{ "schema": "varexis-public-evidence-record/0.3", "generated_at_utc": "2026-10-14T01:00:52.414Z", "record_id": "VXI-EXT-TOOL-TRUST-LAUNCHDARKLY-LOCAL-01-v1", "record_kind": "external_reference", "title": "LaunchDarkly MCP: Flag changes and environment scope", "system": "LaunchDarkly MCP", "evidence_family": "agent_tool_trust_review", "index_status": "PUBLIC_SAFE_SOURCE_REVIEW", "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY", "canonical_question": "How can I review a feature-flag agent without granting broad change authority?", "near_questions": [ "How do I limit an agent to reading feature flags?", "Does local MCP hosting stop external API changes?", "Is a read tool filter enough without a read-only token?", "Which environment would a feature-flag change affect?", "Can a flag change alter behaviour without deployment?", "What should I verify before allowing a targeting-rule update?", "Does the hosted connector use the same authentication as local MCP?", "Can tool selection narrow a flag-agent surface?", "What evidence should identify the acting API token role?", "Could configuration files expose agent credentials?", "Can I save a feature-flag permission review?", "When should I recheck a LaunchDarkly local MCP configuration?" ], "supported_claims": [ { "claim": "The local LaunchDarkly MCP uses an API access token. Its documentation recommends both a read-only token role and read scope for a read-only setup, and supports selecting tools. Review the token, environment and enabled operations together; a flag change can affect application behaviour even without a new deployment.", "reliance": "DOCUMENTED_CAPABILITY_ONLY" } ], "not_demonstrated_claims": [ "Verified buyer configuration or effective access rights", "Independent execution, completeness or security testing", "Vendor certification, legal compliance or guaranteed suitability" ], "public_summary": "The local LaunchDarkly MCP uses an API access token. Its documentation recommends both a read-only token role and read scope for a read-only setup, and supports selecting tools. Review the token, environment and enabled operations together; a flag change can affect application behaviour even without a new deployment.", "related_record_ids": [ "VXI-EXT-TOOL-TRUST-WEBFLOW-01-v1", "VXI-EXT-TOOL-TRUST-CANVA-01-v1", "VXI-EXT-TOOL-TRUST-SANITY-01-v1", "VXI-EXT-TOOL-TRUST-NETLIFY-LOCAL-01-v1" ], "source_review": { "source_type": "official_external_documentation", "source_title": "LaunchDarkly local MCP token permissions and tool restrictions", "source_url": "https://launchdarkly.com/docs/home/getting-started/mcp-local", "checked_on": "2026-10-14", "candidate_record_id": "VXI-EXT-TOOL-TRUST-LAUNCHDARKLY-LOCAL-01-v1", "candidate_record_sha256": "5ae4cae94478e694d23d15e0251b5a6db3b28fe905c9e30fb46c01696b299072", "method": "Primary documentation reviewed for the published bounded statement.", "deployment_tested_by_varexis": false, "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research." }, "answer_policy": { "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY", "bounded_answer": "The local LaunchDarkly MCP uses an API access token. Its documentation recommends both a read-only token role and read scope for a read-only setup, and supports selecting tools. Review the token, environment and enabled operations together; a flag change can affect application behaviour even without a new deployment.", "required_buyer_context": "Identify the local server version, token role, environment endpoint, selected tools and whether flag changes are authorised.", "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state." }, "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.", "trust_profile": { "schema": "varexis-agent-tool-trust/1", "identity": { "tool": "LaunchDarkly MCP", "variant": "Local MCP server with API token; hosted OAuth variant excluded" }, "review_status": "documentation_review_only", "checked_on": "2026-10-14", "version_scope": "Dated rolling documentation snapshot; no installed or hosted runtime version independently verified.", "plan_scope": "Buyer plan, entitlement and effective configuration are not verified.", "findings": [ { "field": "operator", "label": "Publisher and operator", "status": "documented", "statement": "LaunchDarkly publishes the MCP; the buyer operates this local variant.", "source_ids": [ "launchdarkly", "launchdarkly-tools" ] }, { "field": "purpose", "label": "Purpose", "status": "documented", "statement": "Use supported LaunchDarkly operations through an assistant.", "source_ids": [ "launchdarkly", "launchdarkly-tools" ] }, { "field": "reads", "label": "Read capability", "status": "documented", "statement": "Retrieves flag and related account context through exposed tools.", "source_ids": [ "launchdarkly", "launchdarkly-tools" ] }, { "field": "writes", "label": "Write capability", "status": "documented", "statement": "Includes feature-flag creation and updates when permitted.", "source_ids": [ "launchdarkly", "launchdarkly-tools" ] }, { "field": "auth", "label": "Authentication", "status": "documented", "statement": "The local server uses a LaunchDarkly API access token.", "source_ids": [ "launchdarkly", "launchdarkly-tools" ] }, { "field": "permissions", "label": "Permission surface", "status": "documented", "statement": "Documentation pairs read scope with a read-only token role and permits tool selection.", "source_ids": [ "launchdarkly", "launchdarkly-tools" ] }, { "field": "egress", "label": "Data leaving the environment", "status": "review_inference", "statement": "Local execution still sends API requests to LaunchDarkly and returns context to the assistant.", "source_ids": [ "launchdarkly", "launchdarkly-tools" ] }, { "field": "failures", "label": "Failure modes to consider", "status": "review_inference", "statement": "Wrong-environment changes or overbroad token permissions can have operational effects.", "source_ids": [ "launchdarkly", "launchdarkly-tools" ] }, { "field": "unknown", "label": "Unknowns and applicability", "status": "unknown", "statement": "The installed version, token grants and actual flag evaluation paths are unverified.", "source_ids": [] }, { "field": "gate", "label": "Suggested refusal or clarification condition", "status": "varexis_review_policy", "statement": "Require an explicit target environment and change approval; do not treat local hosting as read-only authority.", "source_ids": [] } ], "evidence_sources": [ { "source_id": "launchdarkly", "url": "https://launchdarkly.com/docs/home/getting-started/mcp-local", "final_url": "https://launchdarkly.com/docs/home/getting-started/mcp-local", "title": "LaunchDarkly local MCP token permissions and tool restrictions", "checked_on": "2026-10-14", "sha256": "6210d040fd3818f1ebb108999fe2a0fe474e23d8024642dd508229ee16ef3b22", "bytes": 731081 }, { "source_id": "launchdarkly-tools", "url": "https://github.com/launchdarkly/mcp-server", "final_url": "https://github.com/launchdarkly/mcp-server", "title": "LaunchDarkly MCP flag operations and local deployment", "checked_on": "2026-10-14", "sha256": "dbf42cea2650967753f7da45bd6a04f698fbae769fa4cc91118193c2bb6e6863", "bytes": 401839 } ], "observed_tool_execution": false, "policy_basis": "Suggested VAREXIS review gates; apply the buyer's authorized task and policy. These conditions do not execute or enforce controls.", "commercial_reliance_boundary": "A source-linked review aid, not a vendor certification, security clearance or deployment assessment. Unknown does not mean false or unsafe.", "paid_value": { "decision_context": "Save the token, tool and environment evidence used for a flag-agent review.", "free": "Complete review, practical questions, sources and limitations; may be saved locally.", "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.", "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.", "excluded": [ "Fresh vendor research", "Continuous monitoring or change alerts", "Testing the buyer configuration", "Private evidence or vendor certification" ], "integrity": "Hashes identify content versions; they do not prove truth or provide a signature." }, "revalidation": { "trigger": "Recheck when permissions, deployment, authentication, source guidance or intended use changes; a purchase does not trigger revalidation.", "specific_watch": "Recheck token roles, selected tools and deployment variant." }, "change_history": [ { "version": 1, "date": "2026-10-14", "change": "Initial documentation review; no earlier vendor assessment claimed." } ] }, "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.", "service_route": { "request_guide": "/varexis-index/request.html", "request_workflow": "/varexis-index/request-workflow.json", "service_id": "single_request", "service_routes_url": "/varexis-index/service-routes.json", "payment_required": true, "availability_endpoint": "/api/index/capabilities", "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED", "checkout_url": "/index-access" }, "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.", "human_page": "/varexis-index/catalog.html#launchdarkly-mcp-flag-environment-trust", "machine_readable_record": "/varexis-index/records/launchdarkly-mcp-flag-environment-trust.json" }