An MCP server for feature flags, used safely
Flagger.gg's MCP server gives agents 11 flag tools, hosted (Streamable HTTP at mcp.flagger.gg) or local (flagger mcp). Tools appear only when the agent token's actions allow them, every write needs a note, kill is always allowed, and there is no approve tool, so agents can't approve their own changes.
Updated
Connect an agent
- Create an agent token in the console, scoped to one project, its environments and its actions.
- Point the agent at the server:
https://mcp.flagger.ggwithAuthorization: Bearer flg_agent_…, or runflagger mcpon stdio withFLAGGER_TOKENset. - List the tools from your client. The agent sees only the tools its token's actions allow.
- Make a first change with a note, such as
flag_createfor the work it's about to ship, and find it in the audit log.
Client-by-client snippets for Claude Code, Codex and Cursor are in this setup guide.
The 11 tools
project and env are optional on every tool and default to the token's project and production. Each write takes note (required for agents) and an optional run.
| Tool | Input | Needs action |
|---|---|---|
flags_list | {notLive?, state?} | read |
flag_get | {key}: the flag, its history and pending requests | read |
flag_eval | {key, context: {userId?, email?, isAdmin?, workspaceIds?}} → {on, reason} | read |
requests_list | {status?} | read |
request_get | {id} | read |
flag_create | {key, description, summary, owner, notReady?, note} | create |
flag_set | {key, state?, users?, workspaces?, percent?, confirmNotReady?, note} | target or rollout |
flag_target | {key, users?, workspaces?, mode: replace | add | remove, note} | target |
flags_bulk | {keys, state: on | admins, note} | target or rollout |
flag_revert | {key, toEvent?, note} | target or rollout |
flag_kill | {key, note} | kill |
Each tool's output is the API's JSON answer, as structuredContent and as text. A change that needs a person comes back as a normal result with status: "pending_approval" and the request; API errors come back as isError results with {error:{code,message}}.
What keeps it safe
- Scope decides the tool list. A token with only
readandkillsees six tools and can't create or roll out anything. - No approve tool. Approving is human-only, in the Release console or with a person's own
flagger login. - Notes and runs. Writes without a note are refused for agents. The run is the tool's
runinput, elseFLAGGER_RUNor theX-Flagger-Runheader, else the MCP client's name. - Approvals mode. With approvals on, an agent in production can roll out up to the cap (10% by default);
on, bulk on and wider percentages become requests. - Protected flags refuse agents except
flag_kill. - Rate limits: 30 writes a minute per agent token, and with approvals on, 5 changes to one flag an hour. Kill is exempt.
Hosted or stdio
Both serve the same tools. The hosted server is stateless Streamable HTTP: POST gets a JSON answer, and the Mcp-Session-Id returned at initialize only carries the client's name for the run. Stdio (flagger mcp) calls api.flagger.gg with FLAGGER_TOKEN or the token stored by flagger login.
FAQ
Is there an MCP server for feature flags?
Yes. Flagger.gg's MCP server is hosted at mcp.flagger.gg and also runs locally as flagger mcp, with 11 tools to list, read, create, set, target, bulk-change, revert, kill and explain flags and to read approval requests. Several other flag vendors publish MCP servers too.
Can an agent approve its own flag change over MCP?
No. There is no approve tool, and agent tokens can't approve through the API either.
Why can't my agent see flag_create?
Its token doesn't have the create action. Tools are listed only when the token's actions allow them.
Does the MCP server need a session?
No. Hosted MCP is stateless; requests without a session id work.
Ship your next change behind a flag.
Sign up, add an SDK key to your app and give your agent a token.