Globals button (apply to every collection).
• Environment: selector at the top right; managed in Manage Environments (per collection). From there you can also copy variables to another collection (selected ones or all).
• Collection: right-click the collection → Collection Variables.

Scripts (Scripts tab of each request)

Two panels: Pre Request (before sending) and Post Response (validations). Each panel has a Snippets… menu with ready-made examples and a ⛶ button to maximize it.

// Pre Request
rr.variables.set('token', 'abc');              // runtime: memory only, flows between requests
rr.variables.setGlobal('key', 'value');        // saved to globals (globals.json)
rr.variables.setEnvironment('token', 'abc');   // saved to the ACTIVE ENVIRONMENT (environments/<name>.json)
rr.request.headers['X-Trace'] = '1';           // modify the outgoing request

// Post Response (tests)
rr.test('status is 200', () => rr.expect(rr.response.status).toBe(200));
rr.test('has id', () => rr.expect(rr.response.body.id).toBeDefined());
rr.variables.set('token', rr.response.body.token);  // chain login → next request

rr command reference

Scripts are synchronous JavaScript in a sandbox. There is no require/import/fetch/process/setTimeout, no async/await, and no network access. 5-second timeout.

Variables (work in pre and post):

Values are stored as text — use JSON.stringify(obj) if you need to store an object, and JSON.parse(...) when reading it.

Pre Request — modify the request before sending it (pre script only):

Post Response — read the response (post script only):

Tests (post) — every rr.test is reported as pass/fail in the runner and the response panel:

• rr.test('name', () => { ... })
• rr.expect(actual) with matchers: .toBe(x) (strict ===), .toEqual(x) (deep comparison), .toContain(x) (array item or substring), .toBeDefined(), .toBeLessThan(n), .toBeGreaterThan(n), .toMatch(regexOrStr), and the negation prefix .not (e.g. rr.expect(s).not.toBe(500)).

console.log/info/warn/error(...) is captured and shows up in the global console.

Full example (post-response of a login that stores the token persistently):

rr.test('login OK', () => rr.expect(rr.response.status).toBe(200));
rr.test('returns token', () => rr.expect(rr.response.body.access_token).toBeDefined());
rr.test('content-type json', () =>
  rr.expect(rr.response.headers['content-type']).toMatch(/application\/json/));

// store the token in the active environment for the next requests:
rr.variables.setEnvironment('token', rr.response.body.access_token);
console.log('token stored:', rr.response.body.access_token);

The Snippets… menu of each panel inserts many of these patterns ready to use. If you have the AI assistant enabled, the ✨ button generates scripts from a description using this same reference.

Runner (Pro)

RestRuno Pro feature since version 3.0.

Right-click a collection or folder → Run Collection / Run Folder. It opens as a full-screen tab:

• Two views (runner's ⬓/◨ button): stacked, or split with the configuration on the left and the executions on the right. While the run is in progress, the configuration hides to give the results all the space.
• Request selection: checkboxes to run only a subset. The selection is preserved between runs of the same scope — run, adjust and repeat without re-checking.
• Data file (CSV / JSON / TXT): repeats the sequence once per row; every column becomes a {{variable}} (TXT uses the value variable).
• Iterations: field next to Run — how many iterations to execute. The maximum is the number of rows in the data file (without a file, always 1).
• Results with full detail: expand any execution to see its tests, the console, and the Request (method, resolved URL, headers, sent body) and Response (status, headers, body) blocks. Very large bodies are trimmed on screen; with Persist you have the full copy.
• Persist executions: checkbox that saves the resolved request + full response of every execution under runs/ inside the collection.
• Generate CSV (collapsible section ▸): enable Generate CSV file from response values, choose folder and name, and define columns with expressions over the response: body.data[0].id, status, headers.content-type, timeMs, request.url, iteration. Each column can be text (value as is) or number (strips leading zeros: 00742 → 742). The Save always / Only passed / Only failed selector controls which executions write a row — and in every case, the row is only written if at least one expression matches.
• Failures do not stop the run; you can cancel at any time.

AI assistant (Pro)

RestRuno Pro feature since version 3.0. Configuration is free; running AI actions requires a license.

✨ AI button in the top bar. Connect any OpenAI-compatible endpoint: OpenAI, Ollama, LM Studio, OpenRouter, Groq, etc. It is completely optional — if you don't configure it, RestRuno works exactly the same and no AI button appears.

💡 Works with open source models — free and 100% on your machine. Install Ollama or LM Studio and use Llama, Mistral, DeepSeek, Qwen, Gemma, or any other open model running locally: no API fees, no subscriptions, and your requests never leave your computer. You can also use hosted open source models (OpenRouter, Groq) if you'd rather not run them yourself.

Configuration (stored only on your computer):

Check Enable AI assistant, use Test Connection to verify, and save. The ✨ AI button in the top bar shows a green dot when it is enabled and the last connection test succeeded (gray if disabled or unverified). When enabled, ✨ buttons appear in three places:

1. Scripts (pre and post) — ✨ in each panel's header: describe what you need ("validate that the status is 201 and store the id in a variable") and it generates the script using the correct rr.* API, with your request's context. The Insert into script button adds it to the editor.
2. Response — ✨ Explain button: analyzes the request + response + failed tests and explains what happened, the likely cause of the error and how to fix it.
3. Runner CSV columns — ✨ AI expression: describe the value you want to extract ("the id of the first item") and it generates the expression (body.items[0].id) using the last response of the run as context; Add as column adds it directly.

In every action you can edit the instruction, regenerate, copy or insert the result. Privacy: when you use these actions, the request/response involved is sent to your configured AI provider — with Ollama/LM Studio everything stays on your machine.

Usage examples:

• Scripts: "validate that the status is 201, that the body has a numeric id, and store access_token in the active environment" → generates the post-response with rr.test, rr.expect and rr.variables.setEnvironment ready to insert.
• Explain: facing an unexpected 500, ✨ Explain tells you what went wrong (missing header, malformed body, server error) and what to fix.
• Runner CSV: "the email of the second user in the list" → generates body.users[1].email and adds it as a column.

Global console

Console bar at the bottom of the window: logs every sent request, every runner execution and the console.log calls from your scripts. All / Requests / Errors / Logs filters, hideable date and time, and a Clear button.

Local MCP server + API (Pro)

RestRuno Pro feature since version 3.0.

MCP Server button in the top bar. Lets an AI (Claude, GitHub Copilot, Cursor, Antigravity, OpenAI Codex, etc.) control RestRuno: create, edit, delete and send requests, and read the response, the console and the errors — all local, no cloud.

• 100% local: listens only on 127.0.0.1 (never reachable from outside your machine). Disabled by default.
• Status dot: the MCP Server button shows a green dot when the server is on and gray when it is off.
• Bearer token: every external request must present the token shown in the window (you can regenerate it). Copy it with one click.
• The server only acts on the collections you have open in the app; it cannot read or write files outside them.

How to set it up

1. Open MCP Server → check Enable local server ("● running" appears).
2. Copy the MCP endpoint (http://127.0.0.1:<port>/mcp) and the Bearer token.
3. In Connect your AI — pick your client, choose your client and copy the ready-to-paste snippet:

Tools exposed to the MCP client: list_collections, get_tree, read_request, create_request, update_request, delete_request, create_folder, send_request, get_console.

Usage examples (from your AI)

With the client connected, ask for things like:

• "List my RestRuno collections and show me the tree of the payments collection."
• "Create in payments a POST request to {{baseUrl}}/refunds with this JSON body and send it; tell me the status and the response body."
• "Send the login request, and from what you see in the console tell me why it is failing."
• "Go through every request in the smoke folder and flag the ones that don't return 200."

REST API (alternative without MCP)

Plain HTTP calls to http://127.0.0.1:<port>/api/* with Authorization: Bearer <token> — handy for scripts or local CI:

# list collections (returns name + rootPath for each one)
curl http://127.0.0.1:<port>/api/collections -H "Authorization: Bearer <token>"

# tree of a collection
curl "http://127.0.0.1:<port>/api/tree?rootPath=/path/to/payments" -H "Authorization: Bearer <token>"

# send an existing request (absolute path) with an environment, and read the response
curl -X POST http://127.0.0.1:<port>/api/send \
  -H "Authorization: Bearer <token>" -H "Content-Type: application/json" \
  -d '{"requestPath": "/path/to/payments/login.rr.json", "environmentName": "dev"}'

# read the console (last 20 entries)
curl "http://127.0.0.1:<port>/api/console?limit=20" -H "Authorization: Bearer <token>"

Endpoints: GET /api/health · GET /api/collections · GET /api/tree?rootPath= · GET|POST|PATCH|DELETE /api/request · POST /api/folder · POST /api/send · GET /api/console?limit=.

Session cookies

Responses with Set-Cookie are remembered in memory only (never on disk) and replayed to requests to the same host — that's how login flows work. In Globals you can disable or clear them. No HTTP cache is stored.

Where is everything stored?

Shortcuts

Ctrl+Enter send · Ctrl+S save · Ctrl+W close tab · Ctrl+B show/hide sidebar