Postman Silently Added Claude Code Plug-in

Postman's desktop app automatically installed plug-ins into developers' Claude Code and Codex coding agents without asking first, according to a GitHub issue filed Oct. 25 that has drawn wide attention this week. The report says the installer also marked its own startup hook as trusted. A reply on Nov. 3 that reads as Postman's official response said the company will make the opt-in "clearer."

Key takeaways

• Postman desktop 12.33.4 on macOS added a Postman plug-in, a startup hook and a CLI to Claude Code and Codex during an "auto-existing-upgrade," the issue says.
• The hook tells the agent to load Postman's "api-engineer" skill for API work, and the reporter says the installer wrote its own trust entry for it.
• The reporter did not claim any data left the machine. A reply posted as Postman's says it is "reviewing the hook approval and session-start behavior."

What the Postman auto-install changed

GitHub user indicava opened issue #14370 under the title "[SEVERE] Desktop auto-installs Codex/Claude plugins; installer attempts to trust its own startup hook." It covers Postman desktop 12.33.4 and Postman plug-in versions 1.1.0 for Codex and 2.0.1 for Claude Code.

According to the report, Postman's own log recorded a trigger called "auto-existing-upgrade." Codex's config file gained a Postman marketplace entry, an enabled Postman plug-in and hook entries with "trusted_hash" values. Claude Code showed the Postman plug-in as enabled and installed on Oct. 24, and a Postman executable appeared in the user's local bin folder.

The startup hook and trust question

The added SessionStart hook runs when an agent session starts, clears or compacts. It injects text telling the agent to load the "postman:api-engineer" skill for "non-trivial API engineering" tasks. The reporter said Codex began routing API work through Postman skills and showed repeated "Auth required" errors from Postman's remote MCP server.

The reporter says the installer calls a function named approvePostmanHook to trust its own hook. They also noted that the trust record alone does not prove who created it. The user removed the install after saving evidence.

Postman's response

On Nov. 3, a commenter posted what reads as Postman's official reply, though GitHub shows no staff badge confirming the role. It said Postman bundles its CLI and agent plug-ins with the desktop app to ease setup, notes this on its download page and update flow, and lets users uninstall them in the app.

"We're going to make the opt-in clearer, especially for existing users," the reply said, adding that the team is "reviewing the hook approval and session-start behavior you flagged." The issue had 209 thumbs-up reactions as of Nov. 4.

Other users reported the same behavior. One said it happened after updating from 12.31.3 to 12.35.1. Another found Postman enabled in GitHub Copilot's settings and said the in-app "Uninstall" option did not remove it there.

Context: agent plug-ins and consent

Postman's plug-in documentation lists support for nine agents, including Claude Code, Codex, Cursor and GitHub Copilot CLI. It says users "can install into every detected agent on your machine with a single command."

The Model Context Protocol's security best practices say that if a client supports one-click local server setup, it "MUST implement proper consent mechanisms prior to executing commands." The Postman case adds to concerns after a backdoored Claude Code extension reached Cursor's marketplace on Oct. 29.

What's next

Postman said it will post updates in the thread as changes land. Users are asking for opt-in for everyone and a full rollback path. Developers can check their Claude Code and Codex config files for Postman entries and remove any they did not approve.

FAQ

Did Postman send my API data anywhere?

The original reporter did not claim exfiltration. Their Codex logs showed Postman's remote MCP connection failing with "Auth required" errors.

Which versions are involved?

Reports cite Postman desktop 12.33.4, and 12.35.1 after an update from 12.31.3, on macOS.

How do I remove it?

Postman says the components can be uninstalled in the app. One user said that left a Copilot entry, so check each agent's settings by hand.

References

• [SEVERE] Desktop auto-installs Codex/Claude plugins; installer attempts to trust its own startup hook — GitHub, postmanlabs/postman-app-support (Oct. 25, 2026)
• Install the Postman plugin | Postman Docs — Postman
• Security Best Practices — Model Context Protocol (2026-07-28 revision)