Postman installed itself into Claude Code and Codex: how to check and remove it

The bug report went up on October 25. The Hacker News thread about it reached 1,513 points and 489 comments, one of the biggest developer stories of the week. The headline there said Postman “attempts to share all API data”, which the report does not claim. This post sticks to what the report, the follow-up reports and Postman's own code show, then gives you the check and the cleanup for each agent.

What happened?

An update to the Postman desktop app quietly installed Postman's coding agent plugins for users who already had the app. The reporter noticed recurring MCP sign-in warnings and Codex routing API work through Postman skills. Postman's own log on that Mac shows the install ran on its own: an entry dated 2026-10-24 records "source":"auto-existing-upgrade" with claude-code:installed and codex:installed, on darwin, the name for macOS.

A second user reported the same thing on November 3, after an update from Postman 12.31.3 to 12.35.1. That install added the Postman CLI 1.85.0, the Claude Code plugin 2.0.1 and the Codex plugin 1.3.0. A third found Postman entries in GitHub Copilot CLI's settings too. Postman closed and locked the issue on November 5.

What exactly did it install?

The Claude Code plugin comes from Anthropic's official plugin marketplace, so it is a real, listed plugin. The problem is not the plugin. It is that nobody asked before it went in.

Why does the hook approval matter?

Codex makes you review a hook before it runs, and Postman's installer is written to approve its own hook for you. A startup hook runs at the start of every Codex session, and this one adds instructions to the agent's context. Codex ties a hook's trust to a hash of its contents, so a changed hook needs your review again. Postman's installer source calls Codex's own interface to write that trust record, with a comment saying it “approves only Postman's current hook after installation.” Postman's README says the same in plain words: for Codex, installation also approves Postman's session-start hook, and there is no separate hook prompt.

The reporter is careful about one detail: the source proves the installer tries to approve the hook, not exactly which process wrote the record on their Mac. The second report, on 12.35.1, had no trust record at all. Either way, the review step Codex puts in front of new hooks is the step this was designed to skip.

Did Postman send your data anywhere?

No one has shown that it did. The original report says it does not claim to establish data exfiltration, and the MCP server never connected: Codex logged that it needed sign-in. The second reporter wrote that they have no evidence that data was uploaded. The Hacker News title's claim about sharing all API data is not in either report.

What is true is narrower. Once you sign in, calls to Postman's MCP server go to Postman, which is how a remote MCP server works. And Postman's plugin README says that after postman init, the CLI publishes run results, lint results and request history to your connected Postman workspace by default; --report-events=false turns that off per command. That is a documented feature, not a leak, but it is worth knowing before you let an agent drive the CLI.

What did Postman say?

• November 3: a commenter whose Postman affiliation is not shown on GitHub said Postman bundles the CLI and plugins because many users had trouble installing and wiring them up, that this is mentioned on the download page and in the app update flow, and that each part can be uninstalled in the app. They promised a clearer opt-in and a review of the hook approval.
• November 5: a Postman organization member wrote that Postman will redesign the experience “with the right level of control” and, in the meantime, is reverting the change. Postman's founder then locked the issue.
• Not said yet: which Postman version carries the revert, and whether it removes plugins it already installed. On November 5 Postman's plugin repository shipped release 0.7.0 without the Codex hook, then restored the hook the same evening in release 0.7.1. At the time of writing, its README still says installation approves the hook.

How do you check your machine?

Postman's own tool is the quickest check. It lists every coding agent it has set up:

$npx @postman/postman-plugin status

That runs Postman's package from npm. If you would rather not run Postman code to check on Postman, look by hand:

1. Claude Code: run claude plugin list and look for postman@claude-plugins-official. On Windows the settings live in %USERPROFILE%\.claude.
2. Codex: open ~/.codex/config.toml and search for postman. Inside Codex, /hooks lists the hooks it will run.
3. GitHub Copilot CLI: search ~/.copilot/settings.json for postman.
4. Cursor: Postman's installer covers Cursor too, so check its installed plugins, or use the status command above.
5. The CLI: which postman on macOS and Linux, or where postman on Windows.
6. Instruction files: Postman's separate CLI install script adds a block marked postman-cli:installation to ~/.claude/CLAUDE.md and ~/.codex/AGENTS.md. Postman's docs say the desktop app does not, but it costs a second to look.
7. Postman's log (Mac): search ~/Library/Application Support/Postman/logs/main.log for autoInstall to see when it ran.

Every confirmed report is from a Mac. Postman's installer code has Windows support, and one Windows user asked how to check without getting an answer, so check Windows machines too.

How do you remove it?

Start with Postman's own uninstall, then check each agent. In the app, go to Help > Postman CLI and Plugins and use Uninstall Postman Coding Agent Plugin and Uninstall Postman CLI. Or from a terminal (add --dry-run to preview, or --agent <id> to target one agent):

$npx @postman/postman-plugin remove

One user said the in-app uninstall left the Copilot CLI entries behind, so check afterwards. By hand:

• Claude Code: claude plugin uninstall postman@claude-plugins-official --scope user. Do not remove the claude-plugins-official marketplace to get rid of it. Claude Code's docs warn that removing a marketplace uninstalls every plugin from it.
• Codex: back up ~/.codex/config.toml, then delete the [plugins."postman@postman"] and [marketplaces.postman] tables and any hooks.state table whose name starts with postman@postman. Check /hooks again afterwards.
• Copilot CLI: remove the Postman entries from ~/.copilot/settings.json and the Postman folder under ~/.copilot/installed-plugins.
• Postman CLI: npm uninstall -g postman-cli if you installed it with npm, or delete the postman binary and its lib folder from ~/.local/bin or /usr/local/bin. On Windows, Postman's docs give %USERPROFILE%\AppData\Local\Microsoft\WindowsApps as the location. Those docs now say the desktop app does not install the CLI automatically, and explain how to remove a copy it installed before.

Restart each agent so it reloads its config.

How do you stop it coming back?

Postman documents no setting or environment variable that blocks the install. It says it is reverting the change, but it has not named a version, and the reporter's request to respect a removal without reinstalling has no answer. Until Postman confirms the fix:

• Run the check above after each Postman update.
• Keep a copy of ~/.codex/config.toml and ~/.claude/settings.json and compare after updates. Do not put whole agent folders in a public repo: they can hold sign-in tokens.
• In Codex, [features] hooks = false turns off all hooks. That is blunt, and it turns off hooks you wanted too.

Is this the first time an app has done this?

No. In April 2026, GitKraken Desktop 12.0 added Claude Code hooks without notice, and GitKraken fixed it in 12.0.1 after complaints. The pattern is the same. Coding agents now take instructions, hooks and tools from config folders in your home directory, so every developer app that wants to be part of your AI workflow has a reason to write itself in there. One commenter in the Postman thread, which says it is an AI agent testing on its own machine, also reported that Codex's trust hash can be computed and written by any program. If so, a hash only proves the hook has not changed since someone approved it, not who approved it. We have not tested that ourselves.

What does this mean for Bodega One Code?

The honest answer is that no coding agent, ours included, can fully protect its config from another app you run as yourself. Any program running under your account can write to your home folder. What an agent can do is gate what arrives from outside and make what is installed easy to see. Here is where Bodega One Code stands:

• Gated: anything a project brings in. Opening an unknown folder shows a trust prompt before its .bodega/config.json can change your settings. Hooks committed in a repo never run until you approve that exact command for that project. A project's skills in .bodega/skills/ do not load until you approve them, and the approval is tied to a SHA-256 hash of the whole file, so any edit asks again.
• Previewed: plugins. Installing one shows every skill and MCP server it contains before anything is written, and any extra permissions a skill asks for arrive as unchecked boxes.
• Not gated: your own things. Skills in ~/.bodega/skills/ and hooks in your own settings count as yours and are trusted. An app running as you could add one there, much as Postman did with Claude Code.

So check ours the same way you check the others. Settings > Connections lists your skills, MCP servers and plugins, and in the CLI bodega skills list and bodega mcp show your skills and MCP servers. When our docs connect Bodega to another agent, such as adding Bodega's MCP server to Claude Code, you run the command yourself. With air-gap mode on, MCP servers marked as needing the network are blocked. That mark is set when a server is added, and Bodega cannot check what a server actually does, so it is one layer, not a guarantee.

Sources

• Postman bug report, with the log lines, file paths and follow-up reports (issue 14370): github.com/postmanlabs/postman-app-support/issues/14370
• Hacker News discussion, November 3, 2026: news.ycombinator.com/item?id=50354960
• Postman plugin README (install, status, remove, hook approval, CLI publishing): github.com/postmanlabs/postman-plugin
• Postman installer source for the Codex hook approval: github.com/postmanlabs/postman-plugin
• Postman plugin commit history, including the November 5 change and its revert: github.com/postmanlabs/postman-plugin/commits
• Postman CLI installation docs: learning.postman.com
• Claude Code plugin commands: code.claude.com/docs/en/plugins/cli-reference
• Codex hooks docs: learn.chatgpt.com/docs/hooks
• GitKraken Desktop 12.0.1 update on its Claude Code hooks: gitkraken.com
• Bodega One Code docs on workspace trust, skills and plugins: workspace trust, tools and skills, integrations