[jonnyparris]

What

Adds apps/agent-notes, an account-scoped MCP server for persistent, semantically searchable agent notes.

Renamed from Agent Memory (2026-10-29). Cloudflare now has a first-party Agent Memory product (agent_memory binding, agent-memory.* scopes). This server is unrelated: it stores markdown files in the account's own R2. It is now Agent Notes on notes.mcp.cloudflare.com, so the two can't be confused.

Files live in an R2 bucket (agent-notes-mcp) in the selected Cloudflare account. Embeddings and on-demand reflection use Workers AI in that same account, so storage and inference are billed there. Search metadata lives in one Durable Object per account (idFromName(accountId)), matching the R2 isolation boundary.

Tools (22)

• Files: read, write, write_many, reindex, list, list_tags, get_backlinks
• Search: search
• Conversations: search_conversations, index_conversations, expand_conversation, conversation_stats
• Reminders: schedule_reminder, list_reminders, remove_reminder, check_reminders
• Reflection: run_reflection, list_pending_reflections, apply_reflection_changes, archive_reflection
• Config: get_config, set_config

Design and safety

• Built on the current stateless app pattern: createAuthenticatedMcpApp + McpRegistrationContext.accountTool. No per-session McpAgent Durable Object; the only Durable Object is the per-account search index (MemoryIndex).
• Uses the standard MCP deployment account plus the shared staging/production OAuth KV namespaces.
• Keeps Cloudflare credentials out of Durable Object storage: embeddings are generated before DO RPC calls.
• Validates and encodes R2 object paths, preventing .. path normalization from escaping the dedicated bucket.
• Reserves internal paths (.mcp/, conversations, reminders, reflection metadata) for dedicated tools and redacts webhook secrets from config responses.
• Uses a bounded, deterministic exact-cosine vector index (5,000 entries) with SQLite persistence, tag/scope filtering, binary vectors, and a repair-oriented reindex tool.
• Bounds object size, directory listings, search results, batch concurrency, conversation payloads, reminders, reflection iterations, and model tool calls.
• Reflection is on-demand and opt-out. Low-risk fixes may be applied immediately; substantive edits remain pending for review. Source hashes prevent approved edits from overwriting files changed after reflection, and an account-level lock prevents concurrent reflection runs.
• Webhooks are bounded by timeout, reject redirects, and expose only their host through get_config.
• Removes unsupported history/rollback tools rather than advertising no-op behavior.

Account members with the required permissions share the account's notes; this is documented in the server instructions and README.

Deployment

• Staging: notes-staging.mcp.cloudflare.com
• Production: notes.mcp.cloudflare.com
• Streamable HTTP at /mcp, registered in server.json. /sse is retired repo-wide and answers 410.

OAuth client: terraform-internal-oauth-clients!147 (in review). After it is applied, install CLOUDFLARE_CLIENT_ID, CLOUDFLARE_CLIENT_SECRET and MCP_COOKIE_ENCRYPTION_KEY as Wrangler secrets for both environments.

Cleanup after merge: the July staging deploy used the old name. Delete the mcp-cloudflare-agent-memory-staging Worker and its memory-staging.mcp.cloudflare.com route on the MCP account. It only ever held test data.

Verification

• pnpm check:deps ✅
• pnpm check:turbo: 41/41 tasks ✅
• pnpm check:format ✅
• Agent Notes suite: 19 files / 174 tests ✅, including the shared testStatelessMcpApp contract and tests that call the account-tool wrapper

[mattzcarey]

Keeping this PR in draft. Staging is deployed, but normal browser OAuth is not functional yet.

Blocked until a dedicated OAuth client is provisioned with the Agent Memory staging/production callback URLs and the corresponding Worker secrets are installed.