Local storage still comes with an account decision
Choose Insomnia's storage mode before putting a private API collection into it. The README separates Local Vault, Git Sync, and Cloud Sync, and says most product capabilities require an account even if your projects stay on your machine. That distinction decides whether this client fits your workplace. Insomnia's account and storage guidance makes that boundary explicit.
The source checkout is a separate commitment: our installation added 1,702 packages and occupied 936 MB. You don't need to clone it just to send requests, since Kong distributes desktop downloads for Mac, Windows, and Linux. The reason to consider Insomnia is its shared workspace for API debugging and design. The reason to hesitate is how much of that workspace depends on account and subscription choices.
The client covers request debugging and OpenAPI design
Insomnia supports REST and GraphQL requests, plus gRPC, WebSockets, and Server-Sent Events. You can keep an OpenAPI specification beside the requests that exercise it, using the native editor and visual preview. Collection running and the Inso CLI extend that work into repeatable API checks.
Our checkout contained 2,288 files and roughly 247,274 source lines across npm workspaces. That breadth makes sense for a desktop client with an accompanying CLI, but it raises the cost of maintaining your own fork. The README also describes plugins and cloud or self-hosted mocking.
What happened when we ran it
Our run installed Insomnia commit ab658aa in 167 seconds, pulling 1,702 packages and using 936 MB on disk. We cloned it on October 5, 2026, into an unprivileged Debian sandbox with 3 CPUs, 8 GB of RAM, the lab-node:22 image, and no secrets. The checkout occupied 25.2 MB before installation. This measurement setup covers repository preparation, rather than the experience of downloading a desktop release.
The test step succeeded in 175 seconds: Vitest reported 18 passed and 0 failed out of 18. The build step was skipped because our harness found no build script or target. That leaves a clear limit on the result: the reported tests passed, while this run supplies no evidence that a desktop package was built or launched. Npm audit reported 66 known vulnerabilities: 2 critical, 28 high, 32 moderate, and 4 low. Our scan also found 11 CI workflow files, a workspace monorepo, no Dockerfile, and no tests directory. The directory observation doesn't contradict the Vitest result. The audit total warrants dependency review, but the supplied summary doesn't identify affected execution paths or prove that a particular desktop request is exploitable.
Private Environments separate credentials from project storage
Private Environments keep environment configuration locally regardless of the project's storage backend, according to the README. That's useful when requests belong in a shared collection but access tokens shouldn't travel with them. You still need the credentials and network access required by the API you're calling. Git Sync needs access to your Git repository, while Cloud Sync adds the vendor's collaboration service to the workflow.
The 936 MB installation we measured belongs to the developer checkout, so it shouldn't become a claim about desktop memory use or download size. For source development, Kong points you to .nvmrc for the Node version and documents Linux packages such as Debian's libfontconfig-dev. It also gives Electron cache advice for installation trouble. Our install succeeded, so those notes are documented precautions, not explanations for a failure we encountered.
Git Sync has a subscription boundary and formatting friction
The README lists Git Sync among premium capabilities. If your requirement is free Git-backed collections, that is a concrete reason to pick another client. Local Vault can satisfy local storage requirements, but it doesn't remove the stated account boundary for most capabilities. Procurement and security reviewers should decide those questions before developers move a team's working collections into the product.
An open October 10 pull request, the Git Sync discard warning, describes manually edited or older YAML being re-exported into Insomnia's format after discard. Its proposed warning tells users to commit the normalized file once. Our 18 passing tests don't establish whether this Git Sync report is fixed. Teams that edit collection files by hand should inspect this behavior before treating the files as ordinary, freely editable source.
Recent maintenance does not erase the audit findings
The repository's last push was October 10, 2026, and core@13.3.1 was released October 9. GitHub listed 40,033 stars and 906 open issues and PRs. Recent work includes Git Sync behavior and environment export ordering, so the activity extends beyond a fresh tag. Apache-2.0 licensing permits use and modification of the code, while hosted product capabilities still have their own account and subscription conditions.
The 66 audit findings belong to our October 5 commit and dependency resolution. Later pushes and a newer release don't establish that all of them are resolved. I would use Insomnia where its protocol coverage and OpenAPI editor save regular work, provided the team accepts its account model. I would require a separate packaging check before shipping a fork, and review the audit output before giving that fork production credentials.
Bruno is a better starting point for collections in Git
Bruno's repository describes collections stored on the filesystem in a plain-text format designed for version control. Pick it when reviewing request changes beside application code is the main requirement. Hoppscotch is worth considering when a browser client or self-hosted API workspace fits your team. For an individual request in a script, curl avoids adopting a desktop collection workflow at all.
Our 167-second install and passing Vitest step make Insomnia a reasonable source checkout to investigate, not a verified desktop deployment. Before choosing it for a team, create a representative collection in the intended storage mode, confirm who needs an account, and check whether Git Sync requires a subscription you can accept. If those answers fail your policy, the OpenAPI preview won't rescue the purchase.