[{"data":1,"prerenderedAt":1151},["ShallowReactive",2],{"blog-post-remove-postman-plugin-claude-code-codex":3,"related-posts-remove-postman-plugin-claude-code-codex":1124,"decoder-links-remove-postman-plugin-claude-code-codex":1150},{"id":4,"title":5,"author":6,"body":11,"category":1099,"date":1100,"description":1101,"extension":1102,"featured":1103,"hideToc":1103,"image":1104,"imageAlt":1105,"imageHeight":1106,"imageWidth":1107,"itemList":1108,"lang":1108,"meta":1109,"navigation":204,"noindex":1103,"path":1110,"readingTime":1111,"redirected":1103,"relatedSlugs":1108,"seo":1112,"seoTitle":1113,"stem":1114,"subtitle":1108,"tags":1115,"updatedDate":1100,"__hash__":1123},"blog/blog/remove-postman-plugin-claude-code-codex.md","Postman Plugin in Claude Code and Codex: How to Check and Remove It",{"name":7,"role":8,"avatar":9,"bio":10},"Shabnam Katoch","Growth Head","/img/avatars/shabnam-profile.jpeg","Shabnam leads growth at BetterClaw and has spent the past three years building organic distribution for AI-native products. She writes about no-code agent builders, content strategy, and what it actually takes to grow without an ads budget.",{"type":12,"value":13,"toc":1082},"minimark",[14,18,38,41,136,139,145,148,153,156,321,324,370,376,380,387,390,484,487,490,499,503,510,570,576,593,606,609,612,616,643,666,673,683,694,701,705,745,753,756,763,767,770,782,785,789,795,798,924,935,951,957,964,969,985,989,994,1010,1014,1032,1036,1051,1055,1061,1065,1068,1072,1078],[15,16,17],"p",{},"A Postman desktop update wrote itself into your coding agents without asking. Here is what it added, four read-only checks, and the commands that take each piece out.",[15,19,20,21,25,26,29,30,33,34,37],{},"Postman's desktop app installed the Postman plugin in Claude Code and Codex for existing users without a prompt, says a GitHub report filed on Postman 12.33.4. It enabled ",[22,23,24],"code",{},"postman@claude-plugins-official"," in ",[22,27,28],{},"~/.claude/settings.json",", added a marketplace, plugin and hook approval to ",[22,31,32],{},"~/.codex/config.toml",", bundled a remote MCP and dropped a CLI in ",[22,35,36],{},"~/.local/bin",".",[15,39,40],{},"Here's the quick answer as one table:",[42,43,44,60],"table",{},[45,46,47],"thead",{},[48,49,50,54,57],"tr",{},[51,52,53],"th",{},"Where",[51,55,56],{},"What to look for",[51,58,59],{},"How to remove it",[61,62,63,89,109,123],"tbody",{},[48,64,65,69,80],{},[66,67,68],"td",{},"Codex",[66,70,71,74,75,25,78],{},[22,72,73],{},"postman@postman"," and ",[22,76,77],{},"[marketplaces.postman]",[22,79,32],{},[66,81,82,85,86],{},[22,83,84],{},"codex plugin remove postman@postman",", then ",[22,87,88],{},"codex plugin marketplace remove postman",[48,90,91,94,103],{},[66,92,93],{},"Codex hooks",[66,95,96,99,100],{},[22,97,98],{},"hooks.state"," entry starting ",[22,101,102],{},"postman@postman:",[66,104,105,106],{},"Delete that table, then review with ",[22,107,108],{},"/hooks",[48,110,111,114,118],{},[66,112,113],{},"Claude Code",[66,115,116],{},[22,117,24],{},[66,119,120],{},[22,121,122],{},"claude plugin uninstall postman@claude-plugins-official",[48,124,125,128,133],{},[66,126,127],{},"Your PATH",[66,129,130],{},[22,131,132],{},"~/.local/bin/postman",[66,134,135],{},"Help > Postman CLI and Plugins > Uninstall Postman CLI",[15,137,138],{},"Picture this: you open Postman to test one endpoint. The next morning Codex starts nagging about MCP sign-in, and every API question you ask gets routed through skills you never installed.",[15,140,141],{},[142,143,144],"em",{},"When did I add Postman to my agent?",[15,146,147],{},"You didn't. That's the whole story, and it's why this check is worth five minutes even if you like Postman.",[149,150,152],"h2",{"id":151},"how-to-check-if-the-postman-plugin-is-in-claude-code-or-codex","How to check if the Postman plugin is in Claude Code or Codex",[15,154,155],{},"All four commands only read files. Nothing changes until you run the removal steps further down.",[157,158,163],"pre",{"className":159,"code":160,"language":161,"meta":162,"style":162},"language-bash shiki shiki-themes github-light","# 1. Postman's own log (macOS path, as reported)\ngrep -E \"auto-existing-upgrade|autoInstall\" \"$HOME/Library/Application Support/Postman/logs/main.log\"\n\n# 2. Codex config\ngrep -n -i \"postman\" \"${CODEX_HOME:-$HOME/.codex}/config.toml\"\n\n# 3. Claude Code settings and plugin records\ngrep -n -i \"postman\" ~/.claude/settings.json ~/.claude/plugins/installed_plugins.json ~/.claude/plugins/known_marketplaces.json\n\n# 4. The Postman CLI on your PATH\ncommand -v postman; ls -la ~/.local/bin/postman 2>/dev/null\n","bash","",[22,164,165,174,199,206,212,249,254,260,280,285,291],{"__ignoreMap":162},[166,167,170],"span",{"class":168,"line":169},"line",1,[166,171,173],{"class":172},"sAwPA","# 1. Postman's own log (macOS path, as reported)\n",[166,175,177,181,185,189,192,196],{"class":168,"line":176},2,[166,178,180],{"class":179},"s7eDp","grep",[166,182,184],{"class":183},"sYu0t"," -E",[166,186,188],{"class":187},"sYBdl"," \"auto-existing-upgrade|autoInstall\"",[166,190,191],{"class":187}," \"",[166,193,195],{"class":194},"sgsFI","$HOME",[166,197,198],{"class":187},"/Library/Application Support/Postman/logs/main.log\"\n",[166,200,202],{"class":168,"line":201},3,[166,203,205],{"emptyLinePlaceholder":204},true,"\n",[166,207,209],{"class":168,"line":208},4,[166,210,211],{"class":172},"# 2. Codex config\n",[166,213,215,217,220,223,226,229,232,236,238,241,243,246],{"class":168,"line":214},5,[166,216,180],{"class":179},[166,218,219],{"class":183}," -n",[166,221,222],{"class":183}," -i",[166,224,225],{"class":187}," \"postman\"",[166,227,228],{"class":187}," \"${",[166,230,231],{"class":194},"CODEX_HOME",[166,233,235],{"class":234},"sD7c4",":-",[166,237,195],{"class":194},[166,239,240],{"class":234},"/",[166,242,37],{"class":187},[166,244,245],{"class":194},"codex",[166,247,248],{"class":187},"}/config.toml\"\n",[166,250,252],{"class":168,"line":251},6,[166,253,205],{"emptyLinePlaceholder":204},[166,255,257],{"class":168,"line":256},7,[166,258,259],{"class":172},"# 3. Claude Code settings and plugin records\n",[166,261,263,265,267,269,271,274,277],{"class":168,"line":262},8,[166,264,180],{"class":179},[166,266,219],{"class":183},[166,268,222],{"class":183},[166,270,225],{"class":187},[166,272,273],{"class":187}," ~/.claude/settings.json",[166,275,276],{"class":187}," ~/.claude/plugins/installed_plugins.json",[166,278,279],{"class":187}," ~/.claude/plugins/known_marketplaces.json\n",[166,281,283],{"class":168,"line":282},9,[166,284,205],{"emptyLinePlaceholder":204},[166,286,288],{"class":168,"line":287},10,[166,289,290],{"class":172},"# 4. The Postman CLI on your PATH\n",[166,292,294,297,300,303,306,309,312,315,318],{"class":168,"line":293},11,[166,295,296],{"class":183},"command",[166,298,299],{"class":183}," -v",[166,301,302],{"class":187}," postman",[166,304,305],{"class":194},"; ",[166,307,308],{"class":179},"ls",[166,310,311],{"class":183}," -la",[166,313,314],{"class":187}," ~/.local/bin/postman",[166,316,317],{"class":234}," 2>",[166,319,320],{"class":187},"/dev/null\n",[15,322,323],{},"What each one tells you:",[325,326,327,342,345,356],"ol",{},[328,329,330,331,334,335,74,338,341],"li",{},"The reporter found ",[22,332,333],{},"\"source\":\"auto-existing-upgrade\""," with the results ",[22,336,337],{},"claude-code:installed",[22,339,340],{},"codex:installed",". That string comes from the report, not Postman's docs, so a match is strong evidence and no match on Windows or Linux means look elsewhere.",[328,343,344],{},"Any hit means Codex has Postman's marketplace, plugin or hook approval.",[328,346,347,348,351,352,355],{},"Claude Code records the enabled plugin in ",[22,349,350],{},"settings.json"," and the install in ",[22,353,354],{},"installed_plugins.json",", per Anthropic's plugin docs.",[328,357,358,359,25,362,365,366,369],{},"Postman's docs say the app installs ",[22,360,361],{},"postman",[22,363,364],{},"/usr/local/bin"," when that folder is writable without sudo, otherwise in ",[22,367,368],{},"$HOME/.local/bin",". A CLI you installed on purpose looks the same.",[371,372,373],"blockquote",{},[15,374,375],{},"Grep finds the text. You decide whether you put it there. A plugin you installed deliberately is not a problem; one you can't remember installing is.",[149,377,379],{"id":378},"what-was-added-and-what-each-piece-does","What was added and what each piece does",[15,381,382],{},[383,384],"img",{"alt":385,"src":386},"Diagram of the four places the Postman plugin writes to: Codex config.toml, Claude Code settings.json and installed_plugins.json, the remote MCP server, and the CLI in ~/.local/bin","/img/blog/remove-postman-plugin-claude-code-codex-four-places.jpg",[15,388,389],{},"Postman launched the plugin on 30 September in desktop 12.30.4, and from 12.31.7 on 9 October its release notes say the Postman CLI installs with the app. Neither note says the app would wire itself into your agents.",[42,391,392,404],{},[45,393,394],{},[48,395,396,399,401],{},[51,397,398],{},"Piece",[51,400,53],{},[51,402,403],{},"What it does",[61,405,406,420,438,454,468],{},[48,407,408,411,417],{},[66,409,410],{},"Marketplace",[66,412,413,414,416],{},"Codex: ",[22,415,77],{},", from the postmanlabs/postman-plugin repository",[66,418,419],{},"Lets Codex fetch and refresh the plugin",[48,421,422,425,432],{},[66,423,424],{},"Plugin",[66,426,413,427,429,430],{},[22,428,73],{},". Claude Code: ",[22,431,24],{},[66,433,434,435],{},"Adds Postman's skills, such as ",[22,436,437],{},"postman:api-engineer",[48,439,440,443,448],{},[66,441,442],{},"Session-start hook",[66,444,445,446],{},"Codex hook approval in ",[22,447,98],{},[66,449,450,451,453],{},"Tells the agent to load ",[22,452,437],{}," before most API tasks",[48,455,456,459,465],{},[66,457,458],{},"Remote MCP",[66,460,461,462],{},"Bundled in the plugin: ",[22,463,464],{},"https://mcp.postman.com/mcp",[66,466,467],{},"Postman's hosted MCP server; asks you to sign in",[48,469,470,473,481],{},[66,471,472],{},"CLI",[66,474,475,477,478],{},[22,476,132],{}," or ",[22,479,480],{},"/usr/local/bin/postman",[66,482,483],{},"The tool the plugin routes most tasks to",[15,485,486],{},"The hook is the part that matters most. Codex refuses to run a new hook until you review and trust it, and records that trust against the hook's hash.",[15,488,489],{},"Postman's open-source installer had a function that wrote that trust for its own hook. Its source says installs from version 0.4.1 to 0.7.1 wrote the approval, and a commit on 5 November removed it: \"The user must make that choice.\"",[15,491,492,493,498],{},"Injected instructions are how agent extensions go wrong. When we ",[494,495,497],"a",{"href":496},"/blog/clawhub-skills-security-audit","tested 1,024 ClawHub skills",", prompt injection was one of the reasons we rejected 824.",[149,500,502],{"id":501},"how-to-remove-the-postman-plugin-from-codex","How to remove the Postman plugin from Codex",[15,504,505,506,509],{},"Back up first: ",[22,507,508],{},"cp ~/.codex/config.toml ~/.codex/config.toml.bak",". Then:",[157,511,513],{"className":159,"code":512,"language":161,"meta":162,"style":162},"codex plugin list --json            # confirm postman@postman is there\ncodex plugin remove postman@postman\ncodex plugin marketplace list       # find the \"postman\" marketplace\ncodex plugin marketplace remove postman\n",[22,514,515,531,543,557],{"__ignoreMap":162},[166,516,517,519,522,525,528],{"class":168,"line":169},[166,518,245],{"class":179},[166,520,521],{"class":187}," plugin",[166,523,524],{"class":187}," list",[166,526,527],{"class":183}," --json",[166,529,530],{"class":172},"            # confirm postman@postman is there\n",[166,532,533,535,537,540],{"class":168,"line":176},[166,534,245],{"class":179},[166,536,521],{"class":187},[166,538,539],{"class":187}," remove",[166,541,542],{"class":187}," postman@postman\n",[166,544,545,547,549,552,554],{"class":168,"line":201},[166,546,245],{"class":179},[166,548,521],{"class":187},[166,550,551],{"class":187}," marketplace",[166,553,524],{"class":187},[166,555,556],{"class":172},"       # find the \"postman\" marketplace\n",[166,558,559,561,563,565,567],{"class":168,"line":208},[166,560,245],{"class":179},[166,562,521],{"class":187},[166,564,551],{"class":187},[166,566,539],{"class":187},[166,568,569],{"class":187}," postman\n",[15,571,572,573,575],{},"Now the hook approval. Open ",[22,574,32],{}," and delete this table if it's still there:",[157,577,581],{"className":578,"code":579,"language":580,"meta":162,"style":162},"language-toml shiki shiki-themes github-light","[hooks.state.\"postman@postman:hooks/codex-hooks.json:session_start:0:0\"]\ntrusted_hash = \"...\"\n","toml",[22,582,583,588],{"__ignoreMap":162},[166,584,585],{"class":168,"line":169},[166,586,587],{},"[hooks.state.\"postman@postman:hooks/codex-hooks.json:session_start:0:0\"]\n",[166,589,590],{"class":168,"line":176},[166,591,592],{},"trusted_hash = \"...\"\n",[15,594,595,596,599,600,602,603,605],{},"That key comes from Postman's installer source, which tells users to remove it by hand when its own cleanup fails. If it was the only entry, delete the empty ",[22,597,598],{},"[hooks.state]"," header too. Then start ",[22,601,245],{},", run ",[22,604,108],{},", and check nothing from Postman is trusted.",[15,607,608],{},"Prefer one click? Postman's docs list Help > Postman CLI and Plugins > Uninstall Postman Coding Agent Plugin, for Claude Code, Codex and Cursor. Run the grep checks afterwards anyway.",[15,610,611],{},"Why? The npm remover that also clears the marketplace and hook approval is version 0.8.0 in Postman's repository, but npm's latest tag was still 0.7.1 on 10 November.",[149,613,615],{"id":614},"how-to-remove-the-postman-plugin-from-claude-code","How to remove the Postman plugin from Claude Code",[157,617,619],{"className":159,"code":618,"language":161,"meta":162,"style":162},"claude plugin list\nclaude plugin uninstall postman@claude-plugins-official\n",[22,620,621,631],{"__ignoreMap":162},[166,622,623,626,628],{"class":168,"line":169},[166,624,625],{"class":179},"claude",[166,627,521],{"class":187},[166,629,630],{"class":187}," list\n",[166,632,633,635,637,640],{"class":168,"line":176},[166,634,625],{"class":179},[166,636,521],{"class":187},[166,638,639],{"class":187}," uninstall",[166,641,642],{"class":187}," postman@claude-plugins-official\n",[15,644,645,646,649,650,653,654,657,658,661,662,665],{},"Inside a session, ",[22,647,648],{},"/plugin"," and the Installed tab do the same. Then run ",[22,651,652],{},"/reload-plugins"," or restart, and open ",[22,655,656],{},"/mcp",": Claude Code names plugin servers ",[22,659,660],{},"plugin:\u003Cplugin>:\u003Cserver>",", so ",[22,663,664],{},"plugin:postman:postman"," should be gone.",[15,667,668,669,672],{},"One warning. Don't remove the ",[22,670,671],{},"claude-plugins-official"," marketplace to get rid of Postman. Anthropic's docs say removing a marketplace uninstalls every plugin you installed from it.",[15,674,675,676,678,679,682],{},"Don't hand-edit ",[22,677,354],{}," either. The uninstall updates it; grep confirms it. Cached files stay 14 days, or delete ",[22,680,681],{},"~/.claude/plugins/cache/claude-plugins-official/postman/"," yourself.",[15,684,685,686,689,690,693],{},"Copy at project scope? ",[22,687,688],{},"claude plugin list"," shows it. Add ",[22,691,692],{},"--scope project"," to the uninstall, from inside that repo.",[15,695,696,697,700],{},"Last, the CLI. If you never meant to install it, use Help > Postman CLI and Plugins > Uninstall Postman CLI, which also removes the ",[22,698,699],{},"PATH"," line it added.",[149,702,704],{"id":703},"stop-it-coming-back","Stop it coming back",[325,706,707,714,720,726,739],{},[328,708,709,713],{},[710,711,712],"strong",{},"Update Postman."," Its docs, checked on 10 November, say: \"The Postman desktop app doesn't install the plugin automatically.\" The newest desktop build is 12.36.0 from 9 November, though Postman hasn't said which build reverted the change.",[328,715,716,719],{},[710,717,718],{},"Skip the Help menu installer"," unless you want the plugin.",[328,721,722,725],{},[710,723,724],{},"In Codex, never trust a hook you didn't add."," The \"Hooks need review\" prompt is the guard that self-approval skipped.",[328,727,728,731,732,25,735,738],{},[710,729,730],{},"On a team, block it centrally."," Claude Code's managed settings can set a plugin to ",[22,733,734],{},"false",[22,736,737],{},"enabledPlugins",", which blocks installation at every scope.",[328,740,741,744],{},[710,742,743],{},"Re-run the four checks"," after the next few Postman updates.",[15,746,747,748,752],{},"If you also run OpenClaw, our ",[494,749,751],{"href":750},"/blog/openclaw-security-checklist","OpenClaw security checklist"," covers the same habits for a self-hosted gateway.",[15,754,755],{},"The bigger question is who decides what your agent loads. BetterClaw gives you managed agents with permissions you control, 500+ connectors, and your own model keys across 28+ providers at zero markup.",[15,757,758,759],{},"We're ISO 27001 certified, with a SOC 2 Type II audit in progress. Plans start from $19 a month, and your first workspace starts with a 7-day free trial. ",[494,760,762],{"href":761},"/pricing","See BetterClaw plans",[149,764,766],{"id":765},"what-postman-has-said","What Postman has said",[15,768,769],{},"Here's what we could check ourselves:",[771,772,773,776,779],"ul",{},[328,774,775],{},"Postman's install docs now say the app installs the plugin only when you pick it from the Help menu, and that \"If the app installed the plugin for you automatically before, you can remove the plugin.\" The CLI page has matching wording.",[328,777,778],{},"The plugin repository dropped the Codex hook and its auto-approval on 5 and 6 November.",[328,780,781],{},"The report, issue #14370 in Postman's postman-app-support repository on GitHub, opened on 25 October. We found no matching item in the release notes for desktop 12.33 to 12.35.",[15,783,784],{},"Two statements are reported but we couldn't read them at the source. On 3 November, Postman's head of product told the press it would make the opt-in clearer for existing users. On 5 November, a Postman staff member reportedly replied on the issue that it is reverting the change and redesigning it with more user control.",[149,786,788],{"id":787},"a-general-check-for-unexpected-plugins-and-mcps","A general check for unexpected plugins and MCPs",[15,790,791],{},[383,792],{"alt":793,"src":794},"Checklist card for auditing coding agents: plugins, marketplaces, MCP servers, hooks, instruction files and CLIs, with the command to run for each","/img/blog/remove-postman-plugin-claude-code-codex-checklist.jpg",[15,796,797],{},"Postman won't be the last desktop app to write into an agent's config. Run this once a month:",[157,799,801],{"className":159,"code":800,"language":161,"meta":162,"style":162},"claude plugin list && claude plugin marketplace list && claude mcp list\ncodex plugin list && codex plugin marketplace list && codex mcp list\ngrep -n \"^\\[\" \"${CODEX_HOME:-$HOME/.codex}/config.toml\"      # every table Codex reads\ngrep -n \"\u003C!--\" ~/.claude/CLAUDE.md ~/.codex/AGENTS.md ~/.codex/AGENTS.override.md 2>/dev/null\nls -lt ~/.local/bin | head\n",[22,802,803,831,857,886,908],{"__ignoreMap":162},[166,804,805,807,809,811,814,816,818,820,822,824,826,829],{"class":168,"line":169},[166,806,625],{"class":179},[166,808,521],{"class":187},[166,810,524],{"class":187},[166,812,813],{"class":194}," && ",[166,815,625],{"class":179},[166,817,521],{"class":187},[166,819,551],{"class":187},[166,821,524],{"class":187},[166,823,813],{"class":194},[166,825,625],{"class":179},[166,827,828],{"class":187}," mcp",[166,830,630],{"class":187},[166,832,833,835,837,839,841,843,845,847,849,851,853,855],{"class":168,"line":176},[166,834,245],{"class":179},[166,836,521],{"class":187},[166,838,524],{"class":187},[166,840,813],{"class":194},[166,842,245],{"class":179},[166,844,521],{"class":187},[166,846,551],{"class":187},[166,848,524],{"class":187},[166,850,813],{"class":194},[166,852,245],{"class":179},[166,854,828],{"class":187},[166,856,630],{"class":187},[166,858,859,861,863,866,868,870,872,874,876,878,880,883],{"class":168,"line":201},[166,860,180],{"class":179},[166,862,219],{"class":183},[166,864,865],{"class":187}," \"^\\[\"",[166,867,228],{"class":187},[166,869,231],{"class":194},[166,871,235],{"class":234},[166,873,195],{"class":194},[166,875,240],{"class":234},[166,877,37],{"class":187},[166,879,245],{"class":194},[166,881,882],{"class":187},"}/config.toml\"",[166,884,885],{"class":172},"      # every table Codex reads\n",[166,887,888,890,892,895,898,901,904,906],{"class":168,"line":208},[166,889,180],{"class":179},[166,891,219],{"class":183},[166,893,894],{"class":187}," \"\u003C!--\"",[166,896,897],{"class":187}," ~/.claude/CLAUDE.md",[166,899,900],{"class":187}," ~/.codex/AGENTS.md",[166,902,903],{"class":187}," ~/.codex/AGENTS.override.md",[166,905,317],{"class":234},[166,907,320],{"class":187},[166,909,910,912,915,918,921],{"class":168,"line":214},[166,911,308],{"class":179},[166,913,914],{"class":183}," -lt",[166,916,917],{"class":187}," ~/.local/bin",[166,919,920],{"class":234}," |",[166,922,923],{"class":179}," head\n",[15,925,926,927,930,931,934],{},"The ",[22,928,929],{},"\u003C!--"," search finds marked blocks that tools add to your global instruction files. Postman's CLI install script, for example, adds a note between ",[22,932,933],{},"postman-cli:installation"," markers.",[15,936,937,938,941,942,945,946,950],{},"Cursor users: Postman's docs say the app puts its copy in the ",[22,939,940],{},"plugins/local/postman"," folder inside ",[22,943,944],{},"~/.cursor",". Across several agents, keep one rules file instead of five; our guide to ",[494,947,949],{"href":948},"/blog/claude-md-vs-agents-md","which agent reads CLAUDE.md or AGENTS.md"," shows the layout.",[15,952,953],{},[383,954],{"alt":955,"src":956},"Timeline of the Postman plugin incident from launch on 30 September to the updated docs on 10 November","/img/blog/remove-postman-plugin-claude-code-codex-timeline.jpg",[15,958,959,960,963],{},"While you're in there, look for flags like Claude Code's ",[22,961,962],{},"--dangerously-skip-permissions"," in your aliases and scripts. Injected instructions plus no approval step is the worst mix.",[371,965,966],{},[15,967,968],{},"The fix shipped in Postman's docs and code. It didn't ship to your laptop. That part is still yours.",[970,971,973,978],"callout",{"type":972},"cta",[15,974,975],{},[710,976,977],{},"Want a second pair of eyes on your agent setup?",[15,979,980,981],{},"If your team runs several coding agents and no one owns their config, an outside look helps. Our AI automation audit is a 30-minute discovery call, followed by a written report within 5 business days covering your workflows, agent setup and where automation pays off. ",[494,982,984],{"href":983},"/ai-automation-audit","Book an AI automation audit",[149,986,988],{"id":987},"frequently-asked-questions","Frequently Asked Questions",[990,991,993],"h3",{"id":992},"did-postman-install-a-plugin-in-claude-code","Did Postman install a plugin in Claude Code?",[15,995,996,997,999,1000,1002,1003,1006,1007,1009],{},"Yes, according to issue #14370 on GitHub. The reporter found ",[22,998,24],{}," enabled in ",[22,1001,28],{}," and a record in ",[22,1004,1005],{},"~/.claude/plugins/installed_plugins.json"," after opening Postman 12.33.4 on macOS. Run ",[22,1008,688],{}," to see whether it happened to you.",[990,1011,1013],{"id":1012},"how-do-i-remove-the-postman-plugin-from-codex","How do I remove the Postman plugin from Codex?",[15,1015,1016,1017,85,1019,1021,1022,1025,1026,1028,1029,1031],{},"Run ",[22,1018,84],{},[22,1020,88],{},". Then delete the ",[22,1023,1024],{},"[hooks.state.\"postman@postman:hooks/codex-hooks.json:session_start:0:0\"]"," table from ",[22,1027,32],{}," if it's there, and check ",[22,1030,108],{}," in Codex. Back up the file first.",[990,1033,1035],{"id":1034},"how-do-i-see-which-plugins-claude-code-has-installed","How do I see which plugins Claude Code has installed?",[15,1037,1016,1038,1040,1041,1043,1044,1047,1048,1050],{},[22,1039,688],{}," in your shell, or ",[22,1042,648],{}," inside a session and open the Installed tab. ",[22,1045,1046],{},"claude plugin list --json"," adds the scope, version and install path of each plugin. Use ",[22,1049,656],{}," to see MCP servers, including those a plugin brings.",[990,1052,1054],{"id":1053},"is-the-postman-mcp-safe","Is the Postman MCP safe?",[15,1056,1057,1058,1060],{},"It's Postman's official hosted server at ",[22,1059,464],{},", and it needs you to sign in before it can touch your Postman workspaces. The problem in this case was consent, not the server itself. If you want it, install the plugin deliberately and review what it can reach.",[990,1062,1064],{"id":1063},"which-postman-versions-were-affected","Which Postman versions were affected?",[15,1066,1067],{},"The one detailed report is on desktop 12.33.4 for macOS. Postman's release notes for 12.33 to 12.35 don't mention the change, and Postman hasn't named the affected builds or the one that reverted it, so run the four checks whatever version you're on.",[990,1069,1071],{"id":1070},"should-i-remove-the-postman-cli-too","Should I remove the Postman CLI too?",[15,1073,1074,1075,1077],{},"Only if you didn't install it on purpose. Postman's docs say the app can remove it under Help > Postman CLI and Plugins > Uninstall Postman CLI, including the ",[22,1076,699],{}," line it added. The app's built-in terminal keeps its own copy either way.",[1079,1080,1081],"style",{},"html pre.shiki code .sAwPA, html code.shiki .sAwPA{--shiki-default:#6A737D}html pre.shiki code .s7eDp, html code.shiki .s7eDp{--shiki-default:#6F42C1}html pre.shiki code .sYu0t, html code.shiki .sYu0t{--shiki-default:#005CC5}html pre.shiki code .sYBdl, html code.shiki .sYBdl{--shiki-default:#032F62}html pre.shiki code .sgsFI, html code.shiki .sgsFI{--shiki-default:#24292E}html pre.shiki code .sD7c4, html code.shiki .sD7c4{--shiki-default:#D73A49}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":162,"searchDepth":176,"depth":176,"links":1083},[1084,1085,1086,1087,1088,1089,1090,1091],{"id":151,"depth":176,"text":152},{"id":378,"depth":176,"text":379},{"id":501,"depth":176,"text":502},{"id":614,"depth":176,"text":615},{"id":703,"depth":176,"text":704},{"id":765,"depth":176,"text":766},{"id":787,"depth":176,"text":788},{"id":987,"depth":176,"text":988,"children":1092},[1093,1094,1095,1096,1097,1098],{"id":992,"depth":201,"text":993},{"id":1012,"depth":201,"text":1013},{"id":1034,"depth":201,"text":1035},{"id":1053,"depth":201,"text":1054},{"id":1063,"depth":201,"text":1064},{"id":1070,"depth":201,"text":1071},"Security","2026-11-13","Postman desktop put the Postman plugin in Claude Code and Codex without a prompt. Check with grep, then remove the plugin, marketplace, hook and CLI.","md",false,"/img/blog/remove-postman-plugin-claude-code-codex.jpg","Postman plugin in Claude Code and Codex cover: a terminal card with read-only grep checks and a config card showing the Postman entries to remove",512,1024,null,{},"/blog/remove-postman-plugin-claude-code-codex","7 min read",{"title":5,"description":1101},"Postman Plugin in Claude Code and Codex: How to Remove It","blog/remove-postman-plugin-claude-code-codex",[1116,1117,1118,1119,1120,1121,1122],"postman plugin claude code","postman claude code plugin","remove postman plugin codex","postman codex config.toml","postman mcp","claude plugin uninstall","codex plugin remove","nRUo5XnQVIDMj8jYq-4wDPpEUI3vjSXDBC8us0YPCOA",[1125,1133,1141],{"stem":1126,"title":1127,"description":1128,"date":1129,"image":1130,"category":1099,"redirected":1103,"author":1131,"readingTime":1132},"blog/coding-agent-extension-security-check","Is Your Coding Agent Extension Safe? How to Check Claude Code, Cursor and VS Code","Claude Code extension malware hit Cursor's marketplace. What it did, how to check your versions in 10 minutes and the settings that lock it down.","2026-11-09","/img/blog/coding-agent-extension-security-check.jpg",{"name":7,"role":8,"avatar":9,"bio":10},"8 min read",{"stem":1134,"title":1135,"description":1136,"date":1137,"image":1138,"category":1099,"redirected":1103,"author":1139,"readingTime":1140},"blog/is-meta-muse-safe-privacy","Is Meta Muse Safe? What the AI Agent Can See, Store and Share","Is Meta Muse safe to use? What the AI agent can see, what Meta says it stores, what critics claim, and the settings that limit what it can access.","2026-11-06","/img/blog/is-meta-muse-safe-privacy.jpg",{"name":7,"role":8,"avatar":9,"bio":10},"9 min read",{"stem":1142,"title":1143,"description":1144,"date":1145,"image":1146,"category":1147,"redirected":1103,"author":1148,"readingTime":1149},"blog/rogue-ai-agents-incidents-permissions","Rogue AI Agents: 8 Real Incidents, One Cause, and the Permission Rules That Stop It","Rogue AI agents deleted a database and breached real companies and a government portal. 8 real incidents, one cause, and a permission checklist to copy.","2026-11-05","/img/blog/rogue-ai-agents-incidents-permissions.jpg","Guides",{"name":7,"role":8,"avatar":9,"bio":10},"12 min read",[],1794569898264]