Enable MCP | MACHINE-MEMORY by JFA

The MCP endpoint is opt-in. Deploy infrastructure first; then add GitHub OAuth secrets and redeploy.

1. Create a GitHub OAuth app

Open GitHub Developer Settings → OAuth Apps.
Create an app.
Set the Authorization callback URL to:
```
https://<worker-url>/callback
```
Use the router host from provision (for example https://machine-memory.jfa.dev/callback or https://<router>.workers.dev/callback).
Copy the client ID and generate a client secret.

2. Set secrets for the stack

Provision the values in Cloudflare Secrets Store, then reference their names in machine-memory.deploy.json:

"secretsStore": {
  "storeId": "<cloudflare-secrets-store-id>",
  "dbToken": "machine-memory-db-token",
  "oauth": {
    "githubClientId": "machine-memory-github-client-id",
    "githubClientSecret": "machine-memory-github-client-secret",
    "githubAllowedUserId": "machine-memory-github-allowed-user-id",
    "cookieEncryptionKey": "machine-memory-cookie-encryption-key"
  }
}

Generate the cookie signing key:

openssl rand -hex 32

These names are bound on the Worker and values are read only while handling requests. If any OAuth reference or value is missing, OAuth/MCP routes return 503 with the missing names listed. REST routes stay available. The API bearer token is also read from the Secrets Store at request time.

MACHINE_MEMORY_GITHUB_ALLOWED_USER_ID is the numeric ID of the one GitHub account allowed to use this MCP endpoint. Find it with:

gh api user --jq .id

The allowlist is checked when OAuth completes and on every MCP request. Changing it blocks previously issued tokens for the old account after redeployment. Grants from before this check also fail closed, so reconnect after deploying it.

3. Redeploy

machine-memory remote provision

Or from the stack directory:

cd iac
CI=1 bun run deploy

4. Connect

Point an MCP client at https://<router-url>/mcp. Complete the browser OAuth flow once. Tokens carry mcp:read and mcp:write.

Next: Headless login for clients that cannot open a browser, or Init for agent instructions.

If something fails

See Troubleshooting → MCP (503 missing secrets, cookie signing, OAuth 404/403, Alchemy import).