--- title: "Postman Alternative? First Check What It Put in Claude Code" url: https://syntaxradar.com/radar/postman-alternative-claude-code-plugin author: "Abdul Rehman, Lead Systems Architect and Technical Director" publishedAt: 2026-11-05T00:00:00.000Z dateModified: 2026-11-05T00:00:00.000Z category: "#DEV-SYSTEMS" topic: "postman alternative" primarySource: https://github.com/postmanlabs/postman-app-support/issues/14370 summary: "Postman alternative guide: what Postman Desktop reportedly added to Claude Code and Codex, how to remove it, and how Bruno, Insomnia and others compare." --- # Postman Alternative? First Check What It Put in Claude Code **Short answer:** A GitHub issue from Oct 25 reports Postman plugins appearing in Claude Code and Codex after opening Postman Desktop 12.33.4 on one Mac, and an installer that tries to trust its own hook. No source shows data was sent. A reply in Postman's voice promises a clearer opt-in. **Takeaway:** The documented issue is agent plugins the reporter says they never authorized and an installer that attempts to trust its own startup hook, not proven data theft, so check and clean your Claude Code and Codex configs before you switch API clients. **Key figures (as reported by the source):** - Postman Desktop version in the report: 12.33.4 (macOS) - Postman plugin version recorded in Claude Code: 2.0.1 - Comments on issue #14370 as of Nov 4: 38 If you are looking for a Postman alternative this week, check your own machine before you pick one. According to a [GitHub issue opened on October 25](https://github.com/postmanlabs/postman-app-support/issues/14370), opening Postman Desktop 12.33.4 on a Mac was followed by Postman plugins showing up inside two AI coding agents, Claude Code and Codex. The reporter says they never explicitly authorized it. That is one person's evidence from one macOS machine, and it has not been independently reproduced. No source shows that any data left the computer. Still, the changes it lists are specific, they sit inside your coding agents, and Postman's own documentation confirms part of the mechanism. So the useful order is: find out what is installed, remove what you did not ask for, then compare the other API clients on facts rather than on headlines. ### What did Postman install on my computer? What Postman installed, according to issue #14370, is a set of agent plugins plus a command-line tool. The reporter quotes Postman's own log, which records an install with the source "auto-existing-upgrade" and the entries "claude-code:installed" and "codex:installed", dated October 24. The issue then lists what changed on disk: - **Codex:** `~/.codex/config.toml` gained a Postman marketplace (postmanlabs/postman-plugin), enabled `postman@postman`, and added `hooks.state` entries with `trusted_hash` values. - **Claude Code:** `~/.claude/settings.json` enabled `postman@claude-plugins-official`, and `~/.claude/plugins/installed_plugins.json` recorded version 2.0.1. - **Your shell:** a Postman CLI executable appeared in `~/.local/bin`. The reporter titled the issue with a [SEVERE] prefix. As of November 4 it was still open with 38 comments. One commenter, ronthedrummer, reported that updating from Postman 12.31.3 to 12.35.1 triggered the same installs, a detail the [DEV Community write-up](https://dev.to/gabrielanhaia/postman-desktop-added-itself-to-claude-code-and-codex-its-installer-trusts-its-own-hook-2oga) by Gabriel Anhaia also cites. That author notes the sequence has not been reproduced on a clean Mac. ### What is a Claude Code hook? Claude Code hooks are commands the agent runs automatically when a set event happens. The one at the centre of this story is a SessionStart hook, which, per [Claude Code's hooks documentation](https://code.claude.com/docs/en/hooks), runs when a session starts or resumes. If the command prints plain text and exits cleanly, that text is added as context Claude can see and act on. Think of it as a note taped to the agent's monitor that it reads every time it sits down. A plugin is the package that delivers the note: the docs say installing one adds its skills, agents, hooks and MCP servers (MCP servers are connections that let an agent call an outside service's tools). Postman's plugin ships a SessionStart hook with the matcher "startup|clear|compact", so it fires on a fresh session, after a clear and after a compact. It prints a file called session-start-context.md. According to [Postman's plugin repo](https://github.com/postmanlabs/postman-plugin/blob/6c8e452e0f4237f4bcc0901cb1ac442dec707e49/hooks/session-start-context.md), that file tells the agent to load the "postman:api-engineer" skill before any non-trivial API engineering task. The same file says your own instructions in AGENTS.md or CLAUDE.md, and your direct requests, take precedence. The part that drew criticism is trust. Codex hooks need your approval. Postman's docs say that when the plugin is installed through the Codex app or command line, the hook installs untrusted and Codex shows "Hooks need review" at the next start, where you approve it. But Postman's [detected-agents install page](https://learning.postman.com/docs/postman-plugin/install/detected-agents) says its own installer approves the hook for you, and tells you to review it in Codex only if it cannot. [The New Stack](https://thenewstack.io/postman-plugin-coding-agents/) reported the same contrast: the installer can approve the hook on the user's behalf, while people installing the plugin directly through Codex must approve it themselves. Security researcher Frank Denis called the integrations "junk" on X and pointed out that the installer attempts to trust its own startup hook, the outlet adds. Postman's docs also say its skills and MCP server work with or without the hook, which only makes Codex reach for the skills more reliably. ![Diagram of the reported Postman Desktop 12.33.4 plugin flow: opens on one Mac, plugins appear in Claude Code and Codex, installer attempts to trust its own hook, hook points the agent to a Postman skill](/uploads/blog/postman-alternative-claude-code-plugin/img1.webp) ### Is Postman safe? On what has been published so far, the documented problem is consent and control over your coding agents, not proven data theft. The reporter states the issue does not claim to establish data exfiltration. The New Stack says the GitHub report provides no evidence that Postman collected or transmitted API data, and that it documents changes to agent settings and a remote MCP connection. The Codex plugin config points to Postman's remote MCP server at mcp.postman.com/mcp. Per the issue, Codex logged a failed startup with "Auth required", and The New Stack says Codex repeatedly failed to authenticate. You may also have seen a claim from Siddharth Garimella on X that the hooks intercept API data and send it to the company. The New Stack notes that the GitHub report provides no evidence for that. Treat it as unproven. Postman's side came in a reply on the thread dated November 3, from the GitHub account zecoquit, written in Postman's voice ("we") although the account shows no organisation affiliation. The reply says Postman bundles the CLI and agent plugins with the desktop app because many users had trouble installing and wiring them up separately, that this is mentioned on the download page and in the app update flow, and that the components can be uninstalled from inside the app. It adds: "we're going to make the opt-in clearer, especially for existing users", and says Postman is reviewing the hook approval and session-start behavior, with updates to follow in the thread. That is a promise, not a confirmed change: as of November 4 the issue remained open. The New Stack also said it asked Postman about the automatic installs, hook approvals and consent, and had no response by publication on November 3. ### How to remove Postman plugin from Claude Code To remove the Postman plugin from Claude Code, start with the commands in [Claude Code's plugin docs](https://code.claude.com/docs/en/discover-plugins). List what is installed, then disable or uninstall the Postman entry by name and marketplace: ```bash claude plugin list claude plugin disable postman@claude-plugins-official claude plugin uninstall postman@claude-plugins-official ``` You can do the same from the `/plugin` menu's Installed tab inside a session. User-scope plugins are recorded under `enabledPlugins` in `~/.claude/settings.json`, so that file is where to confirm the entry is gone. Postman documents its own removal command, which uninstalls the plugin from each agent it detects. Its flags let you check first: `status` shows what is installed, `--dry-run` previews, `--agent ` limits it to one agent, and `-y` skips the prompt. ```bash npx @postman/postman-plugin status npx @postman/postman-plugin remove --dry-run npx @postman/postman-plugin remove ``` Postman's reply on the thread also says the components can be uninstalled from inside the desktop app. #### Checking Codex and the rest The DEV author suggests these checks. They are that author's suggestions, so read each one before you run it: ```bash grep -n -i postman ~/.codex/config.toml claude plugin list grep -n -i postman ~/.claude/settings.json ls -l ~/.local/bin | grep -i postman ``` For Codex, the same post suggests running `/hooks` in a session and disabling the Postman SessionStart hook. Two caveats. The DEV post says Postman's docs do not state whether the remove command clears the Codex trust record, and its author had not run it. And the reporter argues an uninstall command is not enough: they want removal to also clear agent settings, trusted hooks, MCP connections and CLI tools. Nobody has confirmed the trust record is cleared, so re-run the grep on `config.toml` afterwards. We covered a related cleanup routine in our guide to how to [check and clean up after the Claude Code extension VSCode backdoor](/radar/claude-code-extension-vscode-backdoor). ![Postman alternative comparison by license: Bruno MIT, Insomnia Apache-2.0, Hoppscotch MIT and HTTPie CLI BSD-3-Clause](/uploads/blog/postman-alternative-claude-code-plugin/img2.webp) ### Postman alternatives compared: Bruno, Insomnia, Hoppscotch and HTTPie If you still want a Postman replacement, here are four alternatives to Postman with only what their official sites, pricing pages and GitHub repos say. For reference, Postman's pricing page lists Free at $0 a month for 1 user, Solo at $9 a month and Team at $19 per user a month (both billed annually), and Enterprise through sales.
ToolLicense (official repo)Free optionPaid plansHow it stores work, per the vendor
BrunoMITOpen Source plan, $0: 2 workspaces, public git providersPro $6, Ultimate $11 per user/month, billed annuallyCollections as plain-text files in your repo
InsomniaApache-2.0Essentials, $0: unlimited Cloud and Local projects, Git Sync for up to 3 users, 1,000 mock requests/monthPro $12 per user/month billed annually; Enterprise $45 per user/monthCloud, Local and Git storage
HoppscotchMITNot verifiedNot verifiedOffline, on-prem and cloud; web, desktop and CLI
HTTPieBSD-3-Clause (CLI)Not verifiedNot verifiedTerminal, desktop and web apps
Prices were last checked on November 4, 2026. Confirm current pricing on each vendor's page before you commit a team. **Bruno** calls itself a "Git-native API client" and is a natural open source alternative to Postman if you want collections to live next to your code. Its site says there is no cloud sync, no account and no login, and claims 4M users. Both are vendor claims. Its GitHub repo lists an MIT license, and its pricing page shows a $0 Open Source plan. **Insomnia** keeps a free Essentials plan that includes the Inso CLI. Its Scratch Pad mode is local-only with no login, per the pricing page. **Hoppscotch** describes itself as an "open source API development ecosystem", and its repo pitches it as an open-source alternative to Postman and Insomnia. Its pricing page did not render for us, so we list no prices. **HTTPie** suits people who live in the terminal: the official site describes its CLI as an open-source API testing client. The CLI repo is BSD-3-Clause and was last pushed in December 2024. The separate desktop repo shows no detected license, and we could not verify pricing. One honest limit: none of our sources says whether any of these Postman competitors bundle agent plugins. Whatever you install, check `~/.claude` and `~/.codex` afterwards using the commands above. ### What to watch next Postman says updates will come in the issue thread, so that is the place to follow. Four things matter: - **The opt-in.** Whether Postman ships the clearer opt-in for existing users that the November 3 reply promised. - **Hook approval.** Whether the installer stops approving its own Codex hook after the promised review. - **Clean removal.** Whether anyone confirms that `npx @postman/postman-plugin remove` clears the Codex trust record, settings, MCP connection and CLI. - **Reproduction.** Whether someone reproduces the install on a clean Mac, or reports it on another platform. So far the evidence is one macOS machine plus one commenter's version update. Until then, the practical move is the same whether or not you choose a Postman alternative: know what your coding agents load at startup, and remove anything you did not put there. If you are also weighing coding agents themselves, see our comparison of [DeepSeek Harness vs Claude Code](/radar/deepseek-harness-vs-claude-code). ## Frequently asked questions ### Did Postman send my API data anywhere? No source shows that. The reporter says the issue does not claim to establish data exfiltration, and The New Stack says the GitHub report provides no evidence that Postman collected or transmitted API data. What is documented is changed agent settings, a Codex hook the installer attempts to trust and a configured connection to Postman's remote MCP server, which Codex failed to authenticate to. ### Does this affect Windows or Linux users? The sources do not say. The issue documents one macOS machine running Postman Desktop 12.33.4, and one commenter reported the same installs after updating from 12.31.3 to 12.35.1. The DEV Community author notes the sequence has not been reproduced on a clean Mac. If you use Claude Code or Codex on any platform, the check commands are still worth running. ### What is a Claude Code hook? A Claude Code hook is a command the agent runs automatically when a set event happens. Postman's plugin ships a SessionStart hook that fires on startup, clear and compact and prints a file telling the agent to load the postman:api-engineer skill before non-trivial API work. Claude Code adds the printed text as context. ### Does npx @postman/postman-plugin remove clear the Codex hook approval? Nobody has confirmed it. The DEV Community post says Postman's docs do not state whether the remove command clears the Codex trust record, and its author had not run it. The reporter wants removal to also clear agent settings, trusted hooks, MCP connections and CLI tools. After running it, search ~/.codex/config.toml for postman and check /hooks inside a Codex session. ### Is there a free open source Postman alternative? Yes, several. Bruno is MIT licensed with a $0 Open Source plan, Insomnia is Apache-2.0 with a free Essentials plan, Hoppscotch is MIT licensed, and the HTTPie CLI is BSD-3-Clause. We could not verify Hoppscotch or HTTPie pricing. Prices were last checked on November 4, 2026, so confirm current plans on each vendor's own pricing page. ### How do I remove the Postman plugin from Claude Code and Codex? Run claude plugin list, then claude plugin disable or uninstall postman@claude-plugins-official, and confirm ~/.claude/settings.json. Postman also documents npx @postman/postman-plugin remove, with status and --dry-run to preview first. Nobody has confirmed it clears the Codex trust record, so search ~/.codex/config.toml for postman afterwards. ## Source Based on GitHub issue #14370, Postman's docs and The New Stack. https://github.com/postmanlabs/postman-app-support/issues/14370 --- Published on SyntaxRadar (https://syntaxradar.com). Canonical URL: https://syntaxradar.com/radar/postman-alternative-claude-code-plugin. Last modified 2026-11-05T00:00:00.000Z.