Did Postman install plugins into Claude Code and Codex? 3-step check and removal (plugins, hooks, MCP, config.toml)

Short version: if you run the Postman desktop app on a Mac and also use Claude Code, Codex or Cursor, take two minutes to check your agent configuration.

• According to GitHub issue #14370, Postman desktop 12.33.4 logged auto-existing-upgrade when an existing user opened it, after which Claude Code and Codex both had the Postman plugin. Codex's ~/.codex/config.toml also gained a trusted_hash record for Postman's own startup hook. Another user in the same issue reports the same behaviour on 12.35.1.
• A Postman employee replied in the issue that bundling was meant to make the CLI and plugins easier to set up, that Postman will make the opt-in clearer, and that it is reviewing the hook approval and session-start behaviour.
• On November 4 we reproduced the same entries with Postman's official npx installer in an isolated directory: the trusted_hash matches the one in the issue character for character, and the startup hook injected Postman's instructions into both Claude Code and Codex sessions.
• The official removal command npx @postman/postman-plugin remove uninstalls the plugin from both agents, but in our test the Codex marketplace entry and the trusted_hash record stayed in config.toml. You have to remove those by hand.

Fastest check:

grep -n -i postman ~/.codex/config.toml ~/.claude/settings.json ~/.claude.json 2>/dev/null
claude plugin list
codex plugin list

If any of this prints Postman entries, follow the 3 steps below.

Create an API Key and connect models in Claude Code, Codex and Cursor →

What happened

According to issue #14370 (filed October 25, marked [SEVERE]), the reporter opened Postman 12.33.4 on macOS after not using it for a while. Codex then kept reporting that an MCP server needed sign-in and kept loading Postman skills for API tasks. Postman's own log, ~/Library/Application Support/Postman/logs/main.log, contained these two lines:

PostmanAgentPluginService~install: script completed
{"source":"auto-existing-upgrade","results":["claude-code:installed","codex:installed"],"installer":"script"}

Main: autoInstall.plugin.existing-user finished
{"outcome":"installed","platform":"darwin","exposed":true,"signedIn":true,...}

The changes listed in the report:

The installer source quoted in the report has an approvePostmanHook function that, after installing the plugin, uses Codex's hooks/list and config/batchWrite to mark Postman's hook as trusted. The reporter is explicit that the report shows changes to other tools without consent and does not show that any data was sent anywhere. The New Stack also notes that the issue contains no evidence that Postman collected or transmitted API data.

What followed:

• According to a comment in the issue, another user on macOS saw Postman update from 12.31.3 to 12.35.1, after which the log again showed auto-existing-upgrade and the CLI plus the Claude Code and Codex plugins were installed; Cursor showed cursor:already-installed. That machine's config.toml had no trusted_hash.
• According to another comment, GitHub Copilot CLI's ~/.copilot/settings.json also contained Postman's marketplace and plugin, and the uninstall entry in Postman's menu did not remove them from Copilot.
• According to @daniiie7, unpacking the 12.35.1 Mac app shows that a feature flag decides whether the automatic install runs, including for new downloads.
• Posts by @szchan111 and @Curingieul spread the story among English and Chinese developers, and X lists it as a trending news story.

Postman's response: on November 3 (US time), Postman employee zecoquit replied in the issue that the desktop app bundles the Postman CLI and the agent plugins because many users had trouble installing and wiring them up separately, that this is mentioned on the download page and in the app update flow, and that the components can be uninstalled from inside the app. The reply adds "we've heard you": Postman will make the opt-in clearer, especially for existing users, is reviewing the hook approval and session-start behaviour, and will post updates in the issue.

Who should check

• You use the Postman desktop app on macOS, are signed in, and opened or updated it recently (the reports cover 12.33.4 and 12.35.1).
• Claude Code, Codex, Cursor or GitHub Copilot CLI is installed on the same machine.
• Codex keeps asking you to sign in to a Postman MCP server, or keeps mentioning Postman skills on API tasks.

Even without Postman, the same checks show what any third-party tool has added to your agents.

Our reproduction

Setup: November 4, 2026, 17:20–17:25 Beijing time, Linux, Claude Code 2.1.318, codex-cli 0.166.0, @postman/postman-plugin 0.6.0 (the npm package maintained by Postman), an aicodewith key, and HOME and CODEX_HOME pointing at a fresh isolated directory so no real configuration was touched.

We have no Mac build of Postman, so we did not reproduce the "open the desktop app" step. The issue log says "installer":"script". We used the detected-agents installer from Postman's documentation, npx @postman/postman-plugin install --agent claude-code,codex --yes. We cannot confirm that the desktop app runs the same script, but the entries it wrote match the ones in the report.

We also installed the plugin once with the native Codex commands from Postman's per-agent docs. config.toml then had the plugin and marketplace but no trusted_hash, codex exec did not run the hook, and the session record had no Postman text. That matches the docs: when you install through Codex itself, the hook starts untrusted and Codex asks you to review it. So whether the hook runs in every session comes down to that one trusted_hash record.

Step 1: check Claude Code

# 1) Installed plugins (user and project scope)
claude plugin list

# 2) Plugins and marketplaces turned on in your user settings
grep -n -i -E 'postman|enabledPlugins|extraKnownMarketplaces|"hooks"' ~/.claude/settings.json

# 3) MCP servers, including the ones a plugin brings in
claude mcp list
grep -n -i postman ~/.claude.json

# 4) Install records with timestamps
cat ~/.claude/plugins/installed_plugins.json

Our output with the Postman plugin installed:

$ claude plugin list
Installed plugins:

  ❯ postman@claude-plugins-official
    Version: 2.0.1
    Scope: user
    Status: ✔ enabled

$ claude mcp list
plugin:postman:postman: https://mcp.postman.com/mcp (HTTP) - ! Needs authentication

The two blocks added to ~/.claude/settings.json:

  "extraKnownMarketplaces": {
    "claude-plugins-official": {
      "source": {
        "source": "github",
        "repo": "anthropics/claude-plugins-official"
      }
    }
  },
  "enabledPlugins": {
    "postman@claude-plugins-official": true
  }

claude-plugins-official is Anthropic's official plugin marketplace and is fine on its own; what matters is whether enabledPlugins lists anything you did not install yourself. Postman's SessionStart hook lives in the plugin's own hooks/hooks.json, not in the hooks key of settings.json, so looking at settings.json alone will not show it. Use claude plugin list.

Step 2: check Codex config.toml

codex plugin list
codex plugin marketplace list
codex mcp list

# Section names only (no keys are printed)
grep -n -E '^\[(marketplaces|plugins|hooks|mcp_servers)' ~/.codex/config.toml

# Hook trust records
grep -n -A2 'hooks.state' ~/.codex/config.toml

With the Postman plugin installed:

$ codex plugin list
PLUGIN           STATUS              VERSION  SOURCE
postman@postman  installed, enabled  1.3.0    ~/.codex/.tmp/marketplaces/postman

$ codex plugin marketplace list
MARKETPLACE  ROOT
postman      ~/.codex/.tmp/marketplaces/postman

$ codex mcp list
Name         Url                          Bearer Token Env Var  Status   Auth
postman-mcp  https://mcp.postman.com/mcp  -                     enabled  Not logged in

What was added to config.toml in our reproduction (the trusted_hash matches the issue):

[marketplaces.postman]
source_type = "git"
source = "https://github.com/postmanlabs/postman-plugin.git"
ref = "main"

[plugins."postman@postman"]
enabled = true

[hooks.state]

[hooks.state."postman@postman:hooks/codex-hooks.json:session_start:0:0"]
trusted_hash = "sha256:b67ddd1ece328f5a6f9103ce011bb58adb8411daea644f284732cff85d15cbb3"
trusted_content_hash = "sha256:30a87cda8b01827030f3a7572a88bef9e2ff199d95bd50915b4dd5bb9d5e0023"

Read the three parts separately:

• [marketplaces.xxx]: where plugins come from, a Git repository.
• [plugins."xxx@xxx"] enabled = true: the plugin is on, so its skills and MCP server load.
• [hooks.state."...:session_start:..."] with trusted_hash: the hook is trusted and runs in every session. A trusted_hash for a hook you never approved in Codex is the first thing to delete.

codex exec log with the plugin installed:

$ codex exec --skip-git-repo-check "<prompt>"
ERROR rmcp::transport::worker: worker quit with fatal: Transport channel closed,
  when AuthRequired(... "https://mcp.postman.com/.well-known/oauth-protected-resource/mcp" ...)
hook: SessionStart
hook: SessionStart Completed

The start of the text the hook injects (from hooks/session-start-context.md in Postman's plugin repository):

<EXTREMELY_IMPORTANT>
You have the Postman plugin.

Before responding to any non-trivial API engineering task — designing, implementing,
mocking, testing, monitoring, documenting, or deploying an API or Postman Flow — load
the `postman:api-engineer` skill and follow it. ...

To see whether earlier sessions received it, search the session records:

# Codex: sessions whose context received the hook text
grep -l 'EXTREMELY_IMPORTANT' ~/.codex/sessions/*/*/*/*.jsonl

# Claude Code: transcripts with a SessionStart hook result carrying that text
grep -l 'EXTREMELY_IMPORTANT' ~/.claude/projects/*/*.jsonl

In our reproduction both agents' sessions after the install matched, and none of the sessions after cleanup did.

Step 3: check Cursor, Copilot CLI and the Postman CLI

# Cursor (paths used by Postman's installer source)
ls -d ~/.cursor/plugins/local/postman ~/.cursor/plugins/cache/cursor-public/postman 2>/dev/null

# GitHub Copilot CLI
grep -n -i postman ~/.copilot/settings.json 2>/dev/null

# Postman CLI dropped next to the desktop app
ls -l ~/.local/bin | grep -i postman

The two Cursor paths come from the source of Postman's plugin installer: a local clone in ~/.cursor/plugins/local/postman and the Cursor marketplace copy in ~/.cursor/plugins/cache/cursor-public/postman. The Copilot CLI path comes from a comment in the issue.

How to remove it

Option 1: Postman's official command

According to Postman's documentation, the detected-agents installer supports status, remove (alias uninstall) and --dry-run:

# What is installed, per agent
npx @postman/postman-plugin status

# Preview the removal, nothing is changed
npx @postman/postman-plugin remove --dry-run

# Remove from every detected agent (alias: uninstall)
npx @postman/postman-plugin remove

# Or only some agents
npx @postman/postman-plugin remove --agent claude-code,codex

Our remove output:

Found 2 coding agents. Postman in each:
  Claude Code         installed      postman@claude-plugins-official 2.0.1
  Codex               installed      postman@postman 1.3.0

Claude Code
  $ claude plugin uninstall postman@claude-plugins-official --scope user --json
  done: uninstalled postman@claude-plugins-official
Codex
  $ codex plugin remove postman@postman --json
  done: removed postman@postman

Summary:
  Claude Code         done     uninstalled postman@claude-plugins-official
  Codex               done     removed postman@postman

The Postman employee also said the components can be removed inside the app; according to a comment in the issue, the menu item is Help → Postman CLI and Plugins → Uninstall Postman Coding Agent Plugin.

Option 2: clean up what is left

After the official remove, our config.toml still contained:

# ~/.codex/config.toml after "npx @postman/postman-plugin remove"
[marketplaces.postman]
source_type = "git"
source = "https://github.com/postmanlabs/postman-plugin.git"
ref = "main"

[hooks.state]

[hooks.state."postman@postman:hooks/codex-hooks.json:session_start:0:0"]
trusted_hash = "sha256:b67ddd1ece328f5a6f9103ce011bb58adb8411daea644f284732cff85d15cbb3"
trusted_content_hash = "sha256:30a87cda8b01827030f3a7572a88bef9e2ff199d95bd50915b4dd5bb9d5e0023"

The ~/.claude/plugins/cache/claude-plugins-official/postman and ~/.codex/plugins/cache/postman directories were also still there. Clean up in this order:

# --- Codex ---
codex plugin remove postman@postman          # if codex plugin list still shows it
codex plugin marketplace remove postman
cp ~/.codex/config.toml ~/.codex/config.toml.bak
# Open ~/.codex/config.toml and delete the whole table
#   [hooks.state."postman@postman:hooks/codex-hooks.json:session_start:0:0"]
# (the header line plus trusted_hash and trusted_content_hash)
rm -rf ~/.codex/plugins/cache/postman

# --- Claude Code ---
claude plugin uninstall postman@claude-plugins-official --scope user   # if still listed
rm -rf ~/.claude/plugins/cache/claude-plugins-official/postman

# --- Cursor ---
rm -rf ~/.cursor/plugins/local/postman
# then uninstall Postman from Cursor's own plugin marketplace view

# --- Postman CLI, only if you do not use it ---
ls -l ~/.local/bin | grep -i postman

Then check again and run a real task to confirm both agents work:

$ grep -n -i -E 'postman@|marketplaces\.postman|trusted_hash' ~/.codex/config.toml ~/.claude/settings.json
(no output, exit 1)

$ codex plugin list | grep -i 'postman@'
(no output, exit 1)

$ codex mcp list
No MCP servers configured yet. Try `codex mcp add my-tool -- my-command`.

$ claude plugin list
No plugins installed. Use `claude plugin install` to install a plugin.

$ codex exec --skip-git-repo-check "Create hello.py that prints 'clean-ok', run it with python3, and report its output."
exec
/bin/bash -lc 'python3 hello.py' in <test-dir>/ws
 succeeded in 0ms:
clean-ok
[exit 0, 11.8 s]

$ claude -p "Create hello2.py that prints 'clean-ok-cc', run it with python3, and report its output." \
    --allowedTools "Write,Bash(python3:*)"
Output: `clean-ok-cc`
[exit 0, 9.4 s]

extraKnownMarketplaces.claude-plugins-official in ~/.claude/settings.json is the official marketplace and can stay; if you never use Claude Code plugins you can delete that block too.

Stop it from happening again

1. Compare your configuration after updating a desktop app, IDE or CLI. This snapshot keeps only section and plugin names, never your key:

# Snapshot without secrets: Codex section names, Claude Code plugin/marketplace/hook names
mkdir -p ~/.agent-audit
grep -E '^\[' ~/.codex/config.toml > ~/.agent-audit/codex.txt
python3 - > ~/.agent-audit/claude.txt <<'EOF'
import json, os
d = json.load(open(os.path.expanduser('~/.claude/settings.json')))
for k in ('enabledPlugins', 'extraKnownMarketplaces', 'hooks'):
    print(k, sorted(d.get(k, {})))
EOF

# After updating a desktop app, IDE or CLI, compare with the snapshot
diff ~/.agent-audit/codex.txt <(grep -E '^\[' ~/.codex/config.toml)

Comparing before and after the install gave us:

$ diff ~/.agent-audit/codex.txt <(grep -E '^\[' ~/.codex/config.toml)
2a3,6
> [marketplaces.postman]
> [plugins."postman@postman"]
> [hooks.state]
> [hooks.state."postman@postman:hooks/codex-hooks.json:session_start:0:0"]

# Claude Code, before and after
enabledPlugins []                                  ->  ['postman@claude-plugins-official']
extraKnownMarketplaces []                          ->  ['claude-plugins-official']

1. Trust only hooks you approved. If Codex has a trusted_hash you do not recognise, delete it; Codex will ask you to review the hook next time it starts.
2. Turn off MCP servers you do not use. A remote MCP that keeps asking for sign-in is contacted on every start.
3. Check project-level files too. AGENTS.md and .claude/settings.json in a repository also change agent behaviour; see Can an AGENTS.md in Downloads hijack Codex and Claude Code?.
4. Give the agent clear permission boundaries. If an unwanted hook slips in, the sandbox and approval policy still stop out-of-bounds actions; see Codex sandbox and /permissions.

Keeping your config clean with an aicodewith key

A hook is a command that runs as your user, so it can read files your user can read, including configuration that holds your key. Keep only things you recognise in these files. After cleanup, a clean Codex configuration needs only this (Codex uses experimental_bearer_token in the global config.toml):

# ~/.codex/config.toml
model = "gpt-6.1-sol"
model_provider = "aicodewith"

[model_providers.aicodewith]
name = "aicodewith"
base_url = "https://api.aicodewith.ai/chatgpt/v1"
wire_api = "responses"
experimental_bearer_token = "YOUR_API_KEY"

[projects."/path/to/your/repo"]
trust_level = "trusted"

Claude Code ~/.claude/settings.json:

{
  "env": {
    "ANTHROPIC_BASE_URL": "https://api.aicodewith.ai",
    "ANTHROPIC_AUTH_TOKEN": "YOUR_API_KEY"
  }
}

If cleanup turned up a hook or plugin you do not recognise, remove it, then create a new key in the console and update both files.

Create an API Key for Claude Code, Codex and Cursor →

For every option, see the Codex config.toml guide and How to connect Claude Code to a third-party API.

FAQ

Does the Postman plugin send my data anywhere?

According to the reporter and The New Stack, the issue contains no evidence that data was collected or transmitted. The report is about plugins, a hook and a remote MCP server being added to other tools without clear consent. Without sign-in, Postman's MCP server does not connect; in our reproduction it showed Not logged in / Needs authentication.

I removed the plugin. Does a leftover trusted_hash matter?

With the plugin gone, the hook has no files to run. But the trust record stays in config.toml, and if the same hook is installed again it runs straight away without asking you. Delete it as well.

I installed the Postman plugin myself. Should I remove it?

No. If you ran npx @postman/postman-plugin yourself, Postman's docs say the installer approves the Codex hook for you. If you would rather approve it yourself, install with the native codex plugin add commands instead.

I only use Cursor or Copilot CLI. Should I check?

Yes. According to comments in the issue, the 12.35.1 log included cursor:already-installed, and Postman entries also appeared in Copilot CLI's settings.json.

Claude Code or Codex stopped working after cleanup. What now?

Make sure you did not delete the provider settings: [model_providers.aicodewith] for Codex, ANTHROPIC_BASE_URL and ANTHROPIC_AUTH_TOKEN for Claude Code. Copy config.toml with cp before editing so you can restore it.

Further reading

• Moving from Claude Code to Codex: /import for rules, skills, MCP and hooks
• Codex MCP setup: install, connect, OAuth and verify
• Claude Code auto mode failing behind a gateway? 2.1.317 fixes 403/422
• Codex sandbox and /permissions