
Security News
arXiv Is Rate Limiting Authors Following a Flood of AI Slop Submissions
arXiv now limits authors to two submissions a month as AI slop overwhelms moderators, delays good papers, and sparks debate over applying the limit to everyone.
launchflag-mcp
Advanced tools
MCP server for LaunchFlag. It lets a coding agent create a feature flag, ship the risky path dark behind it, and flip it later without a deploy.
Seven tools, one token, no state.
Hosted (recommended). Nothing to install. Point your client at https://launchflag.dev/mcp with your API
token (lfk_…) in the Authorization header.
Local (stdio). Runs on your machine and talks to the same API over HTTPS. Useful when your client does not speak Streamable HTTP, or when you self-host LaunchFlag.
npx launchflag-mcp
Either way, the fastest setup is one command from your project root, which also writes the key and the agent
skill: npx launchflag init --token lfk_….
| Variable | Required | Default | What it is |
|---|---|---|---|
LAUNCHFLAG_TOKEN | yes | none | Your API token (lfk_…), from the dashboard Install page. The server exits if it is missing. |
LAUNCHFLAG_URL | no | https://launchflag.dev | Base URL of the LaunchFlag instance. Set it only if you self-host. |
The token is a secret. Keep the file that holds it out of git.
| Tool | What it does |
|---|---|
list_flags | Every flag with its dev, staging and prod state, fail mode and variants. |
create_flag | Creates a flag OFF in all three environments and returns the snippet to wrap the new path in. |
set_flag | Turns a flag on or off, or changes who it targets, in one environment. |
promote_flag | Copies one environment's config forward: dev to staging, or staging to prod. |
delete_flag | Deletes a flag, once the code paths behind it are gone. |
emergency_off | Kill switch: disables every non-essential flag in the project at once, or lifts it. |
list_projects | Your projects and their env keys. |
Hosted:
claude mcp add --transport http launchflag https://launchflag.dev/mcp --header "Authorization: Bearer lfk_…"
Local, in .mcp.json:
{
"mcpServers": {
"launchflag": {
"command": "npx",
"args": ["-y", "launchflag-mcp"],
"env": { "LAUNCHFLAG_TOKEN": "lfk_…" }
}
}
}
.cursor/mcp.json, hosted:
{
"mcpServers": {
"launchflag": {
"type": "http",
"url": "https://launchflag.dev/mcp",
"headers": { "Authorization": "Bearer lfk_…" }
}
}
}
Swap in the command/args/env block above to run it locally instead.
codex mcp add launchflag --url https://launchflag.dev/mcp --header "Authorization: Bearer lfk_…"
Local:
codex mcp add launchflag --env LAUNCHFLAG_TOKEN=lfk_… -- npx -y launchflag-mcp
Full agent guide, including the skill file and the flag conventions agents should follow: launchflag.dev/docs/agents.
Questions or a bug: contact@launchflag.dev.
MIT licensed.
FAQs
MCP server that lets coding agents create and flip LaunchFlag flags.
The npm package launchflag-mcp receives a total of 15 weekly downloads. As such, launchflag-mcp popularity was classified as not popular.
We found that launchflag-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
arXiv now limits authors to two submissions a month as AI slop overwhelms moderators, delays good papers, and sparks debate over applying the limit to everyone.

Research
/Security News
A new GhostAction wave hits hundreds of GitHub repos, expanding CI/CD secret theft to cloud and AI credentials in source code and git history.

Research
/Security News
Tensorlake npm SDK version 0.5.144 was compromised in a ChainDrop / Shai-Hulud attack, delivering credential-stealing malware.