abel30567/fermi-mcp

A portable AI control plane built as a single MCP
server on Cloudflare Workers. Connect it to Claude.ai, Claude Desktop, Claude Code,
Cursor, or ChatGPT and they share the same memory, the same permission model, and the
same skills. Unattended channels (Telegram, Discord, WhatsApp, Slack) enqueue to a D1
task queue drained by a Mac-local daemon.
One server, one memory, one permission spine — the host changes, the agent doesn't.
> Full documentation site: abel30567.github.io/fermi-mcp — guide, component reference, architecture with data-flow diagrams, use cases, and the build-journey blog. Sources in docs-site/.
> Architecture in depth: docs/ARCHITECTURE.md.
> Setup and day-to-day usage: docs/USAGE.md.
## What it does
Cross-host memory — facts, preferences, and events in D1, recalled from any
connected host. A nightly job summarizes sessions, de-duplicates near-identical
memories by embedding similarity, and decays stale ones.
Skills — procedures stored as versioned SKILL.md documents in R2 with metadata
in D1. You can author them directly or promote them from a memory; a weekly job
proposes draft skills from recent session summaries for you to refine.
Permission spine — every tool declares a scope and a risk level. High-risk tools
require a two-phase approval token. Mutating tools are blocked in plan mode. Shell
code is screened against a blocklist. Every call is audited to D1.
Hooks — declarative, glob-matched deny-gates that run before a tool, evaluated
with deny > ask > allow precedence (today deny is the enforced decision).
Unified search — Reciprocal Rank Fusion (k=60) over capabilities, skills,
memories, and message history, blending keyword, FTS5, and Vectorize semantic lanes.
Code mode — the execute tool runs JavaScript in an isolated Worker sandbox
where capabilities are reachable as codemode. (...). Outbound HTTP goes
through a gateway that injects secrets and enforces per-secret host allow-lists.
Dual-lane browser — a headless cloud lane (Cloudflare Browser Rendering) for
scraping and a headed local lane (a macOS bridge over Cloudflare Tunnel) for sites
that need a real hardware fingerprint and authenticated state.
Channels & subagents — Telegram, Discord, WhatsApp, and Slack gateway channels
drained by a local daemon; teamspawn runs role-prompted subagents.
Live Canvas — agent-driven UI over a Durable Object + WebSocket, persistent
across turns and hosts.
## Architecture at a glance
MCP Hosts ─┐
Channels ──┼──► Cloudflare Worker ──► D1 · R2 · KV · Workers AI · Vectorize
Cron ──────┘ (FermiMCP + 3 DOs)
Worker (src/index.ts) routes MCP (/mcp, /sse), channels, OAuth, the
/apps/ host, the canvas WebSocket, and cron dispatch. When FERMIAUTHENABLED
is true, an OAuth provider gates the MCP transports; otherwise they are open.
Durable Objects: FermiMCP (the agent, SQLite-backed), LiveCanvasDO,
SandboxStorageDO, BrowserSessionDO.
Storage: D1 (memory, sessions/messages + FTS5, audit, hooks, skills metadata,
secrets metadata, oauth, approval tokens), R2 (skills, files, apps), KV (config),
Workers AI (embeddings + summaries), Vectorize (semantic index).
See docs/ARCHITECTURE.md for the full diagram and data flow.