Changelog

24 October 2026

• gRPC and GraphQL fixes. gRPC reflection now finds out by itself whether a server needs TLS and switches the lock for you; errors say what is wrong (unknown host, wrong port, an address that is a website rather than a gRPC server) instead of "UNKNOWN transport error", and half-pasted addresses like ://host work. The gRPC address field no longer shrinks to one character next to long method names, and the bar wraps on narrow screens. GraphQL introspection explains DNS and connection failures, and an empty query is no longer flagged as an error.
• Faster start. The code editor loads after the first screen instead of before it: about 30% less to download before the app is usable, and a smaller memory footprint at start.
• Security updates. TLS and runtime libraries updated (rustls, certificate verification, root certificates, tokio); stricter security headers sent by the app itself.
• MCP client fixes. Connecting now starts with the standard initialize handshake, so servers built with the official SDKs (which stopped or refused on the earlier discovery probe, especially over STDIO in the desktop app) connect. The desktop app starts STDIO servers with your shell's PATH, so npx and uvx commands work when the app was opened from a menu, and says clearly when a command is not installed. The MCP view keeps Run tool in view (also Ctrl+Enter), shows why a connection failed, explains when a server needs the desktop app (STDIO, localhost or private addresses), and offers a public server to try.
• API docs from your GitHub repositories, kept up to date. Connect GitHub under Account settings → GitHub to scan public and private repositories into collections with documentation. Each push updates the requests and docs (published docs too) and keeps your edits; repositories without admin rights are checked every 10 minutes. The Import dialog's GitHub tab also reads private repositories once GitHub is connected.
• Contact form. Fields on the contact page are back to their normal height on wide screens.
• Breaking changes in the app. API → Versions → Breaking changes compares a saved version with the current definition using the same rules as swc diff, plus response fields and status codes; it lists the requests to re-test, the tests and examples that read a removed or retyped field, and runs just the affected requests.
• Rate-limit check. Security checks note hosts whose responses never signal a rate limit (RateLimit / Retry-After headers or 429), in the app and in swc security.
• Security page: your data, short answers. Where data is stored, what passes through our servers, AI training (none), turning sync off, token handling, roles, retention and certifications (none yet).
• Compare with code. A collection's Coverage tab scans a public GitHub repository and lists undocumented routes, documented routes the code lacks, untested routes and requests for routes that are gone (swc inventory in the browser).
• Security checks. The runner's new Security checks tab reads every response for CORS that trusts any website, missing security headers, insecure cookies, version banners, stack traces and sensitive fields, then sends signed-in requests again without credentials to find endpoints that do not enforce authentication. Findings carry their OWASP API Security Top 10 label.
• Fuzz inputs. Send each request with one input wrong (wrong type, empty, very long, boundary numbers, left out) and see which ones cause server errors or are accepted without validation. Lesson.
• swc security. The same checks (and --fuzz) in the CLI, failing CI with --fail-on.
• Learn. 18 step-by-step lessons, from your first request to CI, security checks, breaking-change checks, mocks, monitors, team sharing and moving from Postman.
• Compare responses and environments. Compare with… shows every changed status, header and JSON field between two responses; the runner's Compare environments sends a collection to two environments and lists each difference.
• Find flaky tests. The runner repeats a run and marks requests flaky, failing or stable, with the reason.
• Test coverage. A collection's Coverage tab lists requests without tests, endpoints of your API definition no request calls, and documented responses nothing has checked.
• Access matrix. Mark which roles may call each request, then send every request as every role; anything let through that should be denied is flagged.
• Variables checked before a run. The runner warns about variables the selected requests use that are undefined or empty.
• Audit log and data retention. Workspace admins see who saved, deleted, shared, published or restored what, download it as CSV, and set how long history, monitor runs and the audit log are kept.
• Reliability report. Monitor pass rates, runs per day, slowest runs and the requests that fail most, for the last 7, 30 or 90 days.
• Offline documentation. Download a collection's docs as one self-contained HTML file.
• New in swc: swc inventory (undocumented and stale endpoints), swc mock (local mock server), swc mcp (your collection in AI coding assistants), swc diff --collection and swc run --affected-since (re-test only what a change affects).
• Workspaces as files in Git. swc workspace pull writes every collection, environment and the globals as readable JSON files, in the same layout as the app's workspace export; swc workspace push saves your edits back and stops instead of overwriting changes made in the app since. Secrets never reach the disk.
• Package library. Share script code across the workspace: add packages on a collection's Packages tab and load them with swc.require('@team/name') (Postman's pm.require works the same). Packages sync, version and export with the collection.
• Import from a GitHub repository. Paste a public repository in Import → GitHub repo and get a collection of its API routes, read from the code like swc scan, with no install. Collections written by swc scan -o now import directly too.
• Slack, Microsoft Teams and Discord alerts. Paste their incoming-webhook URL into a monitor and failures and recoveries arrive as chat messages with the failing tests and a link to the run.
• Load-test pass criteria. Add conditions like p95<500, error-rate<1 to a load test and each run is marked passed or failed, with the measured values; the same syntax fails CI with swc perf --pass-if.
• Import compatibility report. Importing a Postman (or other) collection now shows how many requests should run unchanged, and lists unsupported script calls, missing libraries and packages, local files and undefined variables before you import. Download it as a text file.
• Two-factor sign-in. Protect your account with an authenticator app: scan a QR code in Account settings → Security, confirm a code and save ten recovery codes. Password and GitHub sign-ins then ask for a code.
• Breaking-change detection. swc diff compares the API in your code with a git branch or a saved snapshot and lists what changed: removed endpoints, new required fields and parameters, changed types, removed values and new auth requirements fail the check; everything else is listed. Markdown output for pull-request comments, and a ready GitHub Actions workflow.
• Run in CI. The collection runner writes a pipeline file for GitHub Actions, GitLab CI, Jenkins, Azure Pipelines or CircleCI that runs your collection with the swc CLI and publishes a JUnit report.

23 October 2026

• Benchmarks. We measured Swastik Codes against Postman, Insomnia, Bruno and Hoppscotch on the same machine: the desktop app used 434 MB of memory against 585 to 800 MB, opened in 0.4 s, and its Windows installer is 11 MB against 45 to 500 MB. The web app loads 382 KB to start. Method and every number on the benchmarks page.
• Team API catalog. One searchable list of every collection and API definition in the workspaces you belong to: search by name, owner, tag or endpoint, filter by status or team, and see each API's owner, contact, docs, mocks and monitors. Owners fill in a collection's new Catalog tab. See the API catalog.
• Docs drift. Responses are now checked against the request's saved examples, which the published docs and mock servers show. An undocumented status, a different Content-Type or JSON fields that are missing, new or retyped show as Docs drift in the response bar, with one click to update the example. The collection runner counts and filters drifted requests.
• Local bridge. Run swc bridge on your computer and switch on Local bridge in the status bar: requests and collection runs from the web app then run on that computer, so they reach localhost, your LAN and VPN hosts. No browser extension and no CORS settings; the bridge connects out with your API key, takes work only from your account and prints every request.
• Run as. Send a collection's requests as an admin, a normal user or a guest in one click. Roles are set up on the collection's Roles tab (Add Admin, User and Guest finds the sign-in request for you); each has its own values and signs in on its own, refreshing the token before it expires or after a 401. See environments and variables.
• Secret guard, on by default. Saving a request that holds a token, API key or password as plain text now warns you and points to the secret scanner, which moves it to the vault. The export dialog shows how many secrets a file would carry before you download it, and the History panel can delete the entries that recorded one. Turn it off in Settings under Warn about secrets.
• swc command-line tool. swc init logs in with an API key, lets you choose or create a workspace and a collection, scans your project's code for its API routes and saves them as a detailed collection: folders, path variables, query parameters, typed request bodies, auth and a login request that stores the token. swc sync updates it when the code changes and keeps the tests and examples you added in the app. It reads Python (FastAPI, Flask, Django), JavaScript and TypeScript (Express, NestJS, Next.js, Fastify, Koa, Hono, Elysia), PHP (Laravel, Symfony, Slim), Java and Kotlin (Spring, JAX-RS, Micronaut), Go, Rust, Ruby (Rails, Sinatra) and C# (ASP.NET Core). The same binary runs collections in CI. For Linux and Windows.
• Desktop app for Windows and Linux. Download Swastik Codes as a Windows installer or a Linux .deb, .rpm or AppImage. The desktop app sends requests, collection runs, load tests and protocol connections from your own computer, so it reaches localhost, your LAN, Docker networks and VPN hosts, with no CORS limits. It has every feature of the web app, and signing in syncs the same workspaces. A macOS version is coming.

22 October 2026

• swc.* script API. Scripts now use swc.* (swc.test, swc.expect, swc.response …) in snippets, autocomplete and generated contract tests. Postman's pm.* is the same object and keeps working unchanged. Importing a Postman collection offers to convert its scripts to swc.*, a collection's menu and the bar above a script do the same later, and exporting to Postman writes pm.* back.
• Website. The new swastik.codes website with feature guides, tutorials and comparisons. The app now lives at swastik.codes/app.
• Phones and tablets. A touch-friendly layout for small screens: tab and section strips scroll sideways, text stays readable, inputs no longer zoom the page, and the field you are typing in stays visible above the on-screen keyboard.
• Change a request's type in place. Turn an HTTP request into a GraphQL, WebSocket, Socket.IO, SSE, gRPC, MQTT or MCP request (and back) without losing its name, URL, headers, auth or scripts.
• More complete clients and services. Finished HTTP settings, the vault, the collection runner, monitors, import, mock servers and collaboration features.

21 October 2026

• MCP client. Connect to Model Context Protocol servers over Streamable HTTP or HTTP+SSE, list and call tools, read resources and prompts, and answer elicitation and sampling requests.
• MQTT 5. Connection, publish and subscription properties, user properties, last will settings and automatic reconnect.
• gRPC and GraphQL. Improvements to streaming, scripting and schema handling.
• HTTP TLS settings. Choose TLS versions and cipher suites per request, and see the negotiated protocol, cipher and certificate in the response.
• Load tests. Back off when requests fail instantly, and keep memory bounded on long runs.

20 October 2026

• Published documentation settings and a choice of environment for published docs.
• Activity, trash and workspace webhooks in the app.
• WSDL import for SOAP services.

Earlier in October 2026

• The foundations: collections, environments and variable scopes, the HTTP engine, the JavaScript sandbox for pm.* scripts, the collection runner, team workspaces with sync, history and realtime presence, mock servers, monitors, API specifications and flows.

Related

• Features
• Blog
• PageAbout Swastik Codes