Changelog

Notable changes in each release. The in-app updater shows the notes for a new version from this page, and you can always browse the full history here.

Unreleased

• Requests open on the tab you came for. A POST, PUT or PATCH opens on Body; everything else opens on Params — instead of inheriting whatever tab the last request happened to be showing. Switching back to an already-open tab still restores the tab you left it on.
• Documentation is a menu item. The ☰ menu (and, on macOS, Help ▸ Impostor Documentation) opens docs.impostor.uk in your browser.
• The HTTP tab shows the full URL. The raw request line now reads POST https://api.example.com/v1/users HTTP/1.1 rather than just the path, so you can see where a request went without cross-referencing the Host header.
• Easier folder carets. The expand/collapse target on a sidebar folder is now a full-height square around the arrow instead of the arrow itself.
• The edition is spelled out. The window title reads Impostor — Pro Edition (or Team/Community), and “Check for Updates…” names the version and edition you’re on even when there’s nothing to install.
• The window comes back the way you left it. Panes are remembered as a share of the window rather than a fixed pixel width, so making the window smaller shrinks both sides of a split instead of squeezing the response pane out of sight — and growing it back restores the exact same layout. The active environment is remembered per workspace, so a workspace reopens on the environment you last used it with rather than the first one in the list.
• The request tree opens focused. A workspace now opens collapsed, with just the branch holding your active request unfolded, instead of every folder at once.
• History says when a request ran. Entries show the clock time they were sent at (14:05) rather than an age (5m) that was stale the moment it was drawn — the list is already grouped by day, and hovering a row gives the exact second and time zone, ready to line up against a server log.
• {{var}} highlighting reaches the payload. Request bodies (raw, GraphQL query and variables), gRPC messages, MCP tool arguments and the WebSocket send box now colour their variable tokens the way the URL bar always has — green when the name resolves, red when it doesn’t — with the resolved value on hover (secrets stay masked). Dynamic tokens such as {{$guid}} and {{$timestamp}} are also recognised now; they previously showed as unresolved everywhere despite working correctly when sent.
• Client certificates are registered per host, not per folder. A certificate is issued for a server, so it now lives in its own Certificates dialog (the ☰ menu, the macOS menu bar, or the command palette), keyed by a host pattern (api.acme.com, api.acme.com:8443, *.acme.com) — the most specific entry wins. Any request that reaches a matching host presents it, across HTTP, WebSocket, SSE, gRPC and MCP alike, wherever the request sits in the workspace. The list is stored with the app, not the workspace, so a shared repo no longer carries anyone’s machine-specific cert paths, and PKCS#12 passphrases now go into the encrypted vault instead of plain YAML.
• Client keys can be encrypted, or pasted straight in. The key field now takes either a file path or the PEM text itself — for a key that never touches disk — and an encrypted PKCS#8 key is unlocked with a Key password, the same field a PKCS#12 bundle uses. Pasted keys and passwords both go to the encrypted vault, never to a file. A key using OpenSSL’s legacy PEM encryption is now named as such, with the one-line conversion, instead of failing as an unreadable key.
• WebSocket connections finally honour your TLS settings. wss:// previously ignored the Cert tab entirely — a custom CA or client identity was collected and silently dropped. It now uses them, including PKCS#12 bundles and insecureSkipVerify.
• Breaking: folder-level tls: blocks are no longer honoured. A tls: block in a settings.yaml is ignored on load and dropped the next time that folder’s settings are saved. Re-add those certificates in the Certificates dialog, keyed by the host they belong to. A request’s own tls: block still works and still wins, as a per-request override.

v0.3.0

• A real Settings dialog, and app-level preferences. Impostor now has preferences of its own (⌘, / Ctrl+,, or the ☰ menu): Appearance, Request defaults — default timeout, follow redirects, max redirects — and History. Defaults are stored with the app rather than in a workspace, so a shared repo can never change how someone else’s requests behave, and they sit at the base of the same inheritance chain as folder and request settings — request → folder → app default — so the app, the CLI, and the MCP server all resolve a request identically.
• Follow the system theme. Theme is now Dark / Light / Auto. Auto tracks the OS the moment it flips, with no reload and no wrong-theme flash on launch, and hands the native window chrome back to the OS. A fresh install is still dark. The theme toggle has moved out of the header into Settings ▸ Appearance (the command palette still cycles it).
• No more menu bar on Windows and Linux. The in-window menu bar was two rows of chrome before any content. Its commands — Open/Close Folder, Settings, Check for Updates, License, About — now live in a ☰ menu in the tab strip and in the command palette. macOS keeps its native menu bar, which mirrors the ☰ menu item for item, with Settings… at ⌘, where the platform puts it.
• See where a request actually went. Responses that were redirected show a ↳ N redirects chip that expands into the full chain — one line per hop with the status, the URL that answered, and where it pointed. The chain is recorded on failure too, so a request that dies in a redirect loop now names the hops instead of just saying “too many redirects”.
• The redirect limit is yours to set. The hardcoded ceiling of 10 is now a Max redirects setting, inheritable like timeout and follow-redirects (request → folder → app default), so long SSO and OAuth chains no longer dead-end. It stays visible but greyed out when following is off, and 0 means no redirects at all.

v0.2.4

• Editing a large workspace no longer re-reads it. Creating, cloning, or deleting a request in a big workspace could take seconds on Windows: every structural edit re-read all of the request files and then re-ran git status over the whole worktree. The tree scan is now cached per file, and bursts of edits coalesce into a single refresh — on a 500-request workspace, the reload that follows creating a request went from 56ms to 2.6ms.

v0.2.3

• Faster workspace opening. Opening a large workspace read every request file twice and waited on git before the sidebar could settle. Each file is now read once, and the git status refresh happens after the tree is on screen. Returning to the window also costs one refresh for a burst of switches rather than one per switch.
• Fewer filesystem probes, especially on Windows. The workspace scan asked the filesystem three questions per entry where one would do, and opened two optional sidecar files per folder blind — usually absent, and a failed open is the most expensive kind under antivirus or a cloud-sync provider. A 500-request workspace went from roughly 1580 path operations to 520.

v0.2.2

• See what a request inherits, before you open the tab. Every editor sub-tab now marks whose value it carries: a filled dot means this request or folder sets the property itself, a hollow ring means it comes from a parent folder — and the tab’s tooltip names the folder. Folders show it too, so a nested folder makes clear what it picks up from above, including a read-only Inherited certificate panel that was previously only shown on requests.
• gRPC inherits folder certificates. A gRPC request with no TLS settings of its own now uses the nearest folder’s certificate, exactly like HTTP — so a whole folder of gRPC calls can share one mTLS identity. Certificate paths in a gRPC request also resolve {{variables}} (such as {{workspaceDir}}) and keychain-backed PKCS#12 passphrases, which previously only worked for HTTP.

v0.2.1

• One-click MCP setup that Claude Code actually picks up. Impostor now recognises Claude Code from its config file as well as from the claude CLI — the Claude app’s built-in sessions don’t necessarily put claude on your PATH — and registers itself at user scope, so /mcp lists Impostor in every session instead of only in the directory you happened to add it from. The copyable CLI command passes --scope user for the same reason, and each host now says what it needs before the server appears (restart it, or start a new session). Config writes go to a temporary file and are renamed into place, so an interrupted write can’t leave a host’s config truncated.
• “Connect AI” is now “Connect MCP”. The status-bar chip and the panel it opens finally agree — the rename had left the chip reading “Connect AI”.
• Tidier sidebar. Collapsing Source Control no longer leaves a doubled border where its header meets History.

v0.2.0

• Team sync over git. A new Source Control panel brings the everyday git actions inside the app — clone a teammate’s repo straight into a new workspace, turn a workspace into a shared repo, commit, pull, push, and review changes with a request-aware semantic diff (method, header, and auth changes rather than raw YAML). Clone repository… in the no-workspace opener pulls a shared workspace down and opens it in one step. Secrets never travel in git — only their names do, with an inline banner to fill in the values on each machine — and conflicts on the same request offer keep-mine / keep-theirs resolution. A Team-plan feature, fully available during the evaluation.
• Command line. The impostor binary is now a headless CLI. impostor run resolves a saved request — variables, folder inheritance, auth, and all — and sends it with no window, printing the response (or --json for scripts); impostor ls lists the workspace. The exit code reflects the HTTP status, so it drops straight into scripts and CI. It targets the workspace you have open, or an explicit --workspace.
• MCP client. Impostor’s fifth protocol: connect to Model Context Protocol servers over stdio or Streamable HTTP, discover their tools, resources, and prompts, and invoke tools with JSON arguments — with streamed results and server progress/log notifications.
• MCP server — drive Impostor from your AI. The other side of MCP: a local AI agent (Claude Desktop/Code, Cursor, GitHub Copilot) can list, inspect, and run your saved requests. A Connect an AI popover in the status bar copies a ready-to-paste config, or one-click-adds Impostor to a detected host. Secrets are redacted and scripts never run over MCP, and it’s confined to the open workspace; letting the agent create requests, folders, and environments is opt-in.
• Binary request bodies. Send a single file as the raw request body (Postman’s “binary” mode). The Content-Type is auto-detected from the file extension, and the path supports {{variable}} substitution.
• Multi-file import. The import dialog now takes several Postman JSON exports at once — each file is auto-detected as a collection or an environment, and a bad file never aborts the rest of the batch. The Environments menu gains a direct Import from Postman shortcut.
• Collection runner report. Finished runs show a summary strip (requests passed, test pass rate, wall-clock and average request time) with expandable failed-test details, and can be downloaded as a self-contained HTML report.
• Open with Impostor. Open a workspace folder straight from Finder’s Open With menu (macOS) or Explorer’s right-click context menu (Windows). A close guard now warns before unsaved changes are discarded.
• Inherited settings at a glance. Requests that inherit auth or variables from a folder show a read-only panel with the resolved values and the folder each comes from.
• Reveal & copy secrets. Keychain-backed secret values can be revealed and copied in place from the environment editor and audit view.
• Copy buttons everywhere. One-click copy for response bodies and WebSocket / SSE / gRPC messages.
• System menu & About. A native application menu and an About dialog with version and licence details.
• In-app auto-update. Impostor now checks for a newer version on launch (at most once a day) and can download, verify, and install it from within the app — with release notes and a one-click Install & Restart. Added a File ▸ Check for Updates… menu item for on-demand checks.

v0.1.0

• Initial public release — fast, local, cross-platform API client with HTTP, WebSocket, and gRPC support, environments and variables, scripting, and git-friendly flat-file workspaces.