Postman quietly installs AI plugins into Codex and Claude Code, then approves its own startup hook
Postman silently auto-installs AI plugins and attempts to share all API data
Opening Postman 12.33.4 on macOS triggered an "auto-existing-upgrade" that installed a Codex plugin, a Claude Code plugin, a remote MCP connection, and a Postman CLI without asking. A startup hook then tells the coding agent to route any non-trivial API task through Postman skills, and the installer tries to mark its own hook as trusted. The reporter calls it a severe consent and trust-boundary failure.
An API client should not make itself the default workflow in other tools simply because I opened it.
- pants2
It's a shame what happened to Postman. It started as an excellent little developer tool for testing APIs. Then for some reason they raised over $400M in funding and hired 1,500+ employees, for what should have been a tiny OSS/passion project like curl or little snitch. Instead they now have to justify their valuation by forcing logins, collecting data, monthly subscriptions, AI features, etc.
I still don't know how they're valued at $5B+ when I don't know a single developer who actually uses it anymore
- primitivesuave
Postman logs detailed information on every single API request you make through its tool, including query parameters. If you use the templating syntax `{{some_secret}}` to fill in a query parameter, it sends the actual secret content of `some_secret` to Postman's servers. If you disable outgoing network traffic to this logging endpoint, the entire app will stop working properly.
I discovered this when investigating whether Postman is HIPAA-compliant (it is not).
- senfiaj
Who still uses Postman? In my experience it became insanely slow and bloated. Switched to Bruno. IMO, Postman is like uTorrent, everybody heard about it and many install because of inertia.
- bottombutton
Working in healthcare, and Postman got decertified by our Cyber team for this. We all switched to Bruno overnight. Their sales team is pinging us like gangbusters though.
- dham
We went to bruno years ago and has been good. Nice to be able to store the request definitions in git. But to be honest, don't really need any of these tools anymore.
- CommonGuy
I have been building Kreya [1] for over 6 years now as a Postman alternative. It's offline-first and privacy focused with a storage format made for git.
In all our years, Kreya "just worked" for our users without any drama or unwanted changes, unlike most of our competitors...
- georgel
Postman went from a great lightweight tool to a bloated up-selling mess.
- dvtkrlbs
I've been using Yaak [1] for a while. It is a breath of fresh air.
- unkn0wn_root
If anyone is interested in a Postman alternative but likes TUIs and leans more toward using .http files, check out resterm[0].
btw - I'm the author.
- ediamondscience
I don't understand how postman became the tool that it is today. The best version of it was just a logger and a formatter on top of an http client. The proto import was nice for gRPC. Who thought that relatively simple tool needed accounts and MCPs and whatever else they've thrown into it?