Deployment options

Two supported paths: the CLI provisioner, or clone the monorepo and run IaC directly. Both use the same stack and optional deploy config.

CLI provision

machine-memory remote provision

That command:

1. Loads optional machine-memory.deploy.json (see deploy config)
2. Runs alchemy deploy for the multi-worker stack
3. Connects API and MCP to existing Cloudflare Secrets Store entries
4. Leaves the CLI’s router URL + bearer token in the OS keychain unchanged

Command details: remote provision.

Self-host (no docs site)

Most operators only need API + MCP. Skip the docs worker and set your own domain/names via a config file:

cp iac/machine-memory.deploy.example.json ./machine-memory.deploy.json
# edit domain, worker names, set "docs": false
machine-memory remote provision --config ./machine-memory.deploy.json

Or one-shot flags:

machine-memory remote provision --no-docs --domain memory.example.com

With no domain, the router is reachable at https://<router-name>.<account>.workers.dev.

Clone the repo and run IaC

git clone https://github.com/jfalava/machine-memory.git
cd machine-memory/iac
# optional: machine-memory.deploy.json in this directory or MACHINE_MEMORY_* env
CI=1 bun run deploy
# first time against an existing account resource set:
# CI=1 bunx alchemy deploy --yes --adopt

MCP OAuth references are optional at this stage. Without them the API still serves REST; MCP routes return 503 until you enable the endpoint.

After a direct IaC deploy, point the CLI at the router base URL with remote setup.

Deploy config file

Copy machine-memory.deploy.example.json:

{
  "domain": "memory.example.com",
  "docs": false,
  "stackName": "machine-memory-remote-db",
  "database": "machine-memory-db",
  "vectorIndex": "machine-memory-v1",
  "oauthKv": "machine-memory-oauth-kv",
  "workers": {
    "router": "machine-memory-router",
    "api": "machine-memory-api",
    "mcp": "machine-memory-mcp",
    "docs": "machine-memory-docs"
  },
  "secretsStore": {
    "storeId": "<cloudflare-secrets-store-id>",
    "dbToken": "machine-memory-db-token",
    "oauth": {
      "githubClientId": "machine-memory-github-client-id",
      "githubClientSecret": "machine-memory-github-client-secret",
      "githubAllowedUserId": "machine-memory-github-allowed-user-id",
      "cookieEncryptionKey": "machine-memory-cookie-encryption-key"
    }
  }
}

secretsStore contains references only: storeId is the Cloudflare Secrets Store ID and each other value is a secret name already provisioned in that store. Secret values are never read by the CLI, committed to this file, or sent through Alchemy. dbToken is required for authenticated API and MCP-to-API requests. The oauth block is optional; omitting it preserves the disabled-MCP behavior.

remote provision does not create or rotate the bearer token and does not overwrite CLI keychain credentials. After deployment, configure a new CLI installation separately with machine-memory remote setup --url <router-url> --token <value-from-secrets-store>.

Precedence: CLI flags → MACHINE_MEMORY_* env → config file → defaults. The stack, database, and API names check saved remote credentials after env and before the config file.

A --config path that does not exist stops provisioning with Deploy config not found at <path>. A MACHINE_MEMORY_DEPLOY_CONFIG path that does not exist prints a warning and continues with environment variables and defaults. Without either, remote provision reads machine-memory.deploy.json from the current directory if it exists.