3.5 Deployment Patterns

MentisDB can run embedded in a Rust process, as a local stdio MCP process, as HTTP/HTTPS MCP, as REST, or with the dashboard enabled. The right deployment is the smallest surface that satisfies your agent topology.

Recommended for teams: run MentisDB as a long-lived HTTPS MCP server in the cloud or on your internal network, protect it with bearer tokens, and have every coding harness connect remotely. Local mode is convenient for solo experiments; shared server mode is how agent memories compound across people, machines, and tools.

Deployment choices

Library-only: use MentisDb directly inside your application.
Stdio MCP: best for desktop clients and local harnesses.
HTTP MCP: best for local development with multiple tools.
HTTPS MCP/REST: required for remote agents and shared servers.
Dashboard: useful for operators, protected with a PIN on shared hosts.

fn inspect_deployment_config_shape() {
    let config = mentisdb::server::MentisDbServerConfig::from_env();

    assert_eq!(config.mcp_addr.port(), 9471);
    assert_eq!(config.rest_addr.port(), 9472);
    assert!(config.https_mcp_addr.is_some());
    assert!(config.https_rest_addr.is_some());
    assert!(config.dashboard_addr.is_some());

    let data_dir = mentisdb::server::default_mentisdb_dir();
    assert!(!data_dir.as_os_str().is_empty());
}

Local daemon

cargo install mentisdb
mentisdb          # keep this terminal running; it starts the daemon

# In another terminal:
mentisdb wizard

Remote HTTPS MCP

export MENTISDB_BIND_HOST=0.0.0.0
export MENTISDB_HTTPS_MCP_PORT=9473
export MENTISDB_DASHBOARD_PORT=9475
export MENTISDB_DASHBOARD_PIN='choose-a-real-pin'

mentisdb bearertoken create --global codex-admin
mentisdb cert your.domain.example
mentisdb          # restart after creating/updating certs and env vars

Systemd unit sketch

[Unit]
Description=MentisDB daemon
After=network-online.target

[Service]
User=mentisdb
EnvironmentFile=/etc/mentisdb/mentisdb.env
ExecStart=/usr/local/bin/mentisdb --headless
Restart=always
RestartSec=3

[Install]
WantedBy=multi-user.target

Remote rule: never expose a remote MCP server without bearer-token access, TLS, and a clear chain-scope policy.