Sandbox & credentials | MACHINE-MEMORY by JFA

Sandboxes (Amp orbs, CI, locked-down Linux) often cannot use the OS keychain. MCP and CLI credentials are different paths.

MCP vs CLI credentials

Path	Auth	Sandbox notes
MCP `/mcp`	GitHub OAuth 2.1 in the browser, or a code entered at `/activate`	No `MACHINE_MEMORY_DB_TOKEN`. Cookie signing uses `MACHINE_MEMORY_COOKIE_ENCRYPTION_KEY` on the Worker.
CLI `--remote`	Worker URL + bearer token	Needs keychain or repo-root `.env` (below).

MCP clients never read your local keychain or .env token. If OAuth fails, see MCP troubleshooting.

CLI remote without keychain

When Bun Secrets / libsecret / macOS keychain is unavailable, put credentials in a repository root .env and run commands from that root:

MACHINE_MEMORY_DB_URL=https://your-worker.example
MACHINE_MEMORY_DB_TOKEN=your-worker-token

URL may be the Worker origin or …/query; the CLI normalizes to /query.
Keep .env out of version control.
Full notes: Sandboxed keychain access.

If the keychain is unreachable, the CLI suggests .env instead of forcing remote setup / provision.

Amp orbs and project secrets

Inject MACHINE_MEMORY_DB_URL and MACHINE_MEMORY_DB_TOKEN (and Cloudflare deploy secrets if you deploy from the orb) as project/workspace secrets, not only a laptop keychain.
After changing secrets, restart orb processes so children see the new env (amp orb restart-processes when applicable).
Trim whitespace on CLOUDFLARE_ACCOUNT_ID / tokens; a trailing space makes Wrangler reject the account id as invalid.

MCP-only in a sandbox

Worker already provisioned and MCP enabled from a machine that can deploy.
In the sandbox, connect the MCP client to https://<worker-url>/mcp. A browser on that machine can finish OAuth directly. Clients implementing Machine Memory’s headless protocol can print a code for approval at https://<worker-url>/activate, then retrieve the authorization code by polling. No loopback listener is needed. This is not automatic support in existing MCP clients; see Headless login.

Install agent instructions without the CLI:

curl -fsSL https://machine-memory.jfa.dev/init-mcp | bash

See MCP init.

Interactive token prompts

Bun.prompt echoes input and cannot mask secrets. The CLI’s interactive Worker token prompt uses a raw TTY reader (* per character). Prefer --token / env / .env in automation so nothing interactive runs.