Production deployment

The standalone server is a runtime process, not a complete production platform.

Production checklist

Before a remote deployment	Why
Add an authenticator or trusted authenticated proxy	Identify callers
Replace `MemoryStore`	Keep sessions and checkpoints
Inject model, MCP, and provider credentials	Keep secrets out of source
Terminate TLS outside the launcher	Protect traffic
Add process supervision and scaling	Run reliably
Enforce network policy outside the launcher	Control reachability

Harnest standalone server	Deployment platform
Agent API and event model	TLS termination
Request limits and concurrency	Secret injection
Application authentication hook	External identity proxy, if used
Session and checkpoint interfaces	Durable database operations
Health endpoint	Process supervision and autoscaling
Structured telemetry	Collector, storage, alerts, and retention

A non-loopback bind is not a security boundary. allowRemote: true adds no authentication, TLS, or network policy.

Establish caller identity and resolve downstream credentials.

Replace process-local state with a durable backend.

Export privacy-safe logs, traces, and audit signals.

Keep local runtime settings separate from platform operations.