Remove the Postman Plugins and Hooks From Codex and Claude Code: Audit the Config Files It Touched

You open an API client to check a request. Days later, your coding agent starts routing plain API work through that same client, and a remote server you never agreed to keeps asking for a sign in. That is the sequence in GitHub issue 14370 on the Postman support repo, filed on October 25, 2026. The reporter opened Postman desktop 12.33.4 on a Mac, and Postman’s own log recorded an automatic install into two other tools. No prompt in either tool. The plugins just arrived.

This tutorial removes them properly. A normal uninstall is not the whole job here, because the install touched trust records and marketplaces as well as plugin files. You will audit first, remove second, and audit again at the end.

What You Will Build or Learn

You will learn how to find and remove an unwanted plugin across two coding agents. By the end, Codex will have no Postman marketplace, no enabled Postman plugin, and no trust record for the Postman SessionStart hook. Claude Code will have no enabled Postman plugin at user scope. You will also know how to tell an active config entry from a harmless cache file, which is the skill that matters the next time any tool installs itself somewhere it was not invited.

What the evidence does and does not show matters, so here it is plainly. The issue documents unwanted installs, config edits, a broad startup instruction, and an installer that approves its own hook. It does not document data leaving the machine. The remote MCP connection in the report failed with an auth error, and the reporter states in the issue that the report does not claim data theft. Treat this as a consent and trust problem, because that is what the record supports.

Before You Begin

Know the four places this install touched, based on the issue. In Codex, ~/.codex/config.toml gained a Postman marketplace table, an enabled plugin table, and a hook trust record under hooks.state. In Claude Code, ~/.claude/settings.json enabled postman@claude-plugins-official, and ~/.claude/plugins/installed_plugins.json recorded the install at version 2.0.1 and user scope. A Postman CLI binary also landed in ~/.local/bin.

The hook is the part worth understanding before you delete anything. Codex hooks are scripts that run at set points in a session. OpenAI’s hooks documentation says a hook that no manager controls must be reviewed and trusted before it can run, and trust is recorded against the hash of the exact hook definition. Postman’s plugin ships a SessionStart hook that fires on startup, clear, and compact. It prints a context file that tells the agent to load the postman:api-engineer skill before any broad API engineering task. The installer source then approves that hook itself. A function in the installer calls the hook list, gets the hash, and writes it into hooks.state as trusted. The comment in that source reads: “Approves only Postman’s current hook after installation.” Postman’s current plugin README says the same thing in plainer words: installation also approves the hook for you, with no separate hook prompt.

Audit first, delete second. Generated illustration by Dirty Static.

Step 1: Copy the Configs Before You Touch Them

Action: make a dated copy of both config folders. These copies are your way back if a later edit goes wrong.

mkdir -p ~/agent-config-backup-2026-11-04
cp ~/.codex/config.toml ~/agent-config-backup-2026-11-04/codex-config.toml
cp ~/.claude/settings.json ~/agent-config-backup-2026-11-04/claude-settings.json
cp ~/.claude/plugins/installed_plugins.json ~/agent-config-backup-2026-11-04/claude-installed_plugins.json

Expected result: three files sit in the new backup folder. If one copy command reports that a file does not exist, that agent may not be installed, or its config may live under CODEX_HOME or CLAUDE_CONFIG_DIR. Note which file was missing and keep going.

Step 2: Audit the Files the Installer Touched

Action: search each config file for Postman entries. These searches change nothing. They print the evidence.

grep -n -i postman ~/.codex/config.toml
grep -n -i postman ~/.claude/settings.json
grep -n -i postman ~/.claude/plugins/installed_plugins.json
ls -la ~/.local/bin | grep -i postman

On a Mac, you can also check whether the automatic install is what happened on your machine. Search the Postman log for the trigger name from the issue:

grep -n "auto-existing-upgrade" ~/Library/Application\ Support/Postman/logs/main.log

Expected result: on an affected machine, the Codex search shows three blocks like the ones the issue preserved:

[marketplaces.postman]
source_type = "git"
source = "https://github.com/postmanlabs/postman-plugin.git"

[plugins."postman@postman"]
enabled = true

[hooks.state."postman@postman:hooks/codex-hooks.json:session_start:0:0"]
trusted_hash = "sha256:..."
trusted_content_hash = "sha256:..."

The Claude searches show postman@claude-plugins-official in the enabled plugins and a record in the installed plugins file. If every search prints nothing, your machine shows no sign of this install, and you can stop here. Your audit is the result.

Step 3: Remove the Plugin From Claude Code

Action: uninstall the plugin with the command Anthropic documents for managing plugins from your shell. Claude Code’s plugin documentation says shell uninstall acts on user scope, which is the scope this install used.

claude plugin uninstall postman@claude-plugins-official

Expected result: the command reports the plugin as uninstalled. If you would rather stop the plugin now and decide later, claude plugin disable postman@claude-plugins-official turns it off without removing it. For this cleanup, uninstall is the right call. You can always install the plugin on purpose later, which is how it should have arrived in the first place. Our guide to running Claude Code and Codex side by side covers deliberate setups like that.

Step 4: Remove the Plugin and Marketplace From Codex

Action: remove the plugin first, then remove the marketplace that delivered it. OpenAI’s plugin documentation covers the marketplace commands, including list and remove.

codex plugin remove postman@postman
codex plugin marketplace remove postman

Expected result: both commands complete, and codex plugin marketplace list no longer shows a Postman entry. If the remove command reports that the plugin is not installed, do not force it. The marketplace removal and the manual check in Step 6 are what guarantee the config is clean.

Step 5: Run Postman’s Own Remover, Then Decide on the CLI

Action: run the remover from Postman’s plugin project. The project README says the installer command can report what is installed with status and uninstall with remove, across every agent it supports.

npx @postman/postman-plugin status
npx @postman/postman-plugin remove

Expected result: the status output after removal shows the plugin as not installed for Codex and Claude Code. One gap matters here. Neither the README nor the install docs state that this remover clears the Codex hook trust record. Assume it does not, and check in Step 6.

The CLI in ~/.local/bin is a separate call. Postman’s CLI documentation says a CLI installed by script is removed by deleting the binary, and that the binary lives in ~/.local/bin on macOS and Linux. If the CLI arrived with this install and you do not use it, delete it. If you installed the Postman CLI on purpose through npm, use npm uninstall -g postman-cli instead.

ls -la ~/.local/bin | grep -i postman
rm ~/.local/bin/postman

Step 6: Clear the Leftover Hook Trust Record by Hand

Action: open ~/.codex/config.toml in a text editor and look for any Postman blocks that survived. Delete each whole block that names Postman: the [marketplaces.postman] table, the [plugins."postman@postman"] table, and the [hooks.state."postman@postman:hooks/codex-hooks.json:session_start:0:0"] table with its two hash lines. Delete whole tables only, from the table header down to the line before the next header. Leave every other setting exactly as it is.

Expected result: the file saves with no damage to its structure. This step is the centre of the whole tutorial. Removing a plugin file while its trust record stays behind leaves the door marked as approved, and the trust record is the part no uninstall screen shows you. If you vet agent plugins often, PlugVet’s grading directory is worth knowing about before the next install, not after it.

Clean configs, empty searches. Generated illustration by Dirty Static.

Verification

Run the audit from Step 2 again. Every search should now print nothing:

grep -n -i postman ~/.codex/config.toml
grep -n -i postman ~/.claude/settings.json
grep -n -i postman ~/.claude/plugins/installed_plugins.json
claude plugin list
codex plugin list
codex plugin marketplace list

Then start each agent fresh. In Codex, run /hooks and confirm no Postman SessionStart hook appears in the list. Start a session in each agent and give it a small task that has nothing to do with Postman. The agent should start with no Postman skill announcement and no MCP auth warning. That clean start, plus the empty searches, is the proof.

Troubleshooting

Next Steps

Keep the backup folder until you have run both agents for a few days without a problem, then delete it. Add the Step 2 searches to your routine after any desktop tool update, not just Postman’s. The pattern in this story is the part that generalises: a trusted app wrote into the config of other apps, and the only sign was a log line and a changed file. Files you can read beat prompts you never saw.

Postman, for its part, still sells a deliberate install path, and the plugin itself is a real tool for API work when you choose it. Choose is the operative word. Install it from the plugin repo when you want it, review the hook inside Codex when Codex asks, and let the trust prompt do the job it was built for.

Facts checked November 4, 2026, against GitHub issue 14370, the Postman plugin repository, Anthropic’s plugin documentation, and OpenAI’s hooks and plugin documentation. This tutorial follows the documented removal commands and the config records preserved in the issue. It does not claim the full sequence was run on a test machine.

Sources

• The install record, config blocks, hook text, installer source, and the reporter’s limits on what the evidence shows: GitHub issue 14370, postmanlabs/postman-app-support
• The deliberate install path, the remover and status commands, and the statement that installation approves the Codex hook: postmanlabs/postman-plugin
• Plugin scopes, where user scope settings live, and the shell install, disable, and uninstall commands: Install and manage plugins, Claude Code documentation
• Hook review and trust, trust recorded against the hook hash, and the /hooks browser: Hooks, Codex documentation
• Marketplace list and remove commands from the CLI: Package your plugin, OpenAI Developers
• Where the script installed CLI binary lives and how to remove it, plus the postman status agent plugin check: Install the Postman CLI and Postman CLI basic commands
• Body illustrations: generated for Dirty Static