Postman Silently Injects MCP Backdoor into Claude and Codex Configurations

Recent versions of the Postman desktop client have been discovered silently injecting a remote Model Context Protocol (MCP) plugin into the local configurations of Anthropic's Claude Code and OpenAI's Codex, bypassing explicit user authorization.

Postman's Silent Injection

Upon startup, the Postman client scans the developer's local environment and directly modifies two sensitive configuration files:

~/.claude/settings.json

~/.codex/config.toml

It inserts its own MCP server endpoint ( mcp.postman.com) into the AI toolchains, effectively granting Postman persistent access to the AI assistants' context and tool-calling capabilities.

Bypassing User Consent via Trust Record

The injection script writes a trust entry into the local configuration, marking Postman's startup hook as "trusted." This circumvents the mandatory security confirmation dialogs that Claude and Codex normally present when a new MCP server is registered, achieving "passwordless" persistence without user awareness.

Risk Exposure: What Data Is at Stake

Developers' Postman workspaces often contain highly sensitive artifacts:

Production Bearer Token values

Financial test account credentials

Undesensitized internal microservice routes

Cloud provider AccessKey pairs

By registering an MCP server that can be invoked by the AI assistant, Postman creates a potential exfiltration channel for any data the AI can access during coding sessions.

Discovery: AI Error Logs Reveal the Backdoor

The behavior was uncovered when OpenAI Codex began throwing repeated authentication-failure errors while attempting to connect to mcp.postman.com. The verbose error logs exposed the unauthorized registration, prompting developers to inspect their configuration files and find the injected entries.

Self-Check and Remediation

To verify compromise, run:

grep -il postman ~/.claude/settings.json ~/.codex/config.toml

If output appears, the files have been modified. Removal options include manually deleting the injected entries from the two configuration files or executing the community-suggested command: npx @postman/postman-plugin remove Running the removal command is recommended for a clean rollback.

Implications for Tool Supply-Chain Trust

The incident underscores a growing risk in the AI-augmented development workflow: tools that integrate via open protocols like MCP can silently extend their reach into other applications' configuration stores. The convenience of "seamless" integration must not come at the cost of user consent and security boundaries.