Plunger

What it does

A small desktop app that sends an HTTP request and shows you what came back.

• Request: GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS, with params, headers and a Bearer token field.
• Body: JSON, form-urlencoded, raw text, or multipart form-data with real file uploads.
• Response: status, time, size, headers, and the body as a collapsible JSON tree. Copy it or save it to a file.
• Variables: {{name}} anywhere in the request, plus {{$uuid}}, {{$timestamp}} and {{$randomInt}}.
• Import: a curl command (including -F uploads) or a HAR file.
• Keep what matters: local history, named saved requests and tabs.

It's a native program, not a web page, so it reaches whatever your machine can reach: localhost, a dev box on your network, an API that sends no CORS headers. For public APIs that do allow browser requests, the online API tester needs no download.

For AI agents

See the JSON, even when an AI sent the request. The same plunger.exe is also a command-line client and an MCP server, so an agent like Claude Code can send requests through Plunger instead of running curl.

• Undefined variables are refused. A request with an undefined {{variable}} is never sent. curl would send the placeholder text.
• Secrets stay by name. The agent writes {{token}} and never sees the value. Secrets you've chosen to remember are kept in the Windows Credential Manager and filled in by Plunger; if a server echoes one back, it comes back as [redacted:token].
• One shared history. Requests an agent sends show up in the same history you see in the window, tagged MCP or CLI.
• Structured results. Status, time, size, headers and the parsed JSON body come back as separate fields.

Six MCP tools: send_request, import_curl, list_saved_requests, get_history, list_variables and export_curl. Setup and every option are in the agent guide.

How Plunger's MCP differs

Other API clients have added MCP too. This is what each one's is for, as of September 2026, summarised from the projects' own documentation:

Plunger's MCP is narrower on purpose. It lets an agent send a real HTTP request without a mistake on the agent's side corrupting it, leaking a credential, or leaving no trace.

Small by design

Built in Rust with egui because we wanted a small, fast, native application. No webview, no bundled browser: one exe of about 7 MB, which is also a command-line client and an MCP server for AI agents.

No account to create. No cloud to sync to. The only network traffic is the requests that get sent, by you or by an agent you've connected: no analytics, no telemetry, no update checks. History and saved requests stay on your computer, in %APPDATA%\Plunger. Bearer tokens and secret variables are never written to a file unless you tick "remember", which keeps them in the Windows Credential Manager. Credential-looking headers are blanked before history is saved. Read the privacy policy.

This website, metamug.com, can show ads if you allow them in its cookie settings, as described in the website privacy policy. The app has no ads and no tracking.

Open source

Plunger is MIT licensed, and the code is on GitHub. Read it, build it, change it. A few promises, so you know what you're picking up:

• It will never require an account.
• It will never add telemetry.
• Existing features will never move behind a paywall.

Bugs and ideas go to GitHub issues. The test for a new feature: does it help someone quickly see what an API is doing?

Install

1. Download the zip and unzip it anywhere.
2. Run plunger.exe.
3. Paste a URL or a curl command, press Ctrl+Enter, read the response.

Plunger isn't code-signed yet, so Windows may say "Windows protected your PC". Click More info, then Run anyway. Or build it yourself.

To update, download the zip again and replace the exe. To remove it, delete the exe and %APPDATA%\Plunger. Windows only for now.