GrowthBook MCP Server

Official

Official GrowthBook MCP server: skill loader + authenticated API passthrough

How to install ↓ Compare GitHub source repository ↗

Category: Dev Tools #121 of 438
Stars: ★ 24 Popular
Transport: stdio (local process) · Streamable HTTP
Runtime: Node.js · Docker
Credentials: API key / credential required
License: MIT
Last commit: 14 days ago
Tools: 3

60FMRS · C

An officially maintained, deliberately thin GrowthBook MCP server: skills are bundled at build time and capability is a single generic API passthrough, with a uniform tool prefix to avoid ambiguity across multiple MCP servers. HTTP mode's OAuth and token-refresh handling is well thought out. Best for existing GrowthBook teams, but mutating calls rely on soft confirmation, so grant credentials carefully.

Strongest · Documentation 16/20 Weakest · Reliability 9/20

Reliability

9/20

Security and permissions

9/20

Maintenance

13/20

Documentation

16/20

Setup experience

13/20

Why each score

Reliability 9/20: The README describes three tools (growthbook_list_skills, growthbook_read_skill, growthbook_call_api) with behavior consistent with the manifest, and the manifest version (2.1.0) matches the package version, showing internal consistency. However, no CI workflow files or committed tests are present in the reviewed material to serve as verifiable execution evidence, and the build pipeline depends on a sibling ../skills checkout (or SKILLS_SRC env var) to run bundle-skills — an unverified external dependency that would break the build if absent. Per the static calibration rule, reliability is capped at 12 without verifiable execution evidence; scored 9 after further deduction for the unverified build dependency.
Security and permissions 9/20: GB_API_KEY is correctly marked required and secret; HTTP mode includes OAuth protected-resource metadata, bearer validation, and a sensible default bind to 127.0.0.1, showing some least-exposure design. However, the core tool growthbook_call_api is a generic, unrestricted REST passthrough supporting POST/PUT/PATCH/DELETE — side-effecting and potentially irreversible operations — and the README explicitly states its confirmation mechanism is 'soft guidance, not a hard gate' embedded in the tool description rather than enforced in code, meaning any agent that disregards the prompt could execute destructive operations like DELETE without confirmation. This is a real permission/confirmation gap that prevents a high score. GB_HTTP_HEADER_* also allows arbitrary custom headers, adding some data-flow opacity. Scored 9 (not red-line level, since the limitation is disclosed transparently and there is no evidence of a default no-confirmation destructive action or credential exfiltration).
Maintenance 13/20: The repo uses the MIT license, is not archived, and documents a disciplined release process (tag-triggered multi-arch Docker images, npm publishing, GitHub Releases, MCP registry entries), indicating reasonable release governance. However, 23 stars against 21 open issues is a relatively high issue-to-star ratio, and there is no direct evidence of commit cadence, issue response time, or dependency-update practices, which limits the score given this uncertainty.
Documentation 16/20: The README is well-layered, covering install, an environment-variable table, both stdio and HTTP run modes, the OAuth flow, capability-only mode, tool parameter examples, development prerequisites, and the release process, with concrete command examples throughout. It falls short on rate-limit and cost implications, which are only briefly mentioned, and troubleshooting coverage is limited mainly to auth-failure scenarios rather than a comprehensive guide, so it does not receive full marks.
Setup experience 13/20: Documentation provides multiple clear install paths — npx, a Docker image, or local npm install && npm run build — with JSON client config examples for both stdio and HTTP modes, covering mainstream client setups. However, the local source build depends on a sibling ../skills checkout or the SKILLS_SRC env var, a hidden runtime prerequisite that adds complexity and potential failure points for anyone building from source. Since static review caps setup at 15 absent verifiable execution evidence, and given this build-dependency fragility, scored 13.

Static review · not runListed 2026-09-07

Read the FMRS scoring method →

Fit and risk

What it can accessUses the networkChanges third-party account data

Best for

Teams already using GrowthBook who want agents to manage flags and experiments
MCP users who want an authenticated, auditable API passthrough
Operators of self-hosted instances

Not for

Users without GrowthBook
Read-only browsing without a GrowthBook API key
Environments that cannot tolerate agent-driven mutating API calls

Required permissions

GB_API_KEY: a GrowthBook API key or personal access token (required, secret)
GB_API_URL: API base URL (optional, defaults to https://api.growthbook.io)
GB_HTTP_HEADER_*: extra request headers (e.g. Cloudflare Access tokens)

Risks and side effects

growthbook_call_api is a generic passthrough; POST/PUT/PATCH/DELETE can mutate data, and the confirm-with-user rule is soft guidance, not a hard gate
The API key is a sensitive credential that can act on the whole account if leaked
HTTP mode should run on a trusted network or loopback; multi-tenant or public deployments should be fronted by your own gateway/auth

Setup

Before you start

Runtime：Node.js · Docker

GB_API_KEY requiredsecret GrowthBook API key or personal access token, generated in your GrowthBook account settings; required for stdio mode.

Other optional settings (7)

GB_API_URL optional GrowthBook API base URL, defaults to https://api.growthbook.io; change it for self-hosted instances.

GB_SKILLS_ENABLED optional Set to false/0 to disable the bundled skill tools (growthbook_list_skills, growthbook_read_skill); enabled by default.

GB_MCP_TRANSPORT optional Transport mode, stdio or http; defaults to stdio.

GB_MCP_PORT optional HTTP mode listen port, defaults to 3333.

GB_MCP_HOST optional HTTP mode bind host, defaults to 127.0.0.1.

GB_MCP_URL optional Public base URL of the server in HTTP mode, stamped into OAuth resource metadata; the server refuses to start without it.

GB_OAUTH_ISSUER optional GrowthBook OAuth authorization server issuer URL; defaults to GB_API_URL.

Install and build with npm (npm install && npm run build), then point your MCP client at the compiled server/index.js, or run the published package via npx @growthbook/mcp. GB_API_KEY (a GrowthBook API key or personal access token) is required; GB_API_URL is optional (defaults to https://api.growthbook.io). Building from source requires a sibling ../skills checkout or SKILLS_SRC. A multi-arch image is also available at ghcr.io/growthbook/growthbook-mcp.

MCP config · JSON

{
  "mcpServers": {
    "growthbook": {
      "command": "npx",
      "args": [
        "@growthbook/mcp"
      ],
      "env": {
        "GB_API_KEY": "your_api_key_or_pat",
        "GB_API_URL": "https://api.growthbook.io"
      }
    }
  }
}

Works in clients that read an "mcpServers" key. For clients such as VS Code that use a different key, the configurator below converts it.

.vscode/mcp.json

{
  "servers": {
    "growthbook": {
      "command": "npx",
      "args": [
        "@growthbook/mcp"
      ],
      "env": {
        "GB_API_KEY": "your_api_key_or_pat",
        "GB_API_URL": "https://api.growthbook.io"
      }
    }
  }
}

Goes in your project's .vscode/mcp.json (VS Code uses a "servers" key).

Terminal

claude mcp add growthbook -e GB_API_KEY=your_api_key_or_pat -e GB_API_URL=https://api.growthbook.io -- npx @growthbook/mcp

Run it in a terminal; replace any <…> placeholders with your own values first.

Generate and validate client config

Check that it works

The client's tool list should show growthbook_list_skills, growthbook_read_skill, and growthbook_call_api; ask the agent to call growthbook_call_api with GET /api/v1/projects — returning project data confirms the connection and auth work.

Troubleshooting

401 invalid_token: check that GB_API_KEY is valid; in HTTP mode the client should refresh the token
403 means the token was accepted but permissions are insufficient — not an invalid token
404 on self-hosted instances: verify GB_API_URL points to the right address
Server refuses to start in HTTP mode: GB_MCP_URL must be set
Skill tools missing: check whether GB_SKILLS_ENABLED is set to false/0

Things to try

Once connected, you can ask your AI assistant things like:

List the available GrowthBook agent skills.
Read the skill for creating feature flags, then follow its steps to create a flag named my-flag.
Call the GrowthBook API to list all projects at /api/v1/projects.
Create an experiment in my project and show me the existing experiments.

Tools 3

growthbook_list_skills read-only

List bundled GrowthBook agent skills (name + description)

growthbook_read_skill read-only

Return the full skill markdown (workflow + guardrails)

growthbook_call_api writes

Authenticated REST passthrough to the GrowthBook API, supporting GET/POST/PUT/PATCH/DELETE

Use cases

Creating and managing feature flags through an AI agent

Fetching experiments and project data

Having agents follow workflows and guardrails from official skills

Remote MCP access to a self-hosted GrowthBook instance (HTTP + OAuth mode)

Overview

The official, lightweight MCP server for GrowthBook. It exposes three tools: listing and reading bundled GrowthBook agent skills (bundled at build time from the official skills repo), and a generic growthbook_call_api tool that passes authenticated REST calls through to the GrowthBook API (creating flags, getting experiments, and more). It supports stdio and an HTTP transport with OAuth 2.0 protected-resource metadata (RFC 9728 / RFC 6750), and skill tools can be disabled to expose capability-only mode.

Similar servers

Context7 80 · B

Upstash's official server providing up-to-date third-party library docs for AI coding assistants

★ 63.3k · Tools 2 Compare with this →

NPM Sentinel MCP Server 79 · B

AI-powered NPM package analysis MCP server

★ 18 · Tools 19 Compare with this →

MartinLoop MCP Server 79 · B

An independent control layer that gives AI coding agents budgets, brakes, and receipts

★ 413 Compare with this →

GitHub MCP Server 76 · B

GitHub's official MCP server for managing repos, issues, PRs, and workflows via natural language

★ 33.7k · Tools 15 Compare with this →

Compare with other MCP servers

Source revision 847741aa5fd9 Data synced 2026-10-19 Read the FMRS scoring method