A pipeline is a file in your repo

Log in, create an order, check it shows up in the list: create order as the window draws it. Dotted lines carry values from one step to the next; the checks hang below the step they check.

name: create order
host: "{{env.api}}"
auth: { bearer: "{{token}}" }
steps:
  - request: login
    method: POST
    path: /auth/login
    auth: none
    json: { user: "{{env.test_user}}", password: "{{env.password}}" }
  - extract: token
    from: $login
    path: $.token
  - extract: user_id
    from: $login
    path: $.user_id
  - request: create
    method: POST
    path: /users/:userId/orders
    params: { userId: "{{user_id}}" }
    json: { sku: A-1, qty: 2 }
  - assert: status
    of: $create
    equals: 201
  - extract: order_id
    from: $create
    path: $.id
  - request: list
    method: GET
    path: /orders
  - assert: contains
    of: $list
    path: $[*].id
    value: "{{order_id}}"

Each step is a request, a value you take from a response, a check, a wait, a loop, or a block you reuse, like logging in. You build it in the window without writing YAML.

The YAML is what lands in git, next to your code. The team reviews it in a pull request, and the app syncs it with one button.

Run it and read what happened

From the window or from a terminal, every step says what it did. A failed check shows what it expected and what came back, with the full response a click away. Secrets never reach the output or the history.

$ ultraman run "create order"
  ✓ 1 request POST /auth/login · 200 · 16 ms
  ✓ 2 extract token ← $.token from $login · bc6dcdac-3c80-484d-83d1-dedb0a905328
  ✓ 3 extract user_id ← $.user_id from $login · u_ana
  ✓ 4 request POST /users/:userId/orders · 201 · 3 ms
  ✓ 5 assert status of $create = 201
  ✓ 6 extract order_id ← $.id from $create · ord_2
  ✓ 7 request GET /orders · 200 · 3 ms
  ✓ 8 assert $[*].id of $list contains {{order_id}}
✓ create order · 8 steps · 28 ms

Then see if it holds

The same pipeline, run by many users at once: steady, ramping up, or in a spike. The report starts with a verdict in plain words, then the numbers behind it.

Holds

p95 was 44.8 ms with up to 20 users and 602 requests per second, without errors.

A 20-second ramp of create order against the demo API on a laptop: 4,040 runs, 12,120 requests.

Run it in CI

The same command installs only ultraman on a build machine. A failed check fails the job; secrets come from environment variables named ULTRAMAN_SECRET_ plus the secret's name.

- run: curl -fsSL https://ultraman-app.github.io/install.sh | sh -s -- --cli
- run: ultraman run "create order" --env staging
  env:
    ULTRAMAN_SECRET_PASSWORD: ${{ secrets.API_PASSWORD }}

Your secrets stay locked

Saved secrets are encrypted on your machine with a master password only you know. Nothing on disk opens them, so a program that copies the folder gets nothing it can use, and only the Ultraman window, or a terminal where you type the password, can unlock them. You can have this machine remember the password; the app tells you first what that costs on your system.

$ ls ~/.ultraman
secrets.enc  vault.json
$ ultraman secret list
Master password:
api_token

Hand it to your agent

Point Claude Code, Cursor or any MCP client at ultraman mcp. Your agent finds the pipelines you have, reuses your blocks to build new ones and runs them. Each call waits for your OK in the window, and it never sees a secret.

{
  "mcpServers": {
    "ultraman": { "command": "ultraman", "args": ["mcp"] }
  }
}

Why a download from the browser warns

We don't pay for code signing yet. The commands above download with curl and PowerShell, which don't mark the file as coming from the internet, so macOS and Windows open it without asking. If you'd rather download the installer from the releases page, macOS asks you to allow it in System Settings, under Privacy & Security, and Windows shows it behind More info, then Run anyway.

Uninstall

macOS: drag Ultraman out of ~/Applications and delete ~/.local/share/ultraman and ~/.local/bin/ultraman.

Linux: delete ~/.local/share/ultraman, ~/.local/bin/ultraman and ~/.local/share/applications/ultraman.desktop.

Windows: remove Ultraman from Settings, Apps, then delete %LOCALAPPDATA%\ultraman-cli.

Your saved secrets stay in ~/.ultraman until you delete it too.