Flagger.gg

Kill switches: roll back a bad release in seconds

A kill switch is a flag you can turn off at once, without a deploy. In Flagger.gg, flagger kill <key>, the flag_kill tool or the console turns a flag off for everyone, on protected flags too. The change reaches your SDKs within a second, and kill is never rate-limited.

Updated

Kill a feature, step by step

  1. Ship the change behind a flag. A kill switch only exists if the code path is wrapped in a flag check. Unknown or errored flags are off, so the fallback path is the safe one.
  2. Kill it. Run flagger kill <key> --note "why", call flag_kill over MCP, or switch it off in the Release console. The flag goes off for everyone and keeps its rules.
  3. Confirm it's off. flagger eval <key> --user <id> explains the answer for one user; it should say off.
  4. Fix, then bring it back. When the fix is deployed, flagger revert <key> restores the state before the kill, rules included, or walk it up again from admins.
flagger kill checkout_v2 --note "500s on /checkout since 3:02 PM" --json
flagger eval checkout_v2 --user usr_123 --json
flagger revert checkout_v2 --note "fix deployed in #881" --json

How fast it takes effect

Flagger.gg's SDKs hold the ruleset in memory and follow a server-sent event stream. After every change the service pushes the new ruleset within a second; if the stream is down, the SDK polls every 5 seconds. There's no build, no deploy and no cache to purge.

Kill always works

  • Anyone who can write, a person or a token with the kill action, can kill any flag, including protected flags that otherwise refuse agents.
  • Kill is exempt from agent rate limits and never needs approval, in auto-live or approvals mode.
  • It writes an audit row with who, which run, the state before and the note, so the post-mortem starts with the facts.

Give the agents that ship your code the kill action, and tell them to kill their own flag the moment a check fails after a change.

Automatic rollback

In development Rolling a flag back automatically when error rates or other metrics regress is in development. Today a kill is a person's or an agent's call, made with one command.

FAQ

How do I turn off a broken feature instantly without redeploying?

Put the feature behind a flag, then turn the flag off. With Flagger.gg, flagger kill <key> turns it off for everyone and your apps see the change within a second.

What's the difference between kill and setting a flag off?

Both end in off and keep the rules. Kill is always allowed for anyone who can write, works on protected flags and skips rate limits and approvals.

Can an AI agent use the kill switch?

Yes, if its token has the kill action. It's the one change an agent can always make, even on protected flags.

How do I undo a kill?

flagger revert <key> (or flag_revert) rolls back to the state before the latest change. With approvals on, a revert that widens the flag past the agent's cap becomes a request.

  • Feature flags for AI coding agentsWhy every change an AI coding agent ships should land behind a flag, and how agents create, roll out and kill flags with scoped tokens and an audit log.
  • Percentage rollouts and sticky bucketingHow to roll a feature out to a percentage of users so each user keeps the same answer as you widen it: sticky hash bucketing, with Go and Node examples.
  • An MCP server for feature flags, used safelyFlagger.gg's MCP server gives agents 11 feature-flag tools, hosted or on stdio. Tools follow token scope, writes need a note, there's no approve tool.
  • What is a feature flag?A feature flag is a switch in your code that turns a feature on or off, for everyone or chosen users, without a deploy. How flags work, with examples.

Ship your next change behind a flag.

Sign up, add an SDK key to your app and give your agent a token.

Sign up