Postman's agent plugins turn an old grievance into departures

The HN submission's title alleged attempts to share all API data. The linked report was more specific. indicava presented installation logs, changed agent settings and pinned source references, saying Postman had made itself part of general API work without a specific request. On HN, schleck8 focused on the trust boundary, while cglan reported experiencing the unwanted behavior too. Their concern was not simply another AI feature inside Postman; it was Postman reaching into separate tools.

This report establishes unwanted integration and instruction changes; it does not claim to establish data exfiltration.

The issue's later updates brought a company-side explanation. zecoquit said bundling the CLI and plugins was meant to spare users installation difficulties, said it was mentioned in the download and update flows, and promised clearer opt-in plus a review of approval and startup behavior. A subsequent report from ronthedrummer described another automatic installation on a later desktop version, but ultimately distinguished changed files from an observed Codex hook execution. On HN, the discussion had already moved from the incident to whether Postman belonged on developers' machines at all.

Within the opening hour, Waterluvian described having replaced Postman with Insomnia and wondered where to go if that replacement also became troublesome. Replies turned that hypothetical into history: mzajc linked an Insomnia account-requirement discussion, while amflare said aggressive account prompts had already driven a move to Yaak. The replacement list was also a record of successive exits.

Bruno became a recurring answer because readers wanted local collections rather than another account. Explaining the attraction, debo_ called it “Bruno is the closest I've found to a dumb client that doesn't pester me for an account.” Elsewhere, devmor said an entire team had moved, and dham valued keeping request definitions in git. Those endorsements described control over a workflow, not just a different arrangement of buttons.

But recommendations carried their own warnings. In response to praise for Bruno, rvz linked its funding announcement and predicted another growth-driven turn. Answering the resulting disappointment, waterTanuki emphasized that Bruno could be forked, unlike Postman. The escape question became whether a replacement offered a durable exit if its owner changed direction.

The most revealing exchange began when Waterluvian inspected Yaak and treated its pricing page as a warning. Its creator, gschier, entered the branch with a different account of payment: “The commercial-use license is my best attempt at aligning incentives between me and the user, while still funding the project's future.” The commercial-use terms, the creator explained, applied to prebuilt binaries; building and running from source remained free for any use.

That answer produced a concession rather than another dismissal. Waterluvian replied, “I think that's a sensible approach.” then explained that Postman and Insomnia had made monetization itself feel predictive of future pressure. When runako objected that engineers deserved compensation, Waterluvian clarified that their company had paid for useful FOSS and small-team services. The exchange separated a price from the fear of a later change in terms.

Then gschier supplied the connection behind the new product: “Fun fact, I made Insomnia too, and started over with Yaak after I sold it and watched it go down the same path.” In this branch, the three participants did not end up divided over whether software work deserved payment. What remained was Waterluvian's doubt that good intentions could survive the same commercial pressures indefinitely.

Elsewhere, the claim that nobody used Postman anymore met accounts from people who still encountered it at work. Responding to that premise, ozim described business analysts, testers and nontechnical colleagues asking for collections. An API-platform lead, karthikeyankc, supplied the practical reason: developers wanted to import a collection and start calling endpoints immediately, while Postman's public network and browser runner reduced friction during evaluation. These replies defended a use case, not the reported installation behavior.

The smaller argument beneath that enterprise explanation was whether a GUI was worth keeping at all. In fergie's branch, three participants questioned the need or described script-based substitutes, while three explained advantages they had found in an interface or wrapper. The exchange split evenly rather than reducing to experienced developers against beginners. Recalling automatic bearer-token handling, AdmiralAsshat described the moment as “The biggest "Oh my god, this is so much easier" moment was just setting up a tiny JS script onto the login API to stash the bearer token from the return response into a variable, and then propagate it into the header of all subsequent calls.”; Tubelord added that a visual client helped demonstrate backend work to semitechnical stakeholders.

Coding agents offered another exit, but not a shared destination. Answering swatcoder's hope that AI could democratize small tools, mschuster91 warned about security and maintenance burdens. In a separate exchange, theturtletalks described useful bespoke software, while caned answered with problems left for others to discover. Those two direct exchanges each paired an optimistic account with a skeptical one. Readers could agree that alternatives existed without agreeing that everyone should maintain a personal replacement.

Three commenters supplied concrete organization-level consequences: devmor reported a previous team migration to Bruno, bottombutton said a healthcare employer had withdrawn approval and switched overnight, and simpaticoder announced an immediate plan to deprecate Postman. Their accounts put existing dissatisfaction alongside new action; the incident was not merely generating a shopping list.

The linked issue separates unwanted installation from proof of uploaded data, while HN commenters such as neya and primitivesuave raised additional allegations about request handling and logging from their own experience. The replacement debate also stayed open: readers disagreed over commercial incentives, the value of interfaces and the maintenance cost of agent-built tools.

The pending test is the response promised in the issue. indicava requested explicit consent, narrower startup instructions and a complete removal path; zecoquit promised clearer opt-in and review. A later issue comment from ck-tecso reported that the offered uninstall route left a Copilot integration behind. For users seeking to leave, the next meaningful update is therefore not another client recommendation, but whether Postman stops installing unwanted integrations and reliably removes those already present.