
Security News
Software Engineering Daily Podcast: Feross on AI, Open Source, and Supply Chain Risk
Socket CEO Feross Aboukhadijeh joins Software Engineering Daily to discuss modern software supply chain attacks and rising AI-driven security risks.
@unleash/mcp
Advanced tools
A purpose-driven Model Context Protocol (MCP) server for managing Unleash feature flags. This server enables LLM-powered coding assistants to create and manage feature flags following Unleash best practices.
Experimental feature
The Unleash MCP server is an experimental feature. Functionality may change, and we do not yet recommend using it in production environments.
To share feedback, join our community Slack, open an issue on GitHub, or email us at beta@getunleash.io.
This MCP server provides tools that integrate with the Unleash Admin API, allowing AI coding assistants to:
The MCP server exposes the following tools:
create_flag: Creates a feature flag in Unleash.evaluate_change: Scores risk and recommends feature flag usage.detect_flag: Discovers existing feature flags to avoid duplicates.wrap_change: Provides guidance on how to wrap a change in a feature flag.set_flag_rollout: Configures rollout strategies for a feature flag (does not enable the flag).get_flag_state: Surfaces a feature flag's metadata and its activation strategies.toggle_flag_environment: Enables or disables a feature flag in an environment.remove_flag_strategy: Deletes a feature flag's strategy from an environment.cleanup_flag: Generates instructions for safely removing flagged code paths.The core workflow for an AI assistant is designed to be:
evaluate_change: First, assess a code change to see if a flag is needed.detect_flag: This is often called automatically by evaluate_change to prevent creating duplicate flags.create_flag: If a new flag is required, this tool creates it in Unleash.wrap_change: Finally, this tool provides the language-specific code to implement the new flag.See more information on the core workflow tools in the Tool reference section.
Before you can run the server, you need the following:
This section covers the different ways to install and run the Unleash MCP server. You can either follow a setup for agents (such as Claude Code and Codex), run the MCP as a standalone process using npx, or use a local development setup.
You can add the MCP server directly to Claude Code or Codex. Agent configurations are path-specific. You must run the following command from the root directory of the project where you want to use the MCP.
For Claude Code:
claude mcp add unleash \
--env UNLEASH_BASE_URL={{your-instance-url}} \
--env UNLEASH_PAT={{your-personal-access-token}} \
-- npx -y @unleash/mcp@latest --log-level error
For Codex:
codex mcp add unleash \
--env UNLEASH_BASE_URL={{your-instance-url}} \
--env UNLEASH_PAT={{your-personal-access-token}} \
-- npx -y @unleash/mcp@latest --log-level error
You can run the MCP server as a standalone process without cloning the repository using npx. Provide configuration through environment variables or a local .env file in the directory where you run the command:
UNLEASH_BASE_URL={{your-instance-url}} \
UNLEASH_PAT={{your-personal-access-token}} \
UNLEASH_DEFAULT_PROJECT={{default_project_id}} \
npx unleash-mcp --log-level debug
The CLI supports the same flags as the local build (for example, --dry-run, --log-level).
Follow these steps to set up the project for local development.
Clone the repository and install dependencies using Yarn.
git clone https://github.com/Unleash/unleash-mcp.git
cd unleash-mcp
yarn install
Copy .env.example to .env and fill in your Unleash credentials:
cp .env.example .env
Edit .env:
UNLEASH_BASE_URL={{your-instance-url}}
UNLEASH_PAT={{your-personal-access-token}}
UNLEASH_DEFAULT_PROJECT={{default_project_id}} # Optional: the project the MCP should use by default
yarn build
Output will be in the dist/ directory.
Run type checking, linting, and tests:
# Type checking and linting
yarn lint
# Run tests (the Vitest framework is configured, but no test suites yet)
yarn test
Development mode with hot reload
yarn dev
Production mode
node dist/index.js
With CLI flags
# Dry run mode (simulates API calls without actually creating flags)
node dist/index.js --dry-run
# Custom log level
node dist/index.js --log-level debug
# Combine flags
node dist/index.js --dry-run --log-level debug
This section describes each of the core tools in detail, including its purpose, parameters, and output.
The create_flag tool creates a new feature flag in Unleash with comprehensive validation and progress tracking.
Use this tool when you have already determined that a feature flag is required (for example, after running evaluate_change) and you are ready to create it with the correct type and metadata.
The tool accepts the following parameters:
name (required): Unique feature flag name within the project.type (required): Feature flag type indicating lifecycle and intent.
release: Gradual feature rollouts to users.experiment: A/B tests and experiments.operational: System behavior and operational toggles.kill-switch: Emergency shutdowns or circuit breakers.permission: Control feature access based on user roles or entitlements.description (required): Clear explanation of what the flag controls and why it exists.projectId (optional): Target project (defaults to UNLEASH_DEFAULT_PROJECT).impressionData (optional): Enable analytics tracking (defaults to false).Agent prompt
Use create_flag with:
- name: "new-checkout-flow"
- type: "release"
- description: "Gradual rollout of the redesigned checkout experience"
- projectId: "ecommerce"
Tool payload
{
"name": "new-checkout-flow",
"type": "release",
"description": "Gradual rollout of the redesigned checkout experience with improved conversion tracking",
"projectId": "ecommerce",
"impressionData": true
}
Tool output
On success, the tool returns a JSON object containing the new feature flag's URL in the Unleash Admin UI, an MCP resource link for programmatic access, creation timestamp, and configuration details.
The evaluate_change tool evaluates whether a code change should be behind a feature flag. It examines the structure, context, and potential risk of the change and returns a recommendation with an explanation and next steps.
Use evaluate_change at the beginning of a feature or modification when you want to understand whether the work requires a feature flag. This tool is also helpful when you are unsure which flag type to use or want guidance on rollout planning.
The tool returns detailed, markdown-formatted guidance for the LLM assistant based on Unleash best practices.
The guidance includes:
When evaluate_change determines a flag is needed, it provides explicit instructions to:
create_flag tool to create the feature flag.wrap_change tool to get language-specific code wrapping guidance.The evaluation process
The tool follows a clear evaluation process:
Step 1: Gather code changes (git diff, read files)
β
Step 2: Check for parent flags (avoiding nesting)
β
Step 3: Assess code type (test? config? feature?)
β
Step 4: Evaluate risk (auth? payments? API changes?)
β
Step 5: Calculate risk score
β
Step 6: Make recommendation
β
Step 7: Take action (create flag or proceed without)
Risk assessment
The tool uses language-agnostic patterns to score risk:
Parent flag detection
The tool looks for common patterns across languages, such as:
if (isEnabled('flag')), if client.is_enabled('flag'):const enabled = useFlag('flag')const enabled = useFlag('flag') β {enabled && <Component />}if (!isEnabled('flag')) return;withFeatureFlag('flag', () => {...})All parameters are optional, but more context leads to better recommendations:
repository (string): Repository name or path.branch (string): Current branch name.files (array): List of files being changed.description (string): Description of the change.riskLevel (enum): low, medium, high, or critical, as assessed by the user.codeContext (string): Surrounding code for parent flag detection.Agent prompt
Simple usage where you let the agent gather context:
Use evaluate_change to help me determine if I need a feature flag
Explicit instructions:
Use evaluate_change with:
- description: "Add Stripe payment processing"
- riskLevel: "high"
Tool payload
{
"repository": "my-app",
"branch": "feature/stripe-integration",
"files": ["src/payments/stripe.ts"],
"description": "Add Stripe payment processing",
"riskLevel": "high",
"codeContext": "surrounding code for parent flag detection"
}
Tool output
Returns a JSON object with the evaluation result, including a needsFlag boolean, a recommendation (e.g., "create_new"), a suggested flag name, risk level, and a detailed explanation.
{
"needsFlag": true,
"reason": "new_feature",
"recommendation": "create_new",
"suggestedFlag": "stripe-payment-integration",
"riskLevel": "critical",
"riskScore": 5,
"explanation": "This change integrates Stripe payments, which is critical risk...",
"confidence": 0.9
}
The detect_flag tool finds existing feature flags in the codebase so you can reuse them instead of creating duplicates. This tool is automatically integrated into the evaluate_change workflow but can also be used manually.
Use this tool before creating a new feature flag or during code evaluation to check for existing flags that might already cover your use case. This helps prevent flag duplication.
The tool returns comprehensive search instructions and uses multiple detection strategies:
The tool then follows a scoring process:
Step 1: Execute file-based search (grep for flag patterns in target files)
β
Step 2: Search git history for recent flag additions
β
Step 3: Perform semantic matching (description β flag names)
β
Step 4: Analyze code context (if provided)
β
Step 5: Combine scores from all methods
β
Step 6: Return best candidate with confidence score
Confidence levels
The tool returns candidates with confidence scores:
β₯0.7: Strong match; reuse is recommended.0.4-0.7: Possible match; review manually.<0.4: Weak match; likely create a new flag.description (required): Description of the change or feature. For example, "payment processing with Stripe", "new checkout flow".files (optional): Files being modified. For example, ["src/payments/stripe.ts", "src/checkout/flow.ts"].codeContext (optional): Nearby code to scan for flags.Agent prompt
Check for existing flags before creating a flag:
Use detect_flag with description "payment processing with Stripe"
Integrated automatically in evaluation:
Use evaluate_change - automatically searches for existing flags
Tool payload
{
"description": "payment processing with Stripe",
"files": ["src/payments/stripe.ts"]
}
Tool output
Returns a JSON object indicating if a flag was found. If flagFound is true, it includes a candidate object with the flag's name, location, confidence score, and the reason for the match.
Match found:
{
"flagFound": true,
"candidate": {
"name": "stripe-payment-integration",
"location": "src/payments/stripe.ts:42",
"context": "if (client.isEnabled('stripe-payment-integration')) {",
"confidence": 0.85,
"reasoning": "Found in same file you're modifying, added 2 days ago",
"detectionMethod": "file-based"
}
}
No match found:
{
"flagFound": false,
"candidate": null
}
The tool wrap_change generates language-specific code snippets and guidance for wrapping code with feature flags. It helps LLMs and developers follow existing patterns in the codebase and use flags correctly.
Use this tool after you have created a feature flag (with create_flag) and need to implement it in your code. It's especially useful when you want to ensure you are following existing codebase patterns or need framework-specific examples (e.g., React, Django).
This tool is the final step in the evaluate_change β create_flag β wrap_change workflow.
The tool provides the following guidance in its response:
Supported languages and frameworks:
flagName (required): Feature flag name to wrap the code with. For example: "new-checkout-flow", or "stripe-integration".language (optional): Programming language (auto-detected from fileName if not provided). Supported: typescript, javascript, python, go, ruby, php, csharp, java, rustfileName (optional): File name being modified (helps detect language), For example: "checkout.ts", "payment.py", or "handler.go".codeContext (optional): Surrounding code to help detect existing patterns.frameworkHint (optional): Framework for specialized templates. For example, "React", "Express", "Django", "Rails", or "Spring Boot".Agent prompt
Use wrap_change with:
- flagName: "new-checkout-flow"
- fileName: "src/components/checkout.ts"
- frameworkHint: "React"
Tool payload
{
"flagName": "new-checkout-flow",
"fileName": "checkout.ts",
"frameworkHint": "React"
}
Tool output
Returns a comprehensive, markdown-formatted string that guides the user on how to wrap their code. This includes a quickstart, search instructions, wrapping instructions with placeholders, all available templates for the language, and links to SDK documentation.
# Feature Flag Wrapping Guide: "new-checkout-flow"
**Language:** TypeScript
**Framework:** React
## Quick Start
[Recommended pattern with import and usage]
## How to Search for Existing Flag Patterns
[Step-by-step Grep instructions]
## How to Wrap Code with Feature Flag
[Wrapping instructions with examples]
## All Available Templates
[If-block, guard clause, hooks, ternary, etc.]
The server follows a focused, purpose-driven design.
src/
βββ index.ts # Main server entry point
βββ config.ts # Configuration loading and validation
βββ context.ts # Shared runtime context
βββ unleash/
β βββ client.ts # Unleash Admin API client
βββ tools/
β βββ createFlag.ts # create_flag tool
β βββ evaluateChange.ts # evaluate_change tool
β βββ detectFlag.ts # detect_flag tool
β βββ wrapChange.ts # wrap_change tool
βββ prompts/
β βββ promptBuilder.ts # Markdown formatting utilities
βββ evaluation/
β βββ riskPatterns.ts # Risk assessment patterns
β βββ flagDetectionPatterns.ts # Parent flag detection patterns
βββ detection/
β βββ flagDiscovery.ts # Flag discovery strategies
β βββ flagScoring.ts # Scoring and ranking logic
βββ knowledge/
β βββ unleashBestPractices.ts # Best practices knowledge base
βββ templates/
β βββ languages.ts # Language detection and metadata
β βββ wrapperTemplates.ts # Code wrapping templates
β βββ searchGuidance.ts # Pattern search instructions
βββ utils/
βββ errors.ts # Error normalization
βββ streaming.ts # Progress notifications
{code, message, hint} format.This section provides a quick reference for all configuration options.
Environment variables:
UNLEASH_BASE_URL: Your Unleash instance URL (required).UNLEASH_PAT: Personal access token (required).UNLEASH_DEFAULT_PROJECT: The default project ID the MCP should use (optional).CLI flags:
--dry-run: Simulate operations without making actual API calls.--log-level: Set logging verbosity (debug, info, warn, error).This server encourages Unleash best practices from the official documentation:
new-checkout-flowenable-ai-recommendations not flag1.mobile-push-notifications.This server uses the Unleash Admin API. For complete API documentation, see:
POST /api/admin/projects/{projectId}/features - Create feature flagError: "UNLEASH_BASE_URL must be a valid URL": Ensure your base URL is complete, including protocol. For example, https://app.unleash-hosted.com/instance. Remove any trailing slashes.
Error: "UNLEASH_PAT is required": Check that your .env file exists and contains UNLEASH_PAT={{your-personal-access-token}}. Verify that the token is valid in Unleash.
Error: "HTTP_401": Your personal access token may be invalid or expired. Generate a new token under Profile > View Profile settings > Personal API tokens > New token.
Error: "HTTP_403": Your token doesn't have permission to create flags in this project. Review your role and permissions in Unleash.
Error: "HTTP_404": The project ID doesn't exist. Confirm the project ID in Unleash Admin UI.
Error: "HTTP_409": A flag with this name already exists in the project. Use a different name or reuse the existing flag.
MIT
This is a purpose-driven project with a focused scope. Contributions should:
FAQs
MCP server for managing Unleash feature flags
We found that @unleash/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago.Β It has 6 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Socket CEO Feross Aboukhadijeh joins Software Engineering Daily to discuss modern software supply chain attacks and rising AI-driven security risks.

Security News
GitHub has revoked npm classic tokens for publishing; maintainers must migrate, but OpenJS warns OIDC trusted publishing still has risky gaps for critical projects.

Security News
Rustβs crates.io team is advancing an RFC to add a Security tab that surfaces RustSec vulnerability and unsoundness advisories directly on crate pages.