---
title: "Deploy Engram | (Just Updated) AI Agent Memory Server for MCP, Token Auth, Postgres"
description: "Engram Cloud: persistent memory sync server for AI coding agents, Postgres"
category: "AI/ML"
url: https://railway.com/deploy/engram-or-just-updated-ai-agent-memory-s
---

# Deploy Engram | (Just Updated) AI Agent Memory Server for MCP, Token Auth, Postgres

Engram Cloud: persistent memory sync server for AI coding agents, Postgres

**[Deploy Engram | (Just Updated) AI Agent Memory Server for MCP, Token Auth, Postgres on Railway](https://railway.com/template/engram-or-just-updated-ai-agent-memory-s)**

Machine-readable deploy manifest (JSON, validated by TemplateCI): https://railway.com/deploy/engram-or-just-updated-ai-agent-memory-s/manifest.json

- **Creator:** SuperSlowSloth
- **Category:** AI/ML

## Template content

### postgres

- **Image:** postgres:17@sha256:3b0cda93be7c8dba2ed484d19393d93845dc3dafb88973e248ba8e6d99d784e1

### engram

- **Image:** ghcr.io/gentleman-programming/engram:3.6.1@sha256:38aefe1d4f7ae4c411d145652ec92e5ba63c796cf06529e8a4f3303cb6e63a95
- **Start command:** `/bin/sh -c 'export ENGRAM_CLOUD_HOST=0.0.0.0 ENGRAM_PORT=${PORT:-8080} ENGRAM_CLOUD_ALLOWED_PROJECTS=${ENGRAM_CLOUD_ALLOWED_PROJECTS:-*}; exec engram cloud serve'`
- **Health check:** /health
- **Public domain:** Yes

## Documentation

# Deploy and Host Engram Cloud on Railway

**Built for an LLM agent to deploy and use.** There is no setup form and nothing to fill in: the access token is generated at deploy time, and the contract below lists every address, variable name and one script that proves a write and a read work.

Engram is a persistent memory system for AI coding agents. Agents save decisions, bug fixes and conventions as observations during a session and recall them in later sessions. Engram Cloud is its server mode: a sync API with a web dashboard that keeps one shared memory for several machines or several agents, stored in PostgreSQL.

## About Hosting Engram Cloud

This template runs two services. `engram` is the official `ghcr.io/gentleman-programming/engram` 3.6.1 image, pinned by digest, started with `engram cloud serve` on Railway's injected port. `postgres` is PostgreSQL 17 on an attached volume, so every saved memory survives redeploys. The server creates its own schema on first boot.

Every sync route needs the bearer token from `ENGRAM_CLOUD_TOKEN`. The dashboard accepts the same token on its login page and then sets a session cookie. The token and the signing secret are generated per deploy and stay the same across redeploys. All projects are allowed by default; set `ENGRAM_CLOUD_ALLOWED_PROJECTS` to a comma separated list on the `engram` service to restrict them.

### Agent contract

- Public URL: `ENGRAM_PUBLIC_URL` (`https://` plus the service's `RAILWAY_PUBLIC_DOMAIN`). The dashboard is at `/dashboard/`.
- Private URL: `http://engram.railway.internal:8080`, exposed as `ENGRAM_PRIVATE_URL`.
- Credentials: `ENGRAM_CLOUD_TOKEN` (the access token) and `ENGRAM_JWT_SECRET` (signing secret, not for clients).
- Auth: send `Authorization: Bearer` followed by the token on every `/sync/*` request. Anonymous requests get `401`. For the dashboard, post the token to `/dashboard/login`.
- Health: `GET /health` returns 200 without credentials.
- API: `POST /sync/mutations/push` and `GET /sync/mutations/pull` for observations, `GET /sync/pull` and `POST /sync/push` for chunks.

```bash
# run with ENGRAM_PUBLIC_URL and ENGRAM_CLOUD_TOKEN set
KEY="obs-$(date +%s)"
curl -s -o /dev/null -w "health: %{http_code}\n" "$ENGRAM_PUBLIC_URL/health"
curl -s -o /dev/null -w "anonymous pull: %{http_code}\n" -G "$ENGRAM_PUBLIC_URL/sync/mutations/pull" --data-urlencode "project=agent-demo"
curl -s -o /dev/null -w "push: %{http_code}\n" -H "Authorization: Bearer $ENGRAM_CLOUD_TOKEN" -H "Content-Type: application/json" \
  -d "{\"entries\":[{\"project\":\"agent-demo\",\"entity\":\"observation\",\"entity_key\":\"$KEY\",\"op\":\"upsert\",\"payload\":{\"sync_id\":\"$KEY\",\"session_id\":\"s1\",\"type\":\"note\",\"title\":\"hello\",\"content\":\"remember this\",\"project\":\"agent-demo\",\"scope\":\"project\"}}]}" \
  "$ENGRAM_PUBLIC_URL/sync/mutations/push"
curl -s -H "Authorization: Bearer $ENGRAM_CLOUD_TOKEN" -G "$ENGRAM_PUBLIC_URL/sync/mutations/pull" --data-urlencode "project=agent-demo" --data-urlencode "since_seq=0" | grep -c "$KEY"
curl -s -o /dev/null -w "dashboard login: %{http_code}\n" -X POST "$ENGRAM_PUBLIC_URL/dashboard/login" --data-urlencode "token=$ENGRAM_CLOUD_TOKEN"
```

A fresh deploy prints `health: 200`, `anonymous pull: 401`, `push: 200`, a count of `1` (the saved observation read back) and `dashboard login: 303`.

## Why Deploy Engram Cloud on Railway?

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying Engram Cloud on Railway, you are one step closer to supporting a complete full-stack application with minimal burden. Host your servers, databases, AI agents, and more on Railway.

- **Agent-ready** - generated access token, contract block and one working script; no setup form.
- **Shared memory** - several machines and agents read and write one store instead of one local file each.
- **State survives redeploys** - memories live in Postgres on a volume.
- **Token on every route** - sync routes reject anonymous callers, and the dashboard needs the same token.
- **One small Go binary** - low memory use, so it costs little to leave running.

## Common Use Cases

- **One memory for a team of coding agents** - agents on different machines recall the same decisions and fixes.
- **Backup and sync of local Engram memory** - push a laptop's memory to the server and pull it on another machine.
- **Browsing what agents learned** - open the dashboard to review saved observations by project.

## Dependencies for Engram Cloud Hosting

- PostgreSQL 17 with one Railway volume, created by the template.

### Deployment Dependencies

- [Engram repository](https://github.com/Gentleman-Programming/engram)
- [Official image](https://github.com/Gentleman-Programming/engram/pkgs/container/engram)
- [Engram documentation](https://github.com/Gentleman-Programming/engram/blob/main/DOCS.md)

### Implementation Details

| Variable | Purpose |
| --- | --- |
| `ENGRAM_CLOUD_TOKEN` | Bearer token for the sync API and dashboard login, generated per deploy. |
| `ENGRAM_JWT_SECRET` | Signing secret for dashboard sessions, generated per deploy. |
| `ENGRAM_PUBLIC_URL` | HTTPS address for clients outside Railway. |
| `ENGRAM_PRIVATE_URL` | Address on the private network, for services in the same project. |
| `ENGRAM_DATABASE_URL` | Connection string to the Postgres service, built from its generated password. |

The start command sets the listen host to all interfaces and the port to Railway's injected `PORT`. Point a local Engram install at the server with its cloud server URL and this token.


## Similar templates

- [Chat Chat](https://railway.com/deploy/-WWW5r) — Chat Chat, your own unified chat and search to AI platform.
- [Weaviate](https://railway.com/deploy/weaviate-1) — Vector database with hybrid search and an API key-protected API
- [Möbius v0.1 Personal AI OS](https://railway.com/deploy/mobius-v01-personal-ai-os) — Self-hosted AI agent that builds and runs apps for you, with memory.

Open this page in a browser: https://railway.com/deploy/engram-or-just-updated-ai-agent-memory-s