Did Postman upload data from my coding agent?

The Postman auto-install issue does not show any data upload. The reporter says the report 'does not claim to establish data exfiltration', and a November 3 follow-up in the GitHub thread says there is 'no evidence that data was uploaded'. Codex did log an authentication failure when it tried to reach the Postman MCP server at mcp.postman.com at startup.

What did Postman say about the auto-installed plugins?

A Postman staff member replied in the GitHub issue on November 3, 2026. Postman said it bundles the CLI and agent plugins with the desktop app because many users had trouble installing and wiring them up separately. It said users can uninstall them inside the app, that it will make the opt-in clearer for existing users, and that it is reviewing the hook approval and session-start behaviour.

How do I remove the Postman plugin from Codex or Claude Code?

Postman says the bundled CLI and agent plugins can be uninstalled from inside the Postman desktop app. The reporter also found a Postman marketplace and plugin entry in the global ~/.codex/config.toml and a Postman CLI in ~/.local/bin, so check both places. The reporter asked Postman for a full rollback path that does not reinstall the plugins on the next update.

Which coding agents does the Postman plugin support?

Postman's own install docs list Claude Code, Codex, Cursor, Factory, Kimi Code, OpenCode and Pi as supported agents, with a command that installs into every detected agent at once. In the GitHub issue, users reported the automatic install for Codex and Claude Code on Postman 12.33.4, and for Cursor as well on 12.35.1.

Postman · 2026-11-03 · major

Postman desktop auto-installed Codex and Claude Code plugins — users object

Postman desktop 12.33.4 installed its Codex and Claude Code plugins, a startup hook and an MCP server without asking, a GitHub issue reports. On November 3 Postman said it will make the opt-in clearer and review the hook.

GitHub issue card for Postman issue 14370 about auto-installed Codex and Claude Code plugins

Postman's desktop app added AI agent plugins to developers' Codex and Claude Code setups without asking first.

Quick facts

App	Postman desktop 12.33.4 (also seen on 12.35.1)
Plugins added	Codex 1.1.0, Claude Code 2.0.1, Cursor 2.2.0
Also added	SessionStart hook, mcp.postman.com MCP server, Postman CLI
Data upload	No evidence found, per the thread
Postman's reply	November 3, 2026 — clearer opt-in, hook review

What is it?

A GitHub issue titled '[SEVERE] Desktop auto-installs Codex/Claude plugins' reports that Postman desktop 12.33.4 added the Postman plugin to Codex (1.1.0) and Claude Code (2.0.1) on its own. The reporter found a Postman marketplace and plugin enabled in the global ~/.codex/config.toml, a remote MCP server at mcp.postman.com, and a Postman CLI placed in ~/.local/bin. A second user saw the same thing on 12.35.1, with a Cursor plugin also added.

How does it work?

Postman's log shows an 'auto-existing-upgrade' step that installed the agent plugins for existing users. The plugin adds a SessionStart hook that tells the coding agent to load a Postman API skill for 'any non-trivial API engineering task'. The reporter says the installer also calls a function to approve its own hook, so the agent host never asks the user to trust it.

Why does it matter?

Coding agents read their config and hooks on every session, so an app that writes to them silently changes how the agent behaves on every project. The reporter does not claim any data was uploaded, and a November 3 follow-up says there is 'no evidence that data was uploaded'. The issue still shows how much trust agent hook systems place in local installers.

Who is it for?

developers who use Postman with Codex, Claude Code or Cursor

Frequently asked questions

Did Postman upload data from my coding agent?: The Postman auto-install issue does not show any data upload. The reporter says the report 'does not claim to establish data exfiltration', and a November 3 follow-up in the GitHub thread says there is 'no evidence that data was uploaded'. Codex did log an authentication failure when it tried to reach the Postman MCP server at mcp.postman.com at startup.
What did Postman say about the auto-installed plugins?: A Postman staff member replied in the GitHub issue on November 3, 2026. Postman said it bundles the CLI and agent plugins with the desktop app because many users had trouble installing and wiring them up separately. It said users can uninstall them inside the app, that it will make the opt-in clearer for existing users, and that it is reviewing the hook approval and session-start behaviour.
How do I remove the Postman plugin from Codex or Claude Code?: Postman says the bundled CLI and agent plugins can be uninstalled from inside the Postman desktop app. The reporter also found a Postman marketplace and plugin entry in the global ~/.codex/config.toml and a Postman CLI in ~/.local/bin, so check both places. The reporter asked Postman for a full rollback path that does not reinstall the plugins on the next update.
Which coding agents does the Postman plugin support?: Postman's own install docs list Claude Code, Codex, Cursor, Factory, Kimi Code, OpenCode and Pi as supported agents, with a command that installs into every detected agent at once. In the GitHub issue, users reported the automatic install for Codex and Claude Code on Postman 12.33.4, and for Cursor as well on 12.35.1.

Try it

Check ~/.codex/config.toml and your Claude Code plugins for a Postman entry, and uninstall it from inside the Postman app