
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
@featureflip/mcp
Advanced tools
MCP server for managing Featureflip feature flags from AI agents and editors
MCP (Model Context Protocol) server for Featureflip — manage feature flags from AI coding assistants (Claude Code, Cursor, Copilot, Cline) and autonomous agents.
ffp_...): Settings → API Tokens — acts as you, for interactive editor use.ffs_...): Organization Settings → Service Tokens — scoped machine identity for CI/agents.claude mcp add featureflip -e FEATUREFLIP_TOKEN=ffp_your_token -- npx -y @featureflip/mcp
{
"mcpServers": {
"featureflip": {
"command": "npx",
"args": ["-y", "@featureflip/mcp"],
"env": { "FEATUREFLIP_TOKEN": "ffp_your_token" }
}
}
}
| Env var | Required | Default | Purpose |
|---|---|---|---|
FEATUREFLIP_TOKEN | yes | — | ffp_/ffs_ API token |
FEATUREFLIP_API_URL | no | https://api.featureflip.io | API base URL |
FEATUREFLIP_ORG | no | auto | Org slug (needed only for multi-org personal tokens) |
CRUD: list_projects, list_environments, list_flags, get_flag, create_flag, update_flag,
delete_flag, archive_flag, restore_flag, set_flag_expiry, toggle_flag, update_flag_environment_config,
get_targeting, update_targeting, manage_variation, list_segments, get_segment
Webhooks (Admin token required): list_webhooks, list_webhook_deliveries, manage_webhook, deliver_webhook
Workflows: flag_status (cross-environment view), find_stale_flags (cleanup candidates),
wrap_feature (create flag + get the SDK snippet for your language)
Full reference: https://featureflip.io/docs/integrations/mcp/
Apache-2.0
FAQs
MCP server for managing Featureflip feature flags from AI agents and editors
The npm package @featureflip/mcp receives a total of 0 weekly downloads. As such, @featureflip/mcp popularity was classified as not popular.
We found that @featureflip/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.