Check your agent configs: Postman's desktop app reportedly installed its plugins into Claude Code and Codex without asking
A GitHub issue that reached Hacker News' front page says opening the Postman desktop app on a Mac installed Postman plugins into Claude Code and Codex on its own. It also added a Codex startup hook telling the agent to use Postman's API skill for almost any API task, plus a remote MCP connection and a Postman CLI. The reporter shows a line from Postman's own log marking the install as an automatic upgrade. Postman's plugin README says its installer approves its own Codex hook, which skips the review Codex normally asks you to do. The reporter says there's no evidence of data being taken.
Why it matters
Hooks and plugins can steer what your coding agent does in every project. An app adding them without asking is a trust problem, and a good reminder to check what's loaded into your agents.
Who it's for
Developers who have Postman's desktop app and use Claude Code or Codex, especially on macOS.
What it means for you
- Look for postman entries in ~/.codex/config.toml, ~/.claude/settings.json and ~/.local/bin.
- Remove what you didn't choose, for example with npx @postman/postman-plugin remove, then restart your agents.
- In Codex, review your trusted hooks, and in Claude Code, check your enabled plugins and MCP servers.
- Follow the GitHub issue for Postman's response before reinstalling anything.
Applies to: Reported on macOS with Postman 12.33.4, with a similar report on 12.35.1. Postman's plugin includes a remove command to uninstall it.
Note: reported by users on X; we haven't independently confirmed it works in the current version.
Source: @SeanScott on X ↗
Written by AgentStackList from the original post. Checked Nov 5, 2026. Features, plans and availability can change, so confirm on the source before you rely on it.
securityclaude-codecodexpluginshooks
More Claude tricks
- Claude's agents now "dream" overnight: they re-read their own sessions and fix bad memories · Nov 7
- $200 free sandbox compute for your coding agents: Daytona, no card · Nov 7
- Free OpenFOAM CFD agent: describe a flow in plain English, Reynolds returns the case and plots · Nov 7
- 1,000 free web-search credits a month for your agents: Tavily Researcher, no card · Nov 7
Agent Stack Weekly · free
Get the week's best AI tricks
Limit and pricing changes, new MCP servers, and setup fixes for Claude Code, Codex, Cursor, Copilot and Antigravity.
No spam. Unsubscribe anytime. Read past issues