Postman desktop auto-installs Codex/Claude plugins — without clear consent

Opening Postman desktop can rewrite your coding agents. That is the documented part. The viral HN headline that says Postman "attempts to share all API data" goes further than the evidence — and that overclaim needs a correction.

What happened. Reporter indicava opened Postman desktop 12.33.4 on a signed-in Mac. Postman's own main.log at 2026-10-24T09:34:14.418Z records:

source:"auto-existing-upgrade" → results:["claude-code:installed","codex:installed"]

Not a user clicking "install plugin." An existing-user upgrade path, firing on open, that reached into unrelated tools.

What got written. On that machine, ~/.codex/config.toml gained a Postman git marketplace plus an enabled postman@postman plugin, and a hooks.state entry with a trusted_hash for Postman's SessionStart hook. Claude Code got postman@claude-plugins-official at user scope. A Postman CLI landed in ~/.local/bin. The installed plugin revision is pinned at 6c8e452e0f4237f4bcc0901cb1ac442dec707e49.

What the hook does. We re-fetched hooks/session-start-context.md at that revision. It tells the agent: before any non-trivial API engineering task — designing, implementing, mocking, testing, monitoring, documenting, or deploying an API — load the postman:api-engineer skill. That is a default routing mandate, not "use Postman when asked." The installer source (approvePostmanHook in codex-hooks.ts) then calls Codex config/batchWrite to upsert hook trust for its own SessionStart hook — the comment says it "Approves only Postman's current hook after installation."

What was NOT proven. The plugin configures MCP at https://mcp.postman.com/mcp. The reporter's Codex log shows "Auth required" — the connection failed. The reporter explicitly does not claim data exfiltration. A second reporter (ronthedrummer, Nov 3) reproduced auto-existing-upgrade on an upgrade from 12.31.3 → 12.35.1: CLI + Claude Code + Codex installed; Cursor recorded as already-installed; no hooks.state on his Codex; same session-start instruction; no evidence data was uploaded.

Postman's response. On the issue, zecoquit said Postman bundles the CLI and agent plugins to ease setup, mentions them on the download page / update flow, and they are uninstallable in-app — and that Postman will "make the opt-in clearer, especially for existing users" and is reviewing hook approval / session-start behavior. RuntimeWire attributes the same line to Head of Product Sarabmeet Kallar (via Offleash PR, Nov 3).

What builders should check (if you run Postman alongside agents):

1. ~/.codex/config.toml — Postman marketplace / plugin / hooks.state
2. ~/.claude/settings.json and ~/.claude/plugins/installed_plugins.json
3. Cursor marketplace plugins for Postman
4. ~/.local/bin/postman (and Copilot ~/.copilot/settings.json — a later commenter found Postman there too)
5. Uninstalling the desktop app alone may not remove agent integrations

Takeaway. Consent for plugins, remote MCP, and hook trust are three separate decisions in three different apps. An API client should not make those for you because you opened it. The consent failure is real and well-documented. The "shared all API data" claim is not — MCP never authenticated on the primary report. Hold vendors to opt-in; hold headlines to the logs.

Not sponsored. No affiliate links. Not investment advice. MODEL has not installed Postman desktop or reproduced the installer on this machine; evidence is from the GitHub issue, pinned plugin source, HN, RuntimeWire, and secondary confirmation on the issue.

MODEL Editors