finding-deleted-feature-flags

Answers who deleted which feature flags in the last week or month, and exactly when — the deletion times are not stored where you would expect, so this goes and digs them out.

WHEN TO USE

SCOPE

USE FOR

Audit recent feature-flag deletions across a project for an incident review.
Find out exactly when one specific feature flag was deleted.
Recover the original name of a flag that got renamed when it was deleted.

NOT FOR

Cleaning up feature flags that are still active but unused, rather than already deleted.

This is a saved copy of the skill's SKILL.md instructions. It may differ from the upstream file or the version you install.

In this document (8)

Finding recently deleted feature flags

This skill produces a list of feature flags that were soft-deleted in the active project within a user-specified time window, along with who deleted each one and when.

When to use this skill

The user asks "what flags got deleted last week / in the last N days?"
The user wants an audit of recent flag deletions (who, when, what was removed)
The user wants to find when a specific flag was deleted, or by whom
Any "recently deleted feature flags" framing

Don't use this for active stale-flag cleanup — that's cleaning-up-stale-feature-flags. This skill is for flags that have already been removed.

The gotcha that makes this non-trivial

system.feature_flags exposes deleted as a boolean but does not expose deleted_at, updated_at, or last_modified_at. There's no way to filter soft-deleted flags by deletion time in a single SQL query — trying to use those columns will return Unable to resolve field.

The actual deletion timestamp lives in the per-flag activity log, reachable only via posthog:feature-flags-activity-retrieve (one call per flag id). There is no bulk activity endpoint.

So the workflow is two-stage: SQL to enumerate candidates, then parallel activity-log lookups to find each deletion event.

Workflow

1. Clarify the window if ambiguous

"Last week" is ambiguous — it can mean rolling 7 days from now, or the previous calendar week (Mon–Sun). If the user wasn't explicit, ask, or surface both interpretations in the final report.

Always compute the cutoff in UTC and keep the user's local interpretation in your head separately.

2. Enumerate soft-deleted flags via SQL

Query system.feature_flags for deleted = true in the active project, ordered by created_at DESC:

SELECT id, key, created_at
FROM system.feature_flags
WHERE team_id = <team_id> AND deleted = true
ORDER BY created_at DESC
LIMIT 100

Order by created_at DESC because deletions empirically cluster near creation — most flags get deleted within a few days of being created — so walking the most-recently-created candidates first finds recent deletions fastest. But this is a heuristic, not a guarantee: an older flag deleted recently won't be at the top of this list. Be explicit about that limitation when you report.

team_id defaults to the active project, but include it explicitly for clarity.

3. Fan out activity-log lookups in parallel

For each candidate id, call posthog:feature-flags-activity-retrieve with limit: 5, page: 1. Issue all calls in one message so they run concurrently — sequential calls are dramatically slower.

call feature-flags-activity-retrieve {"id": <flag_id>, "limit": 5, "page": 1}

Reasonable batch sizes:

"last 7 days" → top 20–25 candidates
"last 30 days" → top 50
"last 90 days" → walk the full ~100

If you sample fewer than the full set, say so in the report and offer to walk the rest as a follow-up.

4. Extract the deletion event from each response

In each response, find the entry where activity == "deleted". That entry's created_at is the actual deletion time, and user.email / user.first_name identify the deleter. These fields are reliable on every delete path.

For most flags there's exactly one delete event. If a flag has been deleted-and-restored multiple times, take the most recent activity: deleted event within the window.

5. Recover the original key and report

Feature flags are renamed to <original>:deleted:<flag_id> when soft-deleted while still referenced elsewhere (e.g. a stopped experiment) — the id-based suffix frees the original key for reuse. Don't try to recover the original from the activity log's own fields: detail.changes only carries the rename on UI/ORM deletes (and is often empty, or missing the key entry, on API/MCP/programmatic deletes), and detail.name just mirrors whatever the current key is — tombstoned or not.

Instead, strip the suffix deterministically with scripts/strip_deleted_suffix.py. Pass it the whole step 2 candidate list as JSON in one call — not one invocation per flag:

echo '[{"id": 687432, "key": "high_frequency_alerts:deleted:687432"}]' | python3 scripts/strip_deleted_suffix.py
# prints the same array back (pretty-printed), each object gaining an "original_key" field:
# "original_key": "high_frequency_alerts"

Filter the collected deletion events to those whose created_at falls inside the requested window. Present as a table, using each row's recovered original key (not the raw tombstoned form) for the "Key" column:

State your methodology in the report (how many candidates you walked vs. how many soft-deleted flags exist total), so the user knows what was and wasn't checked.

Watch-outs

Borderline cases: if a deletion is within ~1 hour of the window cutoff, surface it as borderline rather than silently dropping it.
Don't trust created_at as a proxy for deletion time: a flag created in 2024 can still have been deleted last week. The activity log is the only authority.
Renamed keys are normal: a flag with key foo:deleted:12345 was the flag originally keyed foo — see step 5 for how to recover it.
Walking all candidates is possible but slow: ~100 parallel activity-log calls is doable. Offer it as a follow-up rather than the default for short windows.

Example interaction

User: "what flags got deleted in the last week?"

Clarify if needed, or note both interpretations: "rolling 7 days ending now (UTC), in the active project"
Run the SQL enumeration to get up to 100 soft-deleted candidates ordered by created_at DESC
Fan out activity-log lookups in parallel across the top ~25 candidates
Extract activity: deleted entries; filter to those whose created_at >= now - 7 days

Recover original keys with scripts/strip_deleted_suffix.py and report:

Found 2 feature flags deleted in the last 7 days (rolling, ending 2026-05-22 19:04 UTC):

| Flag ID | Key                                       | Deleted at (UTC)     | Deleted by  |
|---------|-------------------------------------------|----------------------|-------------|
| 687432  | high_frequency_alerts                     | 2026-05-22 17:23     | Matt P.     |
| 676665  | tasks-sendblue-prewarmed-sandbox-pool     | 2026-05-15 13:45     | Alessandro  |

Methodology: walked the activity log for the 25 most-recently-created soft-deleted
flags. Team 2 has ~100 soft-deleted flags total; the remaining ~75 were created
before mid-March 2026 and were not checked. Want me to walk the rest?

Related tools

posthog:execute-sql: Used in step 2 to enumerate soft-deleted candidates against system.feature_flags
posthog:feature-flags-activity-retrieve: Used in step 3 to find the actual deletion event for each candidate
posthog:feature-flag-get-definition: Useful if the user then wants to inspect what the deleted flag looked like

Scripts

scripts/strip_deleted_suffix.py: recovers original flag keys — see step 5.

This skill ships inside the PostHog AI Plugin. Listed package contents include 3 slash commands, 1 agent, hooks and an MCP server. Installed components and skill versions may vary by AI tool.

Install just this skill

Run this outside your AI tool, using Node.js 22.20.0 or newer. Skills CLI 1.7.2 skips skill selection; prompts cancel installation without an interactive terminal. If choosing Project when asked about installation scope, open your project's folder before running this.

Install checklist

Check selected tools if a picker appears; Claude Code may be unchecked under Additional agents. ↑/↓ moves, Space toggles selections, Enter confirms.
Without a tool picker, check Installing to: for your intended tool. Stop if it names a different tool.
If asked, choose Symlink (Recommended) for shared files or Copy to all agents for separate copies; review the summary before confirming installation.
Install the find-skills skill? defaults to Yes, adding another skill for all projects. Choose No if you don't want that extra installation.

Skills CLI 1.7.2 sends install data to skills.sh by default, including the source, skill names, target tools and file details; GitHub sources are reported only when GitHub confirms the repository is public, while other remote sources can also be reported. Confirmed-public GitHub sources also trigger a security-audit request. Before installing, set the environment variable DO_NOT_TRACK=1 or DISABLE_TELEMETRY=1 to disable both.

npx skills add posthog/ai-plugin --skill "finding-deleted-feature-flags" --full-depth

After installing for Claude Code, open it in the installation project if you chose Project; Global makes the skill available across projects on this computer. Once Claude Code loads the skill, its description helps Claude decide when to use it.

If installation created a top-level skills folder that did not exist when your Claude Code session started, run /reload-skills in that session. Run it again after later changes in that folder.

MCP server required

The skill's steps call for tools from the PostHog MCP server. Installing just this skill doesn't add that connection; set it up in your AI tool if it isn't there yet: PostHog MCP setup. Installing the whole plugin instead includes the connection settings.

Requirements for the PostHog MCP server

Connecting is free; sign in with your PostHog account.
Some tools use AI internally and may incur PostHog AI charges. Those tools require AI data processing to be enabled in your organization settings.

Install the whole plugin

This route installs the posthog plugin package selected for your AI tool.

Claude Code

Add PostHog's marketplace, then install the plugin

Run both lines in a terminal. They install PostHog's posthog plugin: this skill, PostHog's other skills, and a connection to PostHog's hosted MCP server.

claude plugin marketplace add PostHog/ai-plugin

02
```
claude plugin install posthog@posthog
```

Installation and loading

The plugin installs for you in every project and loads the next time you start Claude Code, or after /reload-plugins in an open session.
To connect your PostHog account, start claude, type /mcp, select plugin:posthog:posthog and follow the browser prompts.

Good to know

The plugin includes PostHog's session-capture hook; PostHog's README says it sends sessions to LLM Analytics only when POSTHOG_LLMA_CC_ENABLED=true and POSTHOG_API_KEY are both set.
If you use the separate posthog-telemetry plugin, PostHog says to keep only one of the two, because both register the same hook.
On a self-hosted PostHog, this route's MCP connection won't reach your instance: the plugin's config is fixed to https://mcp.posthog.com/mcp, which routes to PostHog's US or EU region. POSTHOG_MCP_URL works only for the Gemini CLI extension.

View on GitHub

Same repository

adding-warehouse-person-properties
Sync columns from a synced data warehouse table onto PostHog person or group properties, so warehouse data becomes usable anywhere person and group properties already work: feature flag targeting, cohorts, insight filters and breakdowns, surveys, session replay filters, workflows, and the person profile. Use when the user wants to "add a person property from my warehouse", "enrich people with Stripe/Postgres/Salesforce data", "put ARR or plan tier on my persons", "target a feature flag by a warehouse column", "sync warehouse columns onto groups or organizations", or wants to inspect, backfill, disable, or debug an existing warehouse-backed person or group property.Read full description
analyzing-expensive-users
Analyze the most expensive users in AI observability and explain why they cost so much. Use when the user asks about top spenders, expensive users, per-user LLM cost, user-level cost drivers, or patterns behind high AI observability spend.Read full description
analyzing-experiment-session-replays
Analyze session replay patterns across experiment variants to understand user behavior differences. Use when the user wants to see how users interact with different experiment variants, identify usability issues, compare behavior patterns between control and test groups, or get qualitative insights to complement quantitative experiment results. Also covers pairing the observed behavior with a linked survey when the user wants qualitative feedback beyond what recordings show.Read full description
assessing-heatmaps
Assesses what a page's heatmap is telling you and recommends concrete changes. Pulls click / rageclick / scroll-depth data for a URL, names the hot elements by cross-referencing autocapture events on the same page, and can create a saved heatmap the user opens in PostHog, then summarizes the behavior and proposes improvements. TRIGGER when: user asks what a heatmap shows, why people aren't clicking something, where users rage-click, how far they scroll, what to change on a page based on heatmap/click data, or to 'analyze/assess/review the heatmap' for a URL. DO NOT TRIGGER when: the user only wants to create a saved heatmap screenshot with no analysis (use heatmaps-saved-create directly), or is asking about session replay in general (use investigating-replay).Read full description
auditing-endpoints
Audit every endpoint in a PostHog project for staleness, failed materialisations, and unused materialised versions. Use when the user asks "what endpoints can I clean up?", "are any of my endpoints broken?", "which materialised versions are still being called?", or wants a one-shot cleanup pass over the Endpoints product. Produces a prioritised report grouped by issue type, with recommended actions but does not modify anything without explicit confirmation.Read full description
auditing-experiments-flags
Audit PostHog experiments and feature flags for configuration issues, staleness, and best-practice violations. Read when the user asks to audit, health-check, or review experiments or feature flags, check flag hygiene, or verify experiment setup.Read full description

Finding recently deleted feature flags

When to use this skill

The gotcha that makes this non-trivial

Workflow

1. Clarify the window if ambiguous

2. Enumerate soft-deleted flags via SQL

3. Fan out activity-log lookups in parallel

4. Extract the deletion event from each response

5. Recover the original key and report

Watch-outs

Example interaction

Related tools

Scripts

MCP connection required

Install just this skill

Install the whole plugin

Add PostHog's marketplace, then install the plugin

More skills

adding-warehouse-person-properties

analyzing-expensive-users

analyzing-experiment-session-replays

assessing-heatmaps

auditing-endpoints

auditing-experiments-flags