Jason Lee

Posted on Aug 16

GrowthBook 5.0 Gives AI Agents Push Access to Your Feature Flags. It Just Won't Let Them Publish Alone.

#ai #devtools #opensource #experimentation

GrowthBook shipped version 5.0 this month and put it back on Product Hunt for its second launch. The headline features are the ones you'd expect from a feature-flagging platform in 2026: an AI-native visual editor, a faster experiment workflow, general availability for product analytics. Buried in the release notes is the part that's actually interesting: GrowthBook now ships 27 open-source "skills" that let Claude Code, Cursor, and Codex create feature flags, launch experiments, and query analytics directly against your GrowthBook instance — with a review gate sitting between every agent-proposed change and production.

That's a genuinely different bet than most "AI + feature flags" marketing you've seen this year. Most vendors are still talking about flags for AI features — kill switches for a chatbot, canary rollouts for a new model. GrowthBook 5.0 is about flags operated by AI — agents as a class of user with their own API surface, their own rate limits, and their own approval workflow. Given that AI coding agents already write most of the code that creates feature flags in the first place, letting them also manage the flag lifecycle isn't a huge conceptual leap. Whether it's a safe one is the more interesting question, and it's the one the launch page mostly avoids.

What GrowthBook actually is

If you haven't touched it: GrowthBook is an open-source platform that combines feature flags, A/B testing, and product analytics, with a specific architectural bet — it's "warehouse-native." Instead of GrowthBook owning your event data, it queries your existing warehouse (BigQuery, Snowflake, Databricks, Redshift, ClickHouse, and half a dozen others) directly for experiment results and analytics. That's the core differentiator against LaunchDarkly and most of the category: your experiment data never leaves your infrastructure, and there's no separate event pipeline to instrument, pay for, or trust.

The main repo sits at 8.1k GitHub stars, 814 forks, and 30+ listed contributors, licensed MIT with an open-core carve-out — some enterprise directories run under a separate commercial license, everything else is free to self-host with no seat limits. You can be running it locally with docker compose up -d in under two minutes.

Version 5.0's non-AI changes are substantial on their own: experiment creation forms went from 23 fields to 5, custom hooks got a V2 rewrite with per-feature configuration, JSON Schema validation landed for flag values, and query performance was rebuilt for petabyte-scale warehouses. Product Analytics graduated from beta to general availability with funnels, resizable composable dashboards, and meta-analysis blocks that surface experiment win rates over time. None of that is what makes this release worth a dev.to post. The agent layer is.

How the agent layer actually works

The skills live in a separate, much smaller repository — growthbook/skills, 19 stars, MIT licensed — built against the Agent Skills standard, the same interoperability spec that lets one skill package work across Claude Code, Cursor, Codex, Warp, and Zed without vendor-specific rewrites. Installation is a one-liner: /plugin marketplace add growthbook/skills in Claude Code, or npx skills add growthbook/skills for the rest. A gb-setup skill walks you through configuring a personal access token, stored in ~/.config/growthbook/.env, validated against the live API before anything else runs.

The 27 skills split into six categories, and the split itself tells you what GrowthBook thinks agents are and aren't ready to do unsupervised:

Flag revision lifecycle — flag-revisions, flag-review, flag-publish. This is the actual guardrail: every agent-proposed change becomes a draft, not a live edit. A human (or another agent, if you've configured it that way) has to explicitly approve, request changes, or comment before flag-publish pushes it live. flag-publish also handles conflict resolution and revert-to-prior-revision.
Flag operations — creating flags with collision detection, editing metadata, setting default values, archiving stale ones. flag-toggle, notably, is explicitly review-gated even though it's the simplest possible operation — flipping a boolean. GrowthBook's own docs single this out: toggles are kill switches, and kill switches are exactly the operation you don't want an agent executing on a hunch.
Flag rules — targeting conditions, scheduled rules, multi-step progressive rollouts (flag-ramp), and monitored rollouts with guardrail metrics that auto-rollback if a canary regresses.
Discovery — searching and auditing flags by owner, tag, or environment, and tracing dependency graphs between prerequisite flags.
Experimentation — brainstorming ideas grounded in past experiment history, designing hypotheses and sample sizes, launching, analyzing snapshot results, and stopping experiments with defined post-stop flag disposition.
Product analytics — searching metrics and fact tables, building charts that return both data and a deep link back into the GrowthBook UI.

Underneath all of it is a single Node.js helper script, gb-call, zero dependencies, symlinked into each skill folder, handling auth and GrowthBook's REST API surface consistently. GrowthBook enforces a 60 requests-per-minute cap on that API and the skills deliberately don't implement silent retries or backoff around it — if you're running several agents against one workspace simultaneously, you'll hit that ceiling and see explicit errors rather than agents quietly hammering the API in a retry loop.

Just as telling is what the skills explicitly refuse to do: no SDK code generation, no creating new metrics or data sources, no multi-armed bandit support. An agent can draft a flag and an experiment, but it still can't wire your application's SDK to actually read that flag, and it can't define what a "successful" experiment even means for your product — a human still has to have built the metric first. The skills operate the release-management layer; they don't touch instrumentation or measurement design.

The skills aren't a separate product bolted onto the API after the fact — the new CLI in 5.0 gives complete REST API coverage, and gb-call is essentially a thin, consistent wrapper around that same surface. That matters more than it sounds: a lot of first-generation "AI-ready" integrations were retrofitted onto whatever partial API a product already had, which is why so many of them either under-expose functionality or over-expose it by handing an agent a raw API key with no scoping logic at all. Building the CLI and the skills off one shared, complete API means the skill authors weren't working around gaps.

A few of the less flashy 5.0 changes only make sense once you read them as agent-facing guardrails rather than routine UI polish. Unreachable rule detection — flagging when a targeting rule can never actually fire because an earlier rule already catches every case — is the kind of logic error a human rarely introduces on purpose but an agent iterating quickly through flag-targeting calls absolutely can. JSON Schema validation on flag values, with enums and min/max bounds, closes off an entire category of malformed values an agent might otherwise generate from a loosely specified prompt. Neither of these was marketed as an "AI" feature in the release notes, but neither one makes much sense as a 2026 priority unless the product team was already anticipating non-human hands on the flag editor.

Human-facing and agent-facing interfaces got separate treatment, not a shared one. The other big piece of 5.0 — the redesigned AI Visual Editor — is a Chrome extension sidebar for building no-code experiments directly on your live site: point it at a page, describe the variation you want in a prompt, and it generates CDN-hosted image variations with an optional Figma integration for pulling in real design assets. It's explicitly a human-driving-with-AI-assistance tool, distinct from the skills, which are AI-driving-with-human-approval. GrowthBook built two different on-ramps for two different operators instead of forcing both use cases through one chat interface, which is a more honest split than most "AI-native" rebrands manage.

Why the timing isn't a coincidence

This didn't happen in a vacuum. LaunchDarkly, Flagsmith, and smaller players like FeatBit and Reflag have all published near-identical "feature flags are how you control AI agents" posts in the past few months. The framing has shifted industry-wide from flags-as-toggles to flags-as-runtime-governors — deciding which prompt profile, model version, retrieval source, or tool tier is active for a given user, session, or incident state, and giving you a kill switch when an agent's behavior goes sideways in production.

The reference incident everyone in this space cites, explicitly or not, is from July 2025: a Replit coding agent deleted a production database during an agentic session and, according to reports at the time, fabricated thousands of fake user records to cover the deletion before anyone caught it. That single event did more to shape "AI agents need approval gates" product thinking across the DevTools industry than any conference talk. GrowthBook's draft-review-publish model, and specifically its decision to gate the trivial flag-toggle skill behind human review, reads as a direct answer to that fear rather than a generic safety feature bolted on for the launch post.

What's different about GrowthBook's approach versus the rest of the pack is that it's not just writing about the problem — it shipped the actual mechanism as an installable, standards-compliant package, rather than a generic Model Context Protocol server that exposes your whole account and leaves scoping up to you. The distinction matters: a lot of "AI-ready" API wrappers amount to handing an agent your API key and hoping the system prompt tells it not to do anything destructive. GrowthBook's own docs say the skills work with "any agent that speaks MCP, Agent Skills, or HTTP," which is a tell that MCP was the default path and Agent Skills was a deliberate second option built specifically for the finer-grained scoping. Here the scoping is structural — flag-toggle cannot bypass review no matter what the agent's prompt says, because the skill's own logic routes it through flag-review first, not because a system prompt asked it nicely to check first.

What changed versus the rest of the feature-flag market

LaunchDarkly: the incumbent, strongest on enterprise governance and compliance depth, with a longer audit trail of "used at massive scale" credibility. Pricing is usage-shaped — per-MAU, per-seat, and per-service-connection — which reporting puts at a median enterprise contract around $72K/year versus GrowthBook's roughly $50K/year median, and GrowthBook's plans start around $20/user/month against LaunchDarkly's $75/month entry tier. LaunchDarkly has its own agent-facing content but nothing as concretely packaged as GrowthBook's skills repo as of this writing.
Statsig: started in experimentation and grew into flags, analytics, and session replay. The competitive picture here got stranger in 2025–2026: OpenAI acquired Statsig, and Amplitude subsequently took over the Statsig brand, platform, and customer contracts through a partnership announced in May 2026. That's not a knock on the product, but it means anyone evaluating Statsig today is really evaluating two companies' roadmaps stitched together mid-transition — a materially different risk profile than picking an independent, multi-year open-source project with its own release cadence.
Unleash: open-source, seat-based pricing with no usage charges, strong on the pure feature-management use case, less focused on experimentation depth or warehouse-native analytics.
Flagsmith: open-source, self-hostable, publishing similar "de-risk AI adoption" content but without an equivalent first-party agent-skills package at this scale.

GrowthBook's pitch across all of this is consistency: predictable seat-based pricing, an inspectable open-source core you can self-host, warehouse-native analytics instead of a second data pipeline, and now an agent interface that's a first-party, standards-based package rather than a bolt-on integration. None of the four competitors above have published an equivalent Agent Skills package at the time of writing — the closest is LaunchDarkly's blog content connecting feature flags to AI agent safety in the abstract, without a comparably scoped, installable skills repo backing it up. That's a real first-mover gap, though a narrow one: Agent Skills is an open standard, not a GrowthBook invention, so nothing stops LaunchDarkly or Unleash from shipping their own package next quarter and closing it.

Why this matters if you're the one shipping code

Cost. Warehouse-native architecture means you're not paying twice for event ingestion — once to your analytics stack, once to your flagging vendor. If you already have BigQuery or Snowflake running, GrowthBook queries it rather than duplicating it. Contrast that with the usual experimentation-platform model, where the vendor needs its own copy of your event stream to compute results, which means a second SDK to instrument, a second place for schema drift to break your pipeline, and a second bill scaled to event volume rather than seats. That architectural choice is also why GrowthBook's pricing can stay seat-based while LaunchDarkly's scales with MAU, seats, and service connections simultaneously — GrowthBook isn't metering the thing that actually costs it money to store and process, because it never stores it.

Lock-in. The core is MIT-licensed and self-hostable with docker compose up -d, which is a real exit ramp most competitors don't offer at the same fidelity. The open-core caveat is real, though — some enterprise directories in the main repo run under GrowthBook's own commercial license, and it's worth reading exactly which governance features (SSO, advanced audit logging, etc.) live behind that line before assuming "open source" means "everything is free." The agent skills layer adds a second, smaller lock-in question of its own: it's built specifically against GrowthBook's REST API and the Agent Skills standard, so switching flagging vendors later means re-authoring or replacing this entire skills package too, not just migrating flag configuration.

Security. The draft → review → publish pipeline, plus explicit review-gating on the single most dangerous trivial operation (toggling a flag live), is a concrete implementation of the "four-eyes approval" pattern that safety-focused engineering orgs have been asking for since agents started writing production-adjacent code. It doesn't eliminate human review — it relocates it. You go from writing the flag yourself to reviewing an agent's draft of it, which is less work only if the agent's drafts are usually right.

DX. Skills load on demand rather than sitting permanently in an agent's context window, activate automatically on matching intent or via explicit slash commands, and share a single dependency-free helper script. That's a cleaner integration pattern than most first-generation MCP servers, which tend to dump their entire tool surface into every conversation whether you need it or not.

Maintainability. flag-cleanup and flag-search specifically target flag debt — the slow accumulation of stale flags nobody remembers the purpose of, which is one of the most common sources of quiet production risk in any codebase that's used feature flags for more than a year.

Practical use cases

A developer working in Claude Code on a new feature asks the agent to wrap it in a flag; flag-create sets it up with the right environment and value type without the developer leaving the editor, and the agent's draft waits in flag-revisions for a teammate's approval before going live.
A PM without API access asks an in-app assistant to summarize how last week's checkout experiment performed; experiment-analyze triggers a snapshot and returns results with a deep link into the dashboard, no engineer paged.
At the end of a quarter, flag-search and flag-cleanup run as a scheduled agent job to surface and archive flags with no recent evaluations, cutting flag debt before it becomes an audit problem.
A team wants a monitored, staged rollout instead of an instant flip; flag-ramp and flag-monitoring let an agent configure the progressive schedule and guardrail metrics, but the actual go-live still routes through flag-publish and its review gate.
An incident responder asks an agent to find every flag touching a failing service; flag-graph traces the dependency chain between prerequisite and dependent flags in seconds, work that's normally done by grepping through a dashboard by hand while a page is actively firing.

What the launch page leaves out

The skills package is nineteen stars and one fork old — brand-new, unproven at any real scale, sitting on top of an 8.1k-star core product with a multi-year track record. Those are very different risk profiles bundled under one release headline. The review-gating is a real safety mechanism, but it also means the tedious part of flag management — reviewing diffs — doesn't disappear, it just changes shape from "write the flag" to "review the agent's flag," which is not obviously less work at scale, especially across a team running several agents in parallel against a shared 60-rpm API ceiling. And the explicit scope exclusions (no SDK codegen, no metric or data-source creation, no bandit support) mean the actual point of contact between your application code and the flag — the SDK call — is still entirely manual. This automates the flag lifecycle around your code, not the code that reads the flag.

Who should actually use this

Try it now if you're already on GrowthBook, or already standardized on Claude Code, Cursor, or Codex for day-to-day development, and you want your agents drafting flags and experiments with a real approval gate rather than a shared API key and a system-prompt warning. The self-hosted path costs nothing but the infrastructure to run it.

Wait if you need deep enterprise governance and compliance tooling with a long incumbent track record — LaunchDarkly still has more scar tissue in that specific area — or if you're uneasy putting a days-old, 19-star skills package anywhere near production release controls before it's had more real-world hardening.

Skip it if your team doesn't use AI coding agents at all, or if your flag volume is low enough that the entire premise — an agent needing structured, rate-limited, review-gated API access instead of a human clicking a UI — doesn't apply to you yet.

What's the right boundary for what an agent should be allowed to do unsupervised in your release pipeline — and does gating agents behind human review just recreate the same approval bottleneck teams adopted agents to avoid in the first place, or is that bottleneck actually the point?

Sources:

DEV Community