Postman Security: Manage AI Plugins & Data Risks

Postman security has become a critical concern for developers after a report surfaced detailing how the desktop app, version 12.33.4, silently auto-installs AI plugins. These integrations can alter your coding agent configurations and attempt to route API work through Postman services without explicit consent. This guide details how to identify these changes, manage data sharing settings, and implement controls to protect sensitive API data. You’ll learn specific steps to audit your local environment, disable unwanted hooks, and verify that your API credentials remain isolated from third-party AI services.

Understanding the Auto-Installation Mechanism

The core issue stems from Postman’s "PostmanAgentPluginService," which reportedly executes during startup for existing users. According to a detailed report filed on GitHub on October 25, 2026 (Issue #14370), the service logs show an automatic installation process triggered by an "auto-existing-upgrade" signal. This process installs plugins for both Claude Code and OpenAI Codex directly onto the user’s machine.

This isn't just about adding a simple extension. The installation modifies global configuration files for these coding agents. For Codex, the installer writes to ~/.codex/config.toml, adding a marketplace source pointing to https://github.com/postmanlabs/postman-plugin.git and enabling the postman@postman plugin. It also registers a startup hook that injects context into the agent’s session. This modification of external tools without explicit user permission raises significant trust and consent concerns.

The Startup Hook Injection

The installed hook, defined in hooks/codex-hooks.json, triggers on session start. It outputs a context file that instructs the AI agent to load the postman:api-engineer skill for any non-trivial API engineering task. This includes activities like designing, implementing, mocking, testing, or documenting APIs.

This behavior creates a trust boundary violation because the AI agent is prompted to route work through Postman skills even if the user didn't request or approve it. Furthermore, the installer reportedly attempts to approve its own hook by updating the trusted_hash in the configuration, effectively bypassing standard user confirmation for this specific integration. This self-approval mechanism is a key part of the reported security concern, as it circumvents typical security checks.

Auditing Your Local Environment

Before making any changes, you need to verify if your system has been affected. The issue was reported concerning Postman Desktop version 12.33.4. If you haven't updated to this version or later, you might be unaffected, but it's still prudent to check.

Checking Postman Logs

Open the Postman desktop application logs. On macOS, this is typically located at ~/Library/Application Support/Postman/logs/main.log. Search for the string PostmanAgentPluginService~install. If you see entries indicating claude-code:installed or codex:installed, the auto-installation has reportedly occurred.

1# Example log entries indicating auto-installation
22026-10-24T09:34:14.418Z (12:34 Jerusalem time): PostmanAgentPluginService~install: script completed {"source":"auto-existing-upgrade","results":["claude-code:installed","codex:installed"],"installer":"script"}
3Main: autoInstall.plugin.existing-user finished {"outcome":"installed","platform":"darwin","exposed":true,"signedIn":true,"flagTimedOut":false,"useScript":true,"installer":"script","scriptResults":"claude-code:installed,codex:installed"}

Inspecting Codex Configuration

If you use OpenAI Codex, examine ~/.codex/config.toml. Look for the following sections. Their presence indicates that Postman has modified your Codex configuration.

1[marketplaces.postman]
2source_type = "git"
3source = "https://github.com/postmanlabs/postman-plugin.git"
4
5[plugins."postman@postman"]
6enabled = true

Also, check for hooks.state entries that reference postman@postman:hooks/codex-hooks.json. The presence of a trusted_hash indicates the hook has been automatically approved without user interaction.

Inspecting Claude Code Configuration

For Claude Code users, check ~/.claude/settings.json for postman@claude-plugins-official being enabled. Additionally, review ~/.claude/plugins/installed_plugins.json. If you see an entry for a Postman plugin, particularly version 2.0.1, with an installation date matching your Postman update, the plugin was likely installed automatically.

1// Example entry in ~/.claude/settings.json
2{
3  "plugins": {
4    "postman@claude-plugins-official": {
5      "enabled": true
6    }
7  }
8}
9
10// Example entry in ~/.claude/plugins/installed_plugins.json
11[
12  {
13    "name": "postman",
14    "version": "2.0.1",
15    "installationDate": "2026-10-24T09:34:14.418Z",
16    // ... other details
17  }
18]

Disabling Unwanted AI Integrations

Once you've identified the unwanted components, you can disable them to restore your previous workflow and prevent potential data exposure. The goal is to remove the Postman plugin from your coding agents and revoke any trusted hook approvals.

Removing Codex Plugins and Hooks

1. Open ~/.codex/config.toml in a text editor.
2. Carefully delete the entire [marketplaces.postman] section.
3. Delete the entire [plugins."postman@postman"] section.
4. Remove any hooks.state entries that reference postman@postman. These entries typically look like [hooks.state."postman@postman:hooks/codex-hooks.json:session_start:0:0"].
5. Save the file and restart your Codex session to ensure the changes take effect.

Removing Claude Code Plugins

1. Open ~/.claude/settings.json.
2. Locate the plugins section and disable or remove the postman@claude-plugins-official entry.
3. For a full local uninstall, check ~/.claude/plugins/installed_plugins.json and remove the corresponding Postman plugin entry.
4. Restart Claude Code.

Uninstalling the Postman CLI

The report also noted that a Postman executable and its library directory were installed in ~/.local/bin. If you don't actively use the Postman CLI, removing these files can prevent background processes from running or further unexpected installations.

1# Example: Removing Postman CLI from local bin (adjust path if different)
2# Be cautious: ensure you are only removing Postman-specific directories.
3rm -rf ~/.local/bin/postman
4rm -rf ~/.local/lib/postman

Always double-check the paths before executing rm -rf to avoid accidentally deleting critical system files.

Managing API Data Privacy

The primary risk of these AI plugins isn't just workflow disruption, but potential data exposure. When an AI agent is instructed to use Postman skills, it may attempt to send API definitions, environment variables, or test results to https://mcp.postman.com/mcp via the Model Context Protocol (MCP).

Understanding the MCP Connection

The Model Context Protocol (MCP) is designed to allow AI agents to interact with external services, providing context and receiving instructions. The installed configuration reportedly points Codex to https://mcp.postman.com/mcp. In the reported case, this connection failed with an "Auth required" error, meaning no data was successfully transmitted in that specific instance. However, the configuration itself represents a potential vector for data sharing if authentication were to be established later.

To prevent any data from leaving your machine via this channel, ensure the MCP server is disabled or removed from your agent configuration. For Codex, this is often managed in mcp.codex.json or similar configuration files. Remove any entries referencing postman as an MCP server. This ensures your AI agent won't attempt to connect to Postman's MCP endpoint.

Protecting Sensitive Environment Variables

Even without AI plugins, developers must be cautious about what data is exposed to AI tools. AI agents often have access to environment variables in the shell where they run. If sensitive API keys or tokens are stored as global environment variables, an AI agent could potentially access and transmit them.

Best practices for protecting sensitive data include:

• Use Secret Managers: Store sensitive API keys, tokens, and credentials in a dedicated secret manager (e.g., HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, Google Secret Manager). These tools provide secure storage, access control, and auditing capabilities, preventing secrets from residing in plain text on your local machine or in environment variables.
• Scope Environment Variables: If you must use environment variables, ensure they are scoped to the specific terminal session or service account that absolutely requires them, rather than your global user profile. Tools like direnv can help manage environment variables on a per-project basis.
• Redact Logs: Configure your logging frameworks to mask or redact sensitive fields. AI agents that read logs for context might inadvertently capture secrets if they are not properly sanitized.
• Principle of Least Privilege: Grant your AI agents and other tools only the minimum necessary permissions and access to data. If an agent doesn't need access to API keys for a particular task, don't provide it.

Postman Security Best Practices

Beyond disabling the specific plugins, adopting broader Postman security habits is crucial to protect your API data and maintain a secure development workflow.

1. Review Collection Permissions

Ensure that your Postman collections are set to private if they contain sensitive API endpoints, example payloads, or confidential business logic. Public collections can be indexed and accessed by anyone with the link, potentially exposing proprietary information. Regularly audit your collections and their sharing settings, especially in team workspaces.

2. Audit Workspace Members

Regularly review who has access to your Postman workspaces. Remove users who no longer need access, such as former employees or contractors. This is especially important if you use Postman for shared team APIs, as unauthorized access to a workspace can lead to data breaches or manipulation of API definitions. Implement a clear offboarding process that includes revoking Postman access.

3. Use Environment-Based Secrets

Postman allows you to store variables in environments. For sensitive variables like API keys, tokens, or authentication credentials, ensure they are marked as "secret" in your Postman environments. This prevents them from being shared in collaboration features, exported in plain text, or inadvertently displayed in logs or screenshots. Use separate environments for development, staging, and production, each with its own set of credentials.

4. Monitor API Traffic

Implement monitoring for your APIs to detect unusual traffic patterns that might indicate data exfiltration, unauthorized access, or credential compromise. Look for spikes in requests from unexpected IP addresses, unusual error rates, or access to sensitive endpoints outside of normal operating hours. Tools like API gateways, intrusion detection systems, and security information and event management (SIEM) platforms can help with this.

5. Keep Postman Updated (with caution)

While the reported issue highlights a concern with a specific Postman version, keeping your software updated generally improves security by patching known vulnerabilities. However, in light of this report, exercise caution. Review release notes for new versions, especially regarding AI integrations or automatic configurations, before updating. Consider disabling automatic updates for Postman and manually installing after a review period, if possible.

Common Errors and Troubleshooting

"MCP Server Startup Failed"

If you see errors like MCP server startup failed server_name="postman" ... error: Auth required in your AI agent's logs, it means the AI agent tried to connect to the Postman MCP server but lacked valid credentials. This is actually a good sign that data isn't being shared, but you should still remove the configuration to prevent future attempts or potential data sharing if authentication were to be established.

"Hook Not Found"

If you remove the hook configuration but your AI agent still complains about a missing hook, it might be due to cached configurations. Restart your terminal, your AI agent session, and potentially your entire system to clear any in-memory state or stale configuration files. You might also check temporary directories for lingering files.

Plugin Reinstallation

If you update Postman again after disabling the plugins, the auto-installation script may run again. To prevent this, you may need to:

• Revert Immediately: Revert the configuration files (e.g., ~/.codex/config.toml, ~/.claude/settings.json) immediately after any Postman update.
• Check Postman Settings: Look for a Postman setting to disable AI plugin auto-updates or integrations in your version's preferences. Such a setting might be added in response to user feedback.
• Monitor Configuration Files: Implement a simple script or use file monitoring tools to alert you if your AI agent configuration files are modified unexpectedly.

Verifying Your Setup

After making changes, it's crucial to verify that your AI agents are no longer interacting with Postman in an unauthorized manner.

1. Start a New Session: Open a new terminal and start a fresh session in Codex or Claude Code.
2. Test API Task: Ask the agent to perform a simple API-related task (e.g., "Generate a curl command for a GET request to example.com").
3. Observe Response: Observe the agent’s response. It should not mention Postman skills, attempt to load Postman plugins, or try to connect to mcp.postman.com. The output should be purely based on the agent's native capabilities.
4. Check Logs Again: Review your Postman logs (~/Library/Application Support/Postman/logs/main.log) and your AI agent's logs to ensure no new PostmanAgentPluginService installation events or MCP connection attempts occur.

Key Takeaways

• Postman Desktop v12.33.4 reportedly auto-installs AI plugins for Codex and Claude Code without explicit user consent.
• These plugins inject hooks that instruct AI agents to route API work through Postman, potentially exposing sensitive data via the Model Context Protocol (MCP).
• You can disable these integrations by editing ~/.codex/config.toml and ~/.claude/settings.json to remove Postman-related entries.
• Always audit your local file system and configuration files for unexpected changes after updating developer tools.
• Protect sensitive API data by using secret managers, restricting environment variable access, and implementing robust API monitoring.

FAQ

Did Postman steal my API keys? There is no evidence from the reported issue that Postman stole your API keys. The concern involves the auto-installation of plugins and configuration changes that could lead to data transmission. Data transmission via the MCP server requires a successful authenticated connection, which reportedly failed in the specific instance due to missing authentication.

How do I update Postman without reinstalling the AI plugins? You can update Postman, but the auto-installation script may run again. To prevent this, you may need to revert the configuration files immediately after the update. Check for a setting in Postman preferences to disable AI plugin auto-updates or integrations if available in your version.

Is the Postman MCP server secure? The security of any third-party service, including the MCP server, depends on its implementation and your authentication practices. However, any data sent to a third-party service via MCP should be treated as potentially sensitive. Only share data you are comfortable with a third party accessing. For security-related decisions, always verify details for your specific situation.

What if I use a different AI agent? If you use a different AI agent that supports MCP or plugins, it's prudent to check its configuration for any Postman-related entries. While the reported issue specifically targeted Codex and Claude Code, the auto-installation script could potentially target other agents in future versions. Always audit your agent’s configuration files for unexpected changes after updating developer tools.