Agents that ship dark.

• You did not read every line. An agent can write a checkout rewrite in four minutes. A flag means the whole thing can be off again in four seconds, from a phone, with no rollback and no deploy.
• The skill changes what the agent writes. It wraps the new path in an if, keeps the old path intact and reachable, and reports the flag key back to you in its final message.
• The MCP server changes what it can do. It can create a flag, turn it on in dev to test its own work, and promote it to staging. Turning a flag on in production stays yours.

From the root of your project. It installs the launchflag package, writes your key into .env.local, downloads the skill to .claude/skills/launchflag/SKILL.md, and points Claude Code and Cursor at the hosted MCP server.

$ npx launchflag init --key lf_dev_… --token lfk_… --url https://launchflag.dev

Using pnpm? Run pnpm dlx launchflag init instead of npx.

Leave the flags off and it asks for your dev key and your API token. Both are on the dashboard Install page. It also adds .env.local, .mcp.json and .cursor/mcp.json to your .gitignore, because two of those now hold a token.

The hosted MCP server is the default: one URL and a token, nothing to install and nothing to keep running. Replace lfk_… with your API token.

$ claude mcp add --transport http launchflag https://launchflag.dev/mcp --header "Authorization: Bearer lfk_…"

Or commit nothing and check in a project file instead. Claude Code reads .mcp.json at the project root. Because it carries the token, keep it out of git.

{
  "mcpServers": {
    "launchflag": {
      "type": "http",
      "url": "https://launchflag.dev/mcp",
      "headers": { "Authorization": "Bearer lfk_…" }
    }
  }
}

Cursor reads the same shape from .cursor/mcp.json for a single project, or ~/.cursor/mcp.json for every project.

{
  "mcpServers": {
    "launchflag": {
      "type": "http",
      "url": "https://launchflag.dev/mcp",
      "headers": { "Authorization": "Bearer lfk_…" }
    }
  }
}

$ export LAUNCHFLAG_TOKEN=lfk_…
$ codex mcp add launchflag --url https://launchflag.dev/mcp --bearer-token-env-var LAUNCHFLAG_TOKEN

Codex has no header flag. It reads the bearer token from the environment every time it starts, so put the export in your shell profile rather than running it once.

Anything else that reads an mcpServers block takes the same JSON on one line.

{"mcpServers":{"launchflag":{"type":"http","url":"https://launchflag.dev/mcp","headers":{"Authorization":"Bearer lfk_…"}}}}

The alternative, if you would rather the process ran locally: launchflag-mcp is a separate package with the same tools over stdio, reading the token from the environment instead of a header. You do not need it for the hosted server above.

$ claude mcp add launchflag -e LAUNCHFLAG_TOKEN=lfk_… -e LAUNCHFLAG_URL=https://launchflag.dev -- npx -y launchflag-mcp@latest

Every tool takes an optional project id and uses your first project when you leave it out. Errors come back as text the agent can read, not exceptions.

The skill is served at https://launchflag.dev/skill.md and lives in your repo at .claude/skills/launchflag/SKILL.md. It fires on any user-facing feature, rewrite, payment, auth, email or deletion path, new agent tool, or prompt change. It tells the agent to:

• Write the if. Wrap the new path, leave the old one intact and reachable, never delete it in the same change.
• Ship it dark. No dashboard step. The flag registers itself the first time the code runs, off everywhere, fail closed.
• Never turn it on in prod. Dev is fair game for testing its own work, staging by promotion. The staging to prod step is yours.
• Tell you the key. Every final message names the flag, its fail mode, and the one line that turns it on.
• Offer cleanup later. Once a feature has been fully on for weeks, it offers a change that deletes the flag and the old path.

import { flag } from "launchflag";

if (await flag("checkout_v2", user.id)) {
  return newCheckout(cart);   // new path
}
return oldCheckout(cart);     // old path, untouched

Not using Claude Code? The file is plain markdown. Point any agent at it, or paste it into your AGENTS.md. npx launchflag init appends a short LaunchFlag section to an existing AGENTS.md for you.

• A token is per user, not per project: it reaches every project you own. Give each thing that calls the API its own, so revoking one does not break the rest, and pick the smallest scope that works.
• Full. Everything you can do, in every environment.
• CI. Flags in dev and staging. Never prod, never Emergency off.
• Read only. Reads flags, audit and insights. Changes nothing.
• It is shown once, when you create it. Only a hash is stored. Lost it, or leaked it: revoke that one from Settings, create another, and re-run npx launchflag init.
• .mcp.json and .cursor/mcp.json hold the token in plain text. Keep both out of git. The init command adds them to .gitignore for you.
• The token is not the same thing as an environment key. lfk_… manages flags, lf_dev_… and its siblings only evaluate them. Never give an agent a production environment key it does not need.