Feature Flag Hygiene Agent

Name: Feature Flag Hygiene Agent
Availability: InStock
Author: Kata Team

Finds flags that outlived their release — and proposes the cleanup instead of doing it.

Software Development Dev Productivity & Project Ops CI/CD & Release Automation @katateam

Before you connect: what this agent would do

A preview derived from this agent’s definition — not a live run. Nothing runs and no key is sent until you connect. FindAgent runs it on the hosted connection.

Tools it can use (4)

list_flagsRead-only
List the feature flags in a project with their kind, creation date, and archive state.
Reaches: app.launchdarkly.com
Uses your LaunchDarkly API access token.
get_flag_statusRead-only
Fetch when a flag was last evaluated and whether it has been serving one value to everyone.
Reaches: app.launchdarkly.com
Uses your LaunchDarkly API access token.
search_flag_in_codeRead-only
Search the repository for a flag key, to find every file that still branches on it.
Reaches: api.github.com
Uses your GitHub token.
open_cleanup_issueCan change data
Open a GitHub issue proposing the removal, with the flag's state, evidence, and every referencing file.
Reaches: api.github.com
Uses your GitHub token.

Credentials it will ask for (2)

LaunchDarkly API access token
Only ever sent to: app.launchdarkly.com
Format: Enter the full authorization value, including any scheme word (e.g. “token ghp_…”).
GitHub token
Only ever sent to: api.github.com

Safety rails that guard it

Every result is scanned for leaked secrets and prompt-injection before it reaches you — a check no agent can turn off.
These personal details are removed from your input before the agent sees them: Credit card, IBAN, National ID.
A request larger than 120,000 characters is rejected before it runs.
list_flagsRate limited to 120/hour.Safe to retry automatically if a run is interrupted.
get_flag_statusRate limited to 600/hour.Safe to retry automatically if a run is interrupted.
open_cleanup_issueSensitive — it is flagged and needs an explicit confirmation before it runs.Rate limited to 20/hour.Runs only after search_flag_in_code has run first.
search_flag_in_codeRate limited to 300/hour.Safe to retry automatically if a run is interrupted.

How FindAgent keeps agents safe

Run locally

This MCP server runs on your own machine — FindAgent only points you at it. Run the command below, then add it to your MCP client. Nothing is hosted or proxied on our side.

terminal

npx -y @findagent/mcp run

Add it to your MCP client

Paste this into your client config (e.g. claude_desktop_config.json or a Cursor mcp.json), then restart the client.

mcp client config

{
  "mcpServers": {
    "feature-flag-hygiene-agent": {
      "command": "npx",
      "args": [
        "-y",
        "@findagent/mcp",
        "run"
      ]
    }
  }
}

What you'll need — and where to get it

This agent will ask you for the following. You enter them when you connect — they're encrypted and never shared with the creator.

LaunchDarkly API access token
The complete Authorization value: LaunchDarkly sends the API access token verbatim with no prefix, so paste the token itself (api-xxxxxxxx). A READER-role token is enough — this agent never archives or edits a flag.
Get this from app.launchdarkly.com's account or API settings.
Paste the value as a single line.
Only sent to: app.launchdarkly.com
GitHub token
A fine-grained personal access token with Contents: read, Issues: read and write, and Metadata: read. It does not need write access to code.
Create a personal access token in GitHub (Settings → Developer settings → Personal access tokens) scoped to what the agent needs.
Paste the value as a single line.
Only sent to: api.github.com

Requirements

This server requires authentication — see the description for how to get a key.

Get this agent

Free

Add the hosted gateway to Claude, ChatGPT, Cursor or any MCP client. Nothing installs on your machine.

https://mcp.findagent.cloud/agents/feature-flag-hygiene-agent

View setup

What we can prove

Ships no executable code. FindAgent’s trusted runtime performs only the actions this agent declares — nothing it wrote runs on your machine or ours.
Any key you connect is bound to its destination — it is only ever sent to app.launchdarkly.com, api.github.com, and is dropped if a request tries to redirect it elsewhere.
Every result is scanned for leaked secrets and prompt-injection before it reaches you — a check no listing can turn off.
Some tools can create, change, or delete data in your connected accounts — your AI client asks you to confirm before a change runs.
Passed an automated security scan and a human review before it could be published.

These are facts derived from the manifest, not a score and not a badge.

Agent details