- Read and manage LaunchDarkly feature flags, experiments, and guarded rollouts through the LaunchDarkly hosted Model Context Protocol (MCP) server
- Trigger Kiro CLI headless through GitHub Actions to implement a flagged code change and open a pull request
- Review the pull request for release readiness
- Merge the pull request and trigger deployment through GitHub Actions workflows it dispatches
Prerequisites
To complete this guide, you must have the following:- A LaunchDarkly account. Sign up through AWS Marketplace for a 30-day free trial, or sign up at launchdarkly.com.
- An AWS account with access to AWS DevOps Agent. Region availability applies. For more information, read Getting started with AWS DevOps Agent.
- A GitHub user or organization account with admin permissions and authorization to install GitHub Apps.
- A target repository that contains the application you want to experiment on.
- A Kiro subscription that permits API key generation: Pro, Pro+, Pro Max, or Power. When your Kiro account is centrally administered, ask your Kiro administrator to enable API key generation first.
Guarded rollouts are available to customers on select plansGuarded rollouts require an Enterprise plan with the Guardian add-on. All accounts include a limited trial. To learn more, read Guarded rollouts.Experimentation is available on every plan. Without guarded rollouts, you can still run experiments and view reports, but you must roll out the winning variation manually.
Concepts
This topic explains how the connected tools work together, how registration and Agent Spaces relate, and the principle that the agent follows.How the pieces fit together
In this guide, “the agent” means AWS DevOps Agent, including the custom agent that you create in Step 7. The integration connects five parts:- AWS DevOps Agent: Connects to LaunchDarkly and GitHub, hosts the custom agent, and reviews pull requests for release readiness.
- LaunchDarkly hosted MCP server: Gives the agent tools to query flag state, read targeting rules, list flags, manage experiments, and drive guarded rollouts.
- GitHub and GitHub Actions: Hold your repository and run the workflows that the agent dispatches to implement, merge, and deploy changes.
- Kiro CLI: Implements the code change inside a GitHub-hosted runner. The CLI runs headless, without an interactive session.
- Orchestration skill: Holds the instructions for the lifecycle. You attach the skill and the LaunchDarkly MCP tools to a custom agent, which runs the lifecycle from goal to report.
Account-level registration and Agent Spaces
You register LaunchDarkly and GitHub with AWS DevOps Agent once per AWS account, and all Agent Spaces in that account share each registration. An Agent Space is the workspace where the agent works with the connected tools. It’s also the workspace where you start chat sessions. You attach a registration to your Agent Space because the agent requires it to use the registration.Experiments and guarded rollouts
The agent always runs an experiment before it starts a guarded rollout. The experiment confirms that a change works on a small slice of traffic, and the guarded rollout then expands the change gradually. Here are the details of each configuration:- Experiment: Compares a treatment against a control on a primary metric, with guardrail metrics that watch for harm. The agent uses one primary metric and a fixed 50/50 split across 10% of traffic.
- Guarded rollout: Progressively increases traffic to the winning variation while LaunchDarkly monitors the same metrics for regressions. The agent configures each metric to roll back automatically on a regression.
Step 1: Enable AWS DevOps Agent and create an Agent Space
The Agent Space is the workspace where you attach the LaunchDarkly MCP server and the GitHub repository that the agent works with. You also start the chat sessions that validate each connection there.- Follow the instructions in Getting started with AWS DevOps Agent to enable the agent and create the space.
- Turn on Enable DevOps Agent Actions in the Agent Actions section. The agent requires Agent Actions for write operations, such as updating a flag. With Agent Actions on, the agent asks a person to approve each write operation before it runs, including LaunchDarkly MCP write calls. Without Agent Actions, write operations fail. If you skip this when you create the space, turn it on later from the Agent Space’s Configuration tab.
- Under Service role for agent actions, choose how to set up the AWS Identity and Access Management (IAM) role that the agent uses for write actions. To have AWS DevOps Agent create the role for you, select Auto-create a new DevOps Agent Actions role.
Step 2: Connect the LaunchDarkly MCP server
Register the LaunchDarkly hosted MCP server with AWS DevOps Agent and attach it to your Agent Space. This gives the agent the ability to query flag state, read targeting rules, list flags, manage experiments, and drive guarded rollouts.Step 2.1: Register the LaunchDarkly MCP server at the account level
You register an MCP server once per AWS account, and all Agent Spaces in that account share it. To register the LaunchDarkly MCP server with AWS DevOps Agent:- Sign in to the AWS DevOps Agent console.
- In the side navigation, open Capability Providers.
- Under Available, find MCP Server and click Register.
-
Enter the server details:
- Name:
LaunchDarkly - Endpoint URL:
https://mcp.launchdarkly.com/mcp/launchdarkly - Description:
LaunchDarkly feature flag management MCP server - Check Enable Dynamic Client Registration. This lets AWS DevOps Agent register itself with the LaunchDarkly authorization server using OAuth.
- Name:
- Click Next.
Every Agent Space acts as the member who authorized the connectionThe LaunchDarkly MCP server acts with the permissions of the LaunchDarkly member who authorizes the connection. All Agent Spaces that use this registration share that one connection. We recommend that you authorize with a dedicated LaunchDarkly member for the integration instead of an individual’s account. Give that member a role that grants access to the flags, metrics, experiments, and guarded rollouts in the projects the agent works with. To learn more, read Member role concepts.
Step 2.2: Add the MCP server to your Agent Space
After you register the LaunchDarkly MCP server at the account level, attach it to your Agent Space to allow the agent to use its tools. To add the server to your Agent Space and choose which tools the agent can use:- In the AWS DevOps Agent console, select your Agent Space.
- Select the Capabilities tab.
- Under MCP Servers, click Add.
- Select the LaunchDarkly MCP server that you registered.
-
Select a tool access option:
- Allow all tools: Gives the agent every LaunchDarkly MCP tool.
- Select specific tools: Limits the agent to the tools you select. We recommend this option for production.
-
Under Webhook authentication type, select API Key. AWS DevOps Agent expects each webhook event to include the key as a bearer token in the
Authorizationheader. - Click Save. The console confirms that it created the association and shows the Webhook URL and API Key under Webhook Configuration.
- Record the webhook URL and API key. AWS DevOps Agent shows the API key only once. Record it before you leave the page. We recommend that you store the API key securely and never commit it to version control. If you lose the API key, rotate the webhook from the Capabilities tab to generate a new one. To learn more, read Invoking DevOps Agent through Webhook.
-
(Optional) Create a webhook in LaunchDarkly that automatically opens an AWS DevOps Agent investigation when LaunchDarkly events occur. The agent uses a separate OAuth connection to call LaunchDarkly MCP tools. To learn more, read Webhooks. When you create the webhook:
- Enter the URL you recorded as the webhook URL.
-
Add the following request header:
Step 2.3: Validate the LaunchDarkly connection
To confirm that your Agent Space can reach LaunchDarkly, start a new chat or investigation session in the Agent Space and ask:
“List the feature flags in the YOUR-PROJECT-KEY project in the production environment.”
When the agent returns flag data, the connection is live.
Step 3: Connect GitHub to AWS DevOps Agent
Connecting GitHub gives AWS DevOps Agent access to the target repository for reading code, running release readiness review, and dispatching workflows. GitHub Actions handles execution. Kiro CLI runs headless inside a GitHub-hosted runner, and the agent dispatches the workflow that runs it through the same native GitHub integration. Because GitHub holds the state and the workflow run is the task record, this configuration needs no container and no state store. GitHub permissions cover every capability the lifecycle needs:- Implement a change behind a flag or trigger deployment: Dispatch workflows, which requires
workflows: write. - Check implementation or deployment progress: Read workflow runs, which requires
actions: read.
Step 3.1: Register GitHub at the account level
You register GitHub once per AWS account, and all Agent Spaces in that account share the registration. To register GitHub at the account level and install the AWS DevOps Agent GitHub App on your target repository:- Sign in to the AWS DevOps Agent console.
- Select the Capabilities tab.
- Under Pipeline, click Add.
- Select GitHub from the list of providers.
- Select User or Organization, depending on the type of GitHub account you’re connecting.
- For an organization, enter the organization name exactly as it appears in GitHub. You must authorize and install the app on that same organization.
-
Under GitHub App permissions, select Read & Write.
The GitHub App requires Read & Write permissionsThe agent must have
workflows: writeto dispatch the implementation and deployment workflows,contents: writeto push Kiro’s branch, andpull-requests: writeto act on pull requests. With read-only access, the agent can review code but cannot trigger anything. - Click Submit. GitHub redirects you to sign in and authorize AWS DevOps Agent.
-
On the Install & Authorize page, select Only select repositories.
Install on the target repository onlyInstall the app only on a specific target repository, not on all repositories. This is the outermost boundary on what the agent can reach, and GitHub enforces it rather than your own configuration.
- Select your target repository.
- Click Install & Authorize.
Step 3.2: Connect the repository to your Agent Space
To make the target repository available to your Agent Space:- In the AWS DevOps Agent console, select your Agent Space.
- Select the Capabilities tab.
- Under Pipeline, click Add.
- Select GitHub.
- Select the registration that you created in Step 3.1.
- Select your target repository.
- Click Add.
Step 3.3: Confirm release readiness review is enabled
When you connect a repository, AWS DevOps Agent automatically adds it to the Code Review and Automated Testing section. This section checks each pull request before merge. To confirm that AWS DevOps Agent reviews every pull request:- Open Code Review and Automated Testing in your GitHub integration settings.
- Confirm that Auto trigger change review is enabled for your repository. This setting runs a review each time a pull request is opened or updated and posts the findings as inline comments.
- (Optional) Enable Automated verification testing. AWS DevOps Agent builds and tests the change in a managed environment during review.
- Click Save.
Step 4: Prepare GitHub for headless Kiro runs
The implementation workflow runs Kiro CLI headless inside a GitHub-hosted runner, with no one present to sign in or approve actions. To prepare GitHub for these unattended runs, you allow GitHub Actions to open pull requests, generate a Kiro API key to replace the interactive browser login, and store the key as a repository secret that the workflow can use.Step 4.1: Allow GitHub Actions to create pull requests
By default, GitHub blocks Actions from opening pull requests. You must enable the Allow GitHub Actions to create and approve pull requests setting to allow the implementation workflow to open a pull request. Until you enable it, the workflow fails at its final step with the error “GitHub Actions is not permitted to create or approve pull requests.” This setting is separate from thepull-requests: write permission in the workflow file, and the workflow needs both.
To enable the setting:
- In your repository, click Settings.
- Select Actions > General.
-
Under Workflow permissions, select Allow GitHub Actions to create and approve pull requests.
An organization policy can disable this settingWhen the checkbox is off, your organization enforces this setting. Enable it under Organization Settings > Actions > General.
- Click Save.
Step 4.2: Generate a Kiro API key
Kiro CLI needs an API key to authenticate when the implementation workflow runs it. Headless mode uses the key instead of the interactive browser login. When you set theKIRO_API_KEY environment variable, Kiro CLI skips interactive authentication entirely.
To create the API key that Kiro CLI uses to authenticate:
- Log in to the Kiro portal.
- Open your account settings.
- Generate an API key.
- Record the API key. You store it as a repository secret in Step 4.3.
Administrator governance rules apply to headless sessionsGovernance rules that your Kiro administrator sets, such as MCP server restrictions, model access policies, and web fetch permissions, apply to headless sessions exactly as they apply to interactive sessions.
Step 4.3: Store the API key as a repository secret
Storing the API key as a repository secret makes it available to the workflow while keeping it separate from your workflow files. To store the key as a repository secret:- Navigate to Settings in your GitHub repository.
- Select Secrets and variables > Actions.
- Click New repository secret.
- Name the secret
KIRO_API_KEY. - Enter the API key you recorded in Step 4.2 as the secret value.
- Click Add secret.
Step 5: Add the Kiro agent and workflows
AWS DevOps Agent implements, merges, and deploys changes by dispatching workflows in your target repository. You commit the Kiro agent definition and the implementation and merge workflows, and you confirm that your deploy workflow can be dispatched. These files keep the agent’s behavior under version control and code review.Step 5.1: Define the Kiro implementation agent
A Kiro custom agent defines a persona with a specific job, tools, and behavior rules. Committing the definition to your repository puts the agent’s instructions and tool permissions under version control and code review, instead of a prompt assembled at runtime. To define the agent, create a file named.kiro/agents/flag-implementer.json and add the following:
flag-implementer.json
- The
toolsfield lists everything the agent can use. - The
allowedToolsfield lists the subset of tools that the agent can use without approval. - The
permissionsfield limits where the agent can read and write. It lets the agent read and write files in the repository, and it blocks writes to.git,.github,.kiro, and.gitattributesfiles. These paths control Git, the workflows, and the agent definition itself.
allowedTools pre-approves fs_read and fs_write, which lets the agent read and change files. execute_bash is not pre-approved, which means the agent cannot run a shell command without approval.
Step 5.2: Add the implementation workflow
The agent dispatches this workflow instead of making a direct “implement code” tool call. Theworkflow_dispatch inputs are the contract between the agent and Kiro.
To add the workflow, create a file named .github/workflows/kiro-implement.yml and add the following:
kiro-implement.yml
${{ inputs.* }} directly into a run: script. GitHub Actions substitutes an expression into the script text before the shell runs. Written directly, quotes, backticks, or $(...) in an input run as commands. This matters because the agent writes the inputs from content it reads, and some of that content can come from untrusted sources. The workflow also rejects a flag key that contains anything other than letters, numbers, periods, underscores, or hyphens, because the flag key becomes part of the branch name.
The checkout step sets persist-credentials: false. Without it, actions/checkout stores the GitHub token in the repository’s Git configuration, where Kiro could read it during its run. The workflow supplies the token only to the steps that push the branch and open the pull request.
The --no-interactive option makes the run headless. It prints the response to standard output and exits instead of opening a chat session. It requires a prompt argument.
The workflow also relies on two details that fail without producing an error.
Step 5.3: Add the merge workflow and confirm the deploy workflow can be dispatched
The agent merges a pull request only after release readiness review passes. Routing the merge through its own workflow keeps the merge conditions, such as the base branch, merge method, and required checks, in version-controlled configuration instead of a one-off API call. To add the merge workflow, create a file named.github/workflows/merge-pr.yml and add the following:
merge-pr.yml
workflow_dispatch as a trigger because the agent needs it to start the workflow directly. The deployment workflow needs no other changes.
Deployment does not start automatically on mergeA deployment workflow that uses only the
workflow_dispatch trigger does not run automatically on merge. This is expected. The agent triggers deployment as its own explicit lifecycle step.Step 6: Protect and validate the repository
The workflow files and the agent definition set the limits on what the agent can do. You protect themain branch to keep those files under pull request review, then confirm that each connection works before the agent runs the full lifecycle.
Step 6.1: Enable branch protection
The workflow files fix which branch the agent targets and which commands run, and the agent definition fixes which tools Kiro can use. Branch protection makes those files trustworthy. To require pull requests and passing status checks onmain and restrict direct pushes:
- In your repository, click Settings.
- Select Branches.
- Add a branch protection rule for
main. - Require a pull request before merging.
- Require status checks to pass.
- Restrict who can push directly to the branch.
Step 6.2: Validate the GitHub configuration
The lifecycle depends on the GitHub integration and headless Kiro runs. Testing each of these on its own, before the agent runs the full lifecycle, isolates any problem to a single part. To verify that AWS DevOps Agent can read your repository:- In the AWS DevOps Agent console, start a chat session in your Agent Space.
- Ask the agent to list the open pull requests in your repository.
- Navigate to your GitHub repository and click the Actions tab.
-
Select Kiro Implement Behind Flag, then click Run workflow.
Start a fresh run after you edit a workflowWhen you edit a workflow between test attempts, start a fresh run with Run workflow instead of Re-run jobs. Re-running replays the original run’s workflow file and commit. It ignores your edits, and the run fails the same way, which makes it look like the fix didn’t work. You can recognize a re-run because its run ID matches the previous attempt.
-
Enter the following values for a small test task:
- What to implement: “add a clarifying code comment to the flag evaluation helper”
- LaunchDarkly flag key gating the change: Any existing flag key
- Behavior of the treatment variation: “no behavior change”
- Confirm that the job completes and opens a pull request.
-
Download the
kiro-run-logartifact to see what Kiro did.
- Close the test pull request.
- Delete its branch.
Step 7: Create the custom agent with the orchestration skill
The orchestration skill tells the agent how to run the experimentation lifecycle, and the custom agent runs it end to end. With LaunchDarkly connected in Step 2 and GitHub and Kiro connected in Steps 3 to 6, you now create the skill and the custom agent.Step 7.1: Create the experiment-orchestration skill
The skill holds the instructions for the experimentation lifecycle. Its own steps are numbered separately from the steps in this guide. To create the skill:- In the AWS DevOps Agent console, create a new skill named
experiment-orchestration. For instructions, read Create a skill using the AWS DevOps Agent console. - Paste the following skill text into the Instructions field.
- Select which agents have access to the skill.
Orchestration skill text
Orchestration skill text
Remove guarded rollout actions when your plan does not include guarded rolloutsWhen your LaunchDarkly plan does not include guarded rollouts, edit the skill to remove the guarded rollout actions. The workflow still runs experiments and produces reports, but rollout past the experiment phase becomes a manual decision.
Step 7.2: Create the custom agent
The custom agent runs the lifecycle end to end. To create it and give it the LaunchDarkly MCP tools and the orchestration skill:- Create a custom agent in AWS DevOps Agent. For instructions, read Custom Agent in AWS DevOps Agent.
-
Enter the following system prompt for the agent:
- Attach the LaunchDarkly MCP tools to the agent.
-
Attach the
experiment-orchestrationskill to the agent.
Step 7.3: Start an experiment
To start an experiment, state a goal in chat, for example “increase add-to-cart rate by 10%”. The agent asks for the success metric and the target improvement when you don’t provide them. The agent then:- Generates and presents a hypothesis
- Creates a flag
- Dispatches the implementation workflow
- Merges the pull request after a clean review
- Triggers deployment
- Runs the experiment
- Starts a guarded rollout of the winning variation, with automatic rollback on a regression, when your plan includes guarded rollouts
- Produces a structured report on every final outcome
Conclusion
In this guide, you connected AWS DevOps Agent to LaunchDarkly and GitHub, and created a custom agent that runs the experimentation lifecycle. To learn more, read Experimentation and Guarded rollouts.Want to know more? Start a trial.Your trial begins as soon as you sign up. Get started in minutes using the in-app Quickstart. You’ll discover how easy it is to release, monitor, and optimize your software.
Want to try it out? Start a trial.
Want to try it out? Start a trial.