Enable MCP | MACHINE-MEMORY by JFA

The MCP endpoint is opt-in. Deploy infrastructure first; then add GitHub OAuth secrets and redeploy.

1. Create a GitHub OAuth app

Open GitHub Developer Settings → OAuth Apps.
Create an app.
Set the Authorization callback URL to:
```
https://<worker-url>/callback
```
Use the router host from provision (for example https://machine-memory.jfa.dev/callback or https://<router>.workers.dev/callback).
Copy the client ID and generate a client secret.

2. Set secrets for the stack

When deploying (CLI provision env, iac/.env, or your CI secrets), set:

MACHINE_MEMORY_GITHUB_CLIENT_ID=your-github-oauth-app-client-id
MACHINE_MEMORY_GITHUB_CLIENT_SECRET=your-github-oauth-app-client-secret
MACHINE_MEMORY_GITHUB_ALLOWED_USER_ID=your-numeric-github-user-id
MACHINE_MEMORY_COOKIE_ENCRYPTION_KEY=your-random-cookie-signing-secret

Generate the cookie signing key:

openssl rand -hex 32

These are bound on the Worker and read at startup. If any are missing, OAuth/MCP routes return 503 with the missing names listed. REST routes stay available.

MACHINE_MEMORY_GITHUB_ALLOWED_USER_ID is the numeric ID of the one GitHub account allowed to use this MCP endpoint. Find it with:

gh api user --jq .id

The allowlist is checked when OAuth completes and on every MCP request. Changing it blocks previously issued tokens for the old account after redeployment. Grants from before this check also fail closed, so reconnect after deploying it.

3. Redeploy

machine-memory remote provision

Or from the stack directory:

cd iac
CI=1 bun run deploy

4. Connect

Point an MCP client at https://<router-url>/mcp. Complete the browser OAuth flow once. Tokens carry mcp:read and mcp:write.

Next: Headless login for clients that cannot open a browser, or Init for agent instructions.

If something fails

See Troubleshooting → MCP (503 missing secrets, cookie signing, OAuth 404/403, Alchemy import).