---
title: "Enable MCP"
description: "Turn on the Worker’s MCP endpoint with GitHub OAuth."
---

> Documentation Index
> Fetch the complete documentation index at: https://machine-memory.jfa.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Enable MCP

The MCP endpoint is opt-in. Deploy [infrastructure](/infrastructure/overview) first; then add GitHub OAuth secrets and redeploy.

## 1. Create a GitHub OAuth app

1. Open [GitHub Developer Settings → OAuth Apps](https://github.com/settings/developers).
2. Create an app.
3. Set the **Authorization callback URL** to:

```text
   https://<worker-url>/callback
```

   Use the **router** host from provision (for example `https://machine-memory.jfa.dev/callback` or `https://<router>.workers.dev/callback`).

4. Copy the client ID and generate a client secret.

## 2. Set secrets for the stack

When deploying (CLI provision env, `iac/.env`, or your CI secrets), set:

```sh
MACHINE_MEMORY_GITHUB_CLIENT_ID=your-github-oauth-app-client-id
MACHINE_MEMORY_GITHUB_CLIENT_SECRET=your-github-oauth-app-client-secret
MACHINE_MEMORY_GITHUB_ALLOWED_USER_ID=your-numeric-github-user-id
MACHINE_MEMORY_COOKIE_ENCRYPTION_KEY=your-random-cookie-signing-secret
```

Generate the cookie signing key:

```sh
openssl rand -hex 32
```

These are bound on the Worker and read at startup. If any are missing, OAuth/MCP routes return `503` with the missing names listed. REST routes stay available.

`MACHINE_MEMORY_GITHUB_ALLOWED_USER_ID` is the numeric ID of the one GitHub account allowed to use this MCP endpoint. Find it with:

```sh
gh api user --jq .id
```

The allowlist is checked when OAuth completes and on every MCP request. Changing it blocks previously issued tokens for the old account after redeployment. Grants from before this check also fail closed, so reconnect after deploying it.

## 3. Redeploy

```sh
machine-memory remote provision
```

Or from the stack directory:

```sh
cd iac
CI=1 bun run deploy
```

## 4. Connect

Point an MCP client at `https://<router-url>/mcp`. Complete the browser OAuth flow once. Tokens carry `mcp:read` and `mcp:write`.

Next: [Headless login](/docs/mcp/headless) for clients that cannot open a browser, or [Init](/docs/mcp/init) for agent instructions.

## If something fails

See [Troubleshooting → MCP](/troubleshooting/mcp) (503 missing secrets, cookie signing, OAuth 404/403, Alchemy import).

Source: https://machine-memory.jfa.dev/docs/mcp/enable/index.mdx