VQV Signal

BIG MOVE WATCH TECHNICAL

Postman desktop app reportedly auto-installed plugins and a hook into Codex and Claude Code

According to a post on X by @realchrisebert, logs in GitHub issue #14370 show an existing Postman desktop install automatically adding plugins to Codex and Claude Code. The bundle reportedly also includes a CLI, an MCP connection, and a session-start hook that tells agents to load Postman's skill, with installer code that tries to approve the hook itself. A Postman staff reply in the issue says the bundling was meant to ease setup and that the company will make opt-in clearer and review the hook.

Source: Scobleizer News Pulse (X) · x.com Found via Robert Scoble’s Scobleizer News Pulse · a post on X, not independently verified Published 2026-11-04T02:20:00+00:00 Detected 2026-11-04T10:22:31+00:00
View original source

According to a post on X by @realchrisebert, logs in GitHub issue #14370 show an existing Postman desktop install automatically adding plugins to Codex and Claude Code. The bundle reportedly also includes a CLI, an MCP connection, and a session-start hook that tells agents to load Postman's skill, with installer code that tries to approve the hook itself. A Postman staff reply in the issue says the bundling was meant to ease setup and that the company will make opt-in clearer and review the hook.

AI-assisted summary based on the listed source.

GitHub issue #14370 shows logs of an existing Postman desktop install auto-installing plugins into Codex and Claude Code, plus a CLI, an MCP connection and a session-start hook telling agents to load Postman's skill, with installer code that tries to approve the hook itself. A Postman staff reply says the bundling...

Developers who use Codex or Claude Code alongside Postman may find plugins, a CLI, and an MCP connection set up in their agent environments without a clear opt-in. Teams should watch whether Postman changes its opt-in flow and what its review of the hook leads to. The case also shows how bundled agent hooks can affect agent behavior by default.

Signal Strength 92% Technical label WATCH Public Interest 53 Category BIG MOVE Reader Depth TECHNICAL

Signal Strength reflects source quality, relevance, freshness and evidence. Public Interest helps organize discovery; it is not proof of truth.

Public Interest components
Recognizable Entity Score 82 Practical Impact Score 28 Novelty Interest Score 70 Consequence Score 30 Curiosity Score 16 Shareability Score 64

VQV surfaced this signal because it is recent, relevant to AI Coding Tools, connected to Scobleizer News Pulse (X).