
Security News
Software Engineering Daily Podcast: Feross on AI, Open Source, and Supply Chain Risk
Socket CEO Feross Aboukhadijeh joins Software Engineering Daily to discuss modern software supply chain attacks and rising AI-driven security risks.
A purpose-driven Model Context Protocol (MCP) server for managing Unleash feature flags. This server enables LLM-powered coding assistants to create and manage feature flags following Unleash best practices.
This MCP server provides tools that integrate with the Unleash Admin API, allowing AI coding assistants to:
Phase 1: Feature Flag Creation (Complete)
create_flag tool for creating flags via Admin APIPhase 2: Evaluation Guidance (Complete)
evaluate_change tool for determining when flags are neededPhase 3: Code Generation (Complete)
wrap_change tool for generating language-specific code snippetsYou can run the MCP server without cloning the repository by installing it on the fly with npx. Provide your configuration as environment variables or via a local .env file in the directory where you run the command:
UNLEASH_BASE_URL=https://app.unleash-hosted.com/your-instance \
UNLEASH_PAT=your-personal-access-token \
UNLEASH_DEFAULT_PROJECT=default \
npx unleash-mcp --log-level debug
The CLI supports the same flags as the local build (--dry-run, --log-level).
yarn install
Copy .env.example to .env and fill in your Unleash credentials:
cp .env.example .env
Edit .env:
UNLEASH_BASE_URL=https://app.unleash-hosted.com/your-instance
UNLEASH_PAT=your-personal-access-token
UNLEASH_DEFAULT_PROJECT=default # Optional: set a default project
To generate a Personal Access Token:
Log into your Unleash instance
Go to Profile β Personal Access Tokens
Create a new token with permissions to create feature flags
Build the project:
yarn build
Development mode (with hot reload):
yarn dev
Production mode:
node dist/index.js
With CLI flags:
# Dry run mode (simulates API calls without actually creating flags)
node dist/index.js --dry-run
# Custom log level
node dist/index.js --log-level debug
# Combine flags
node dist/index.js --dry-run --log-level debug
create_flagCreates a new feature flag in Unleash with comprehensive validation and progress tracking.
Parameters:
name (required): Unique feature flag name within the project
new-checkout-flow or enable-dark-modetype (required): Feature flag type indicating lifecycle and intent
release: Gradual feature rollouts to usersexperiment: A/B tests and experimentsoperational: System behavior and operational toggleskill-switch: Emergency shutdowns or circuit breakerspermission: Role-based access controldescription (required): Clear explanation of what the flag controls and whyprojectId (optional): Target project (defaults to UNLEASH_DEFAULT_PROJECT)impressionData (optional): Enable analytics tracking (defaults to false)Example:
{
"name": "new-checkout-flow",
"type": "release",
"description": "Gradual rollout of the redesigned checkout experience with improved conversion tracking",
"projectId": "ecommerce",
"impressionData": true
}
Response:
Returns a success message with:
evaluate_changeProvides comprehensive guidance for evaluating whether code changes require feature flags. This tool returns detailed markdown guidance to help make informed decisions.
When to use:
Optional Parameters:
repository (string): Repository name or pathbranch (string): Current branch namefiles (array): List of files being changeddescription (string): Description of the changeriskLevel (enum): User-assessed risk level (low, medium, high, critical)codeContext (string): Surrounding code for parent flag detectionWhat it provides:
The tool returns guidance covering:
Evaluation Process:
Step 1: Gather code changes (git diff, read files)
β
Step 2: Check for parent flags (avoid nesting)
β
Step 3: Assess code type (test? config? feature?)
β
Step 4: Evaluate risk (auth? payments? API changes?)
β
Step 5: Calculate risk score
β
Step 6: Make recommendation
β
Step 7: Take action (create flag or proceed without)
Risk Assessment:
The tool provides language-agnostic patterns to detect:
Parent Flag Detection:
Detects existing flag checks across languages:
if (isEnabled('flag')), if client.is_enabled('flag'):const enabled = useFlag('flag')const enabled = useFlag('flag') β {enabled && <Component />}if (!isEnabled('flag')) return;withFeatureFlag('flag', () => {...})Output Format:
Returns JSON evaluation result:
{
"needsFlag": true,
"reason": "new_feature",
"recommendation": "create_new",
"suggestedFlag": "stripe-payment-integration",
"riskLevel": "critical",
"riskScore": 5,
"explanation": "This change integrates Stripe payments, which is critical risk...",
"confidence": 0.9
}
Best Practices Included:
The tool includes Unleash best practices:
Automatic Workflow:
When evaluate_change determines a flag is needed, it provides explicit instructions to:
create_flag tool to create the feature flagwrap_change tool to get language-specific code wrapping guidanceExample Usage in Claude Desktop:
// Simple usage - let Claude gather context
Use evaluate_change to help me determine if I need a feature flag
// With explicit context
Use evaluate_change with:
- description: "Add Stripe payment processing"
- riskLevel: "high"
The tool will automatically guide you through the complete workflow: evaluate β create β wrap β implement.
Tool Parameters (all optional):
{
"repository": "my-app",
"branch": "feature/stripe-integration",
"files": ["src/payments/stripe.ts"],
"description": "Add Stripe payment processing",
"riskLevel": "high",
"codeContext": "surrounding code for parent flag detection"
}
This server follows a purpose-driven design philosophy:
src/
βββ index.ts # Main server entry point
βββ config.ts # Configuration loading and validation
βββ context.ts # Shared runtime context
βββ unleash/
β βββ client.ts # Unleash Admin API client
βββ tools/
β βββ createFlag.ts # create_flag tool
β βββ evaluateChange.ts # evaluate_change tool
βββ prompts/
β βββ promptBuilder.ts # Markdown formatting utilities
βββ evaluation/
β βββ riskPatterns.ts # Risk assessment patterns
β βββ flagDetectionPatterns.ts # Parent flag detection patterns
βββ knowledge/
β βββ unleashBestPractices.ts # Best practices knowledge base
βββ utils/
βββ errors.ts # Error normalization
βββ streaming.ts # Progress notifications
{code, message, hint} formatEnvironment variables:
UNLEASH_BASE_URL: Your Unleash instance URL (required)UNLEASH_PAT: Personal Access Token (required)UNLEASH_DEFAULT_PROJECT: Default project ID (optional)UNLEASH_DEFAULT_ENVIRONMENT: Default environment (reserved for future use)CLI flags:
--dry-run: Simulate operations without making actual API calls--log-level: Set logging verbosity (debug, info, warn, error)yarn lint
The testing framework (Vitest) is configured but tests are not yet implemented:
yarn test
yarn build
Output will be in the dist/ directory.
wrap_changeGenerates language-specific code snippets and guidance for wrapping code changes with feature flags. This tool helps you implement feature flags correctly by finding existing patterns and matching your codebase's conventions.
When to use:
create_flagParameters:
flagName (required): Feature flag name to wrap the code with
"new-checkout-flow", "stripe-integration"language (optional): Programming language (auto-detected from fileName if not provided)
typescript, javascript, python, go, ruby, php, csharp, java, rustfileName (optional): File name being modified (helps detect language)
"checkout.ts", "payment.py", "handler.go"codeContext (optional): Surrounding code to help detect existing patternsframeworkHint (optional): Framework for specialized templates
"React", "Express", "Django", "Rails", "Spring Boot"What it provides:
Supported Languages & Frameworks:
Example Usage:
{
"flagName": "new-checkout-flow",
"fileName": "checkout.ts",
"frameworkHint": "React"
}
Response:
Returns comprehensive guidance including:
Workflow:
evaluate_change β create_flag β wrap_change
evaluate_change determines if flag is neededcreate_flag creates the flag in Unleashwrap_change generates code to use the flagExample Output Structure:
# Feature Flag Wrapping Guide: "new-checkout-flow"
**Language:** TypeScript
**Framework:** React
## Quick Start
[Recommended pattern with import and usage]
## How to Search for Existing Flag Patterns
[Step-by-step Grep instructions]
## How to Wrap Code with Feature Flag
[Wrapping instructions with examples]
## All Available Templates
[If-block, guard clause, hooks, ternary, etc.]
This server encourages Unleash best practices from the official documentation:
new-checkout-flowenable-ai-recommendations not flag1mobile-push-notificationsThis server uses the Unleash Admin API. For complete API documentation, see:
POST /api/admin/projects/{projectId}/features - Create feature flagError: "UNLEASH_BASE_URL must be a valid URL"
https://app.unleash-hosted.com/instanceError: "UNLEASH_PAT is required"
.env file exists and contains UNLEASH_PAT=...Error: "HTTP_401"
Error: "HTTP_403"
Error: "HTTP_404"
Error: "HTTP_409"
MIT
This is a purpose-driven project with a focused scope. Contributions should:
create_flag toolevaluate_change toolwrap_change toolFAQs
MCP server for managing Unleash feature flags
We found that ul-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago.Β It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Socket CEO Feross Aboukhadijeh joins Software Engineering Daily to discuss modern software supply chain attacks and rising AI-driven security risks.

Security News
GitHub has revoked npm classic tokens for publishing; maintainers must migrate, but OpenJS warns OIDC trusted publishing still has risky gaps for critical projects.

Security News
Rustβs crates.io team is advancing an RFC to add a Security tab that surfaces RustSec vulnerability and unsoundness advisories directly on crate pages.