Postman silently auto-installs AI plugins and attempts to share all API data

	Postman silently auto-installs AI plugins and attempts to share all API data(github.com)
	1493 points by sidgarimella 8 days ago \| 487 comments
	tl;dr: Postman's desktop app (12.33.4) silently installed plugins into Codex and Claude Code for existing signed-in users on launch, added a remote MCP connection to mcp.postman.com, and registered a SessionStart hook instructing agents to route virtually all API engineering work through Postman skills. The installer also attempted to self-approve its own hook trust in Codex's config, bypassing the user consent boundary that hook-trust approvals are meant to enforce. Evidence comes from Postman's own logs and the pinned plugin source on GitHub.
	HN Discussion: ↑Postman's trajectory from lightweight tool to bloated VC-funded mess justifies this behavior ↑Users should switch to privacy-focused alternatives like Bruno or Kreya ↑Postman has a prior pattern of silently exfiltrating sensitive data like secrets •Dedicated API testing tools are no longer necessary; simpler scripting approaches suffice •Questions the continued relevance or user base of Postman entirely