Postman Alternative? First Check What It Put in Claude Code

If you are looking for a Postman alternative this week, check your own machine before you pick one. According to a GitHub issue opened on October 25, opening Postman Desktop 12.33.4 on a Mac was followed by Postman plugins showing up inside two AI coding agents, Claude Code and Codex. The reporter says they never explicitly authorized it.

That is one person's evidence from one macOS machine, and it has not been independently reproduced. No source shows that any data left the computer. Still, the changes it lists are specific, they sit inside your coding agents, and Postman's own documentation confirms part of the mechanism.

So the useful order is: find out what is installed, remove what you did not ask for, then compare the other API clients on facts rather than on headlines.

What did Postman install on my computer?

What Postman installed, according to issue #14370, is a set of agent plugins plus a command-line tool. The reporter quotes Postman's own log, which records an install with the source "auto-existing-upgrade" and the entries "claude-code:installed" and "codex:installed", dated October 24.

The issue then lists what changed on disk:

• Codex: ~/.codex/config.toml gained a Postman marketplace (postmanlabs/postman-plugin), enabled postman@postman, and added hooks.state entries with trusted_hash values.
• Claude Code: ~/.claude/settings.json enabled postman@claude-plugins-official, and ~/.claude/plugins/installed_plugins.json recorded version 2.0.1.
• Your shell: a Postman CLI executable appeared in ~/.local/bin.

The reporter titled the issue with a [SEVERE] prefix. As of November 4 it was still open with 38 comments. One commenter, ronthedrummer, reported that updating from Postman 12.31.3 to 12.35.1 triggered the same installs, a detail the DEV Community write-up by Gabriel Anhaia also cites. That author notes the sequence has not been reproduced on a clean Mac.

What is a Claude Code hook?

Claude Code hooks are commands the agent runs automatically when a set event happens. The one at the centre of this story is a SessionStart hook, which, per Claude Code's hooks documentation, runs when a session starts or resumes. If the command prints plain text and exits cleanly, that text is added as context Claude can see and act on.

Think of it as a note taped to the agent's monitor that it reads every time it sits down. A plugin is the package that delivers the note: the docs say installing one adds its skills, agents, hooks and MCP servers (MCP servers are connections that let an agent call an outside service's tools).

Postman's plugin ships a SessionStart hook with the matcher "startup|clear|compact", so it fires on a fresh session, after a clear and after a compact. It prints a file called session-start-context.md. According to Postman's plugin repo, that file tells the agent to load the "postman:api-engineer" skill before any non-trivial API engineering task. The same file says your own instructions in AGENTS.md or CLAUDE.md, and your direct requests, take precedence.

The part that drew criticism is trust. Codex hooks need your approval. Postman's docs say that when the plugin is installed through the Codex app or command line, the hook installs untrusted and Codex shows "Hooks need review" at the next start, where you approve it. But Postman's detected-agents install page says its own installer approves the hook for you, and tells you to review it in Codex only if it cannot.

The New Stack reported the same contrast: the installer can approve the hook on the user's behalf, while people installing the plugin directly through Codex must approve it themselves. Security researcher Frank Denis called the integrations "junk" on X and pointed out that the installer attempts to trust its own startup hook, the outlet adds. Postman's docs also say its skills and MCP server work with or without the hook, which only makes Codex reach for the skills more reliably.

Is Postman safe?

On what has been published so far, the documented problem is consent and control over your coding agents, not proven data theft. The reporter states the issue does not claim to establish data exfiltration. The New Stack says the GitHub report provides no evidence that Postman collected or transmitted API data, and that it documents changes to agent settings and a remote MCP connection.

The Codex plugin config points to Postman's remote MCP server at mcp.postman.com/mcp. Per the issue, Codex logged a failed startup with "Auth required", and The New Stack says Codex repeatedly failed to authenticate.

You may also have seen a claim from Siddharth Garimella on X that the hooks intercept API data and send it to the company. The New Stack notes that the GitHub report provides no evidence for that. Treat it as unproven.

Postman's side came in a reply on the thread dated November 3, from the GitHub account zecoquit, written in Postman's voice ("we") although the account shows no organisation affiliation. The reply says Postman bundles the CLI and agent plugins with the desktop app because many users had trouble installing and wiring them up separately, that this is mentioned on the download page and in the app update flow, and that the components can be uninstalled from inside the app. It adds: "we're going to make the opt-in clearer, especially for existing users", and says Postman is reviewing the hook approval and session-start behavior, with updates to follow in the thread.

That is a promise, not a confirmed change: as of November 4 the issue remained open. The New Stack also said it asked Postman about the automatic installs, hook approvals and consent, and had no response by publication on November 3.

How to remove Postman plugin from Claude Code

To remove the Postman plugin from Claude Code, start with the commands in Claude Code's plugin docs. List what is installed, then disable or uninstall the Postman entry by name and marketplace:

claude plugin list
claude plugin disable postman@claude-plugins-official
claude plugin uninstall postman@claude-plugins-official

You can do the same from the /plugin menu's Installed tab inside a session. User-scope plugins are recorded under enabledPlugins in ~/.claude/settings.json, so that file is where to confirm the entry is gone.

Postman documents its own removal command, which uninstalls the plugin from each agent it detects. Its flags let you check first: status shows what is installed, --dry-run previews, --agent <id> limits it to one agent, and -y skips the prompt.

npx @postman/postman-plugin status
npx @postman/postman-plugin remove --dry-run
npx @postman/postman-plugin remove

Postman's reply on the thread also says the components can be uninstalled from inside the desktop app.

Checking Codex and the rest

The DEV author suggests these checks. They are that author's suggestions, so read each one before you run it:

grep -n -i postman ~/.codex/config.toml
claude plugin list
grep -n -i postman ~/.claude/settings.json
ls -l ~/.local/bin | grep -i postman

For Codex, the same post suggests running /hooks in a session and disabling the Postman SessionStart hook.

Two caveats. The DEV post says Postman's docs do not state whether the remove command clears the Codex trust record, and its author had not run it. And the reporter argues an uninstall command is not enough: they want removal to also clear agent settings, trusted hooks, MCP connections and CLI tools. Nobody has confirmed the trust record is cleared, so re-run the grep on config.toml afterwards. We covered a related cleanup routine in our guide to how to check and clean up after the Claude Code extension VSCode backdoor.

Postman alternatives compared: Bruno, Insomnia, Hoppscotch and HTTPie

If you still want a Postman replacement, here are four alternatives to Postman with only what their official sites, pricing pages and GitHub repos say. For reference, Postman's pricing page lists Free at $0 a month for 1 user, Solo at $9 a month and Team at $19 per user a month (both billed annually), and Enterprise through sales.

Prices were last checked on November 4, 2026. Confirm current pricing on each vendor's page before you commit a team.

Bruno calls itself a "Git-native API client" and is a natural open source alternative to Postman if you want collections to live next to your code. Its site says there is no cloud sync, no account and no login, and claims 4M users. Both are vendor claims. Its GitHub repo lists an MIT license, and its pricing page shows a $0 Open Source plan.

Insomnia keeps a free Essentials plan that includes the Inso CLI. Its Scratch Pad mode is local-only with no login, per the pricing page.

Hoppscotch describes itself as an "open source API development ecosystem", and its repo pitches it as an open-source alternative to Postman and Insomnia. Its pricing page did not render for us, so we list no prices.

HTTPie suits people who live in the terminal: the official site describes its CLI as an open-source API testing client. The CLI repo is BSD-3-Clause and was last pushed in December 2024. The separate desktop repo shows no detected license, and we could not verify pricing.

One honest limit: none of our sources says whether any of these Postman competitors bundle agent plugins. Whatever you install, check ~/.claude and ~/.codex afterwards using the commands above.

What to watch next

Postman says updates will come in the issue thread, so that is the place to follow. Four things matter:

• The opt-in. Whether Postman ships the clearer opt-in for existing users that the November 3 reply promised.
• Hook approval. Whether the installer stops approving its own Codex hook after the promised review.
• Clean removal. Whether anyone confirms that npx @postman/postman-plugin remove clears the Codex trust record, settings, MCP connection and CLI.
• Reproduction. Whether someone reproduces the install on a clean Mac, or reports it on another platform. So far the evidence is one macOS machine plus one commenter's version update.

Until then, the practical move is the same whether or not you choose a Postman alternative: know what your coding agents load at startup, and remove anything you did not put there. If you are also weighing coding agents themselves, see our comparison of DeepSeek Harness vs Claude Code.