Agents that ship dark.

• You did not read every line. An agent can write a checkout rewrite in four minutes. A flag means the whole thing can be off again in four seconds, from a phone, with no rollback and no deploy.
• The skill changes what the agent writes. It wraps the new path in an if, keeps the old path intact and reachable, and reports the flag key back to you in its final message.
• The MCP server changes what it can do. It can create a flag, turn it on in dev to test its own work, and promote it to staging. Turning a flag on in production stays yours.

From the root of your project. It writes your key into .env.local, downloads the skill to .claude/skills/launchflag/SKILL.md, and configures the MCP server for Claude Code and Cursor.

$ npx launchflag init

It asks for your dev key and your API token, or takes them as --key and --token. Both are on the dashboard Install page. It also adds .env.local, .mcp.json and .cursor/mcp.json to your .gitignore, because two of those now hold a token.

The hosted MCP server is one URL and a token. Nothing to install, nothing to keep running. Replace lfk_… with your API token.

$ claude mcp add --transport http launchflag https://launchflag.dev/mcp --header "Authorization: Bearer lfk_…"

Or commit nothing and check in a project file instead. Claude Code reads .mcp.json at the project root. Because it carries the token, keep it out of git.

{
  "mcpServers": {
    "launchflag": {
      "type": "http",
      "url": "https://launchflag.dev/mcp",
      "headers": { "Authorization": "Bearer lfk_…" }
    }
  }
}

Cursor reads the same shape from .cursor/mcp.json for a single project, or ~/.cursor/mcp.json for every project.

{
  "mcpServers": {
    "launchflag": {
      "type": "http",
      "url": "https://launchflag.dev/mcp",
      "headers": { "Authorization": "Bearer lfk_…" }
    }
  }
}

$ codex mcp add launchflag --url https://launchflag.dev/mcp --header "Authorization: Bearer lfk_…"

Anything else that reads an mcpServers block takes the same JSON on one line.

{"mcpServers":{"launchflag":{"type":"http","url":"https://launchflag.dev/mcp","headers":{"Authorization":"Bearer lfk_…"}}}}

Prefer the process local? @launchflag/mcp is the same seven tools over stdio, reading the token from the environment instead of a header.

$ claude mcp add launchflag -e LAUNCHFLAG_TOKEN=lfk_… -e LAUNCHFLAG_URL=https://launchflag.dev -- npx -y @launchflag/mcp

Every tool takes an optional project id and uses your first project when you leave it out. Errors come back as text the agent can read, not exceptions.

The skill is served at https://launchflag.dev/skill.md and lives in your repo at .claude/skills/launchflag/SKILL.md. It fires on any user-facing feature, rewrite, payment, auth, email or deletion path, new agent tool, or prompt change. It tells the agent to:

• Write the if. Wrap the new path, leave the old one intact and reachable, never delete it in the same change.
• Ship it dark. No dashboard step. The flag registers itself the first time the code runs, off everywhere, fail closed.
• Never turn it on in prod. Dev is fair game for testing its own work, staging by promotion. The staging to prod step is yours.
• Tell you the key. Every final message names the flag, its fail mode, and the one line that turns it on.
• Offer cleanup later. Once a feature has been fully on for weeks, it offers a change that deletes the flag and the old path.

import { flag } from "@launchflag/sdk";

if (await flag("checkout_v2", user.id)) {
  return newCheckout(cart);   // new path
}
return oldCheckout(cart);     // old path, untouched

Not using Claude Code? The file is plain markdown. Point any agent at it, or paste it into your AGENTS.md. npx launchflag init appends a short LaunchFlag section to an existing AGENTS.md for you.

• The token is per user, not per project. It can read and change flags in every project you own, so treat it like a password.
• It is shown once, when you create it. Only a hash is stored. Lost it, or leaked it: revoke and create a new one from Settings, then re-run npx launchflag init.
• .mcp.json and .cursor/mcp.json hold the token in plain text. Keep both out of git. The init command adds them to .gitignore for you.
• The token is not the same thing as an environment key. lfk_… manages flags, lf_dev_… and its siblings only evaluate them. Never give an agent a production environment key it does not need.