LaunchDarkly MCP Server

Why it got an A

LaunchDarkly's open-source MCP server (npm @launchdarkly/mcp-server, MIT, TypeScript), generated from its API spec. This grade describes that local server. LaunchDarkly also runs a hosted endpoint at https://mcp.launchdarkly.com/mcp that its own plugin docs describe as OAuth sign-in with no API keys; it is not available in LaunchDarkly's federal or EU environments, where the docs point to the local server, and its internals are not published here, so the hosted endpoint is not graded separately. Tools cover feature flags (create, get, list, update, delete), AI Configs and variations, experiments, metrics, environments, code references and the audit log. Reading is safe; the write tools (for example delete-feature-flag, flag updates and targeting changes) act on your real LaunchDarkly project, and the server adds no confirmation step of its own, so approval depends on your client. Maintenance is strong (commit 2026-11-09, release v0.7.2 on 2026-10-27, five authors in 90 days) with no advisories on record. Biggest deduction: authentication is a LaunchDarkly API access token passed on the command line, and the server mounts write tools by default, so give it a read-only role or start it with --scope read, and keep tool approval on for anything that can change production flags. The README also asks for a patched Node.js (22.23.4, 24.22.1, 26.12.1 or later) after the October 2026 certificate-authority advisory it links.