Cloudflare Agent Memory: Where Durable Recall Meets Readable Truth

Cloudflare Agent Memory is a managed memory service for applications running on Workers: it extracts durable knowledge from conversations, isolates it by profile, and recalls relevant context later. It is a strong fit when an agent needs low-friction recall close to its Cloudflare runtime. It is not automatically the right source of truth for architecture decisions, operating procedures, or knowledge that humans and multiple agent clients must review.

The practical design is often two layers: use Cloudflare for conversational recall, and keep authoritative project memory as files you can read, edit, diff, and self-host—not only as synthesized answers from an opaque index. This is the same distinction behind a sound persistent agent memory architecture.

What Cloudflare Agent Memory actually does

As of October 2026, Agent Memory is in private beta. Cloudflare documents four extracted memory types: facts, events, instructions, and tasks. Facts and instructions can supersede older versions; events accumulate; tasks are deprioritized after their session ends. Raw conversation messages are also retained alongside extracted memories.

Ingestion is more than vectorization. Cloudflare extracts items, classifies them, deduplicates them, assigns topic keys, and stores full-text indexes; non-task memories also receive vector embeddings. Recall combines keyword, topic-key, semantic, and raw-message retrieval, then synthesizes an answer. Profiles isolate users, teams, tenants, agents, or application objects, while namespaces separate applications, environments, or memory layers.

The current top-ranking material covers that product model well. Cloudflare’s announcement explains the extraction and recall pipeline; its overview documents types, profiles, namespaces, and APIs; and its getting-started guide supplies a complete Agents SDK implementation with delayed ingestion. The missing operational question is: which memory is allowed to become authority?

A minimal Worker binding

If you have private-beta access, the core API is small. Create a namespace with npx wrangler agent-memory namespace create support-agent, then bind it in wrangler.jsonc:

{
  "$schema": "./node_modules/wrangler/config-schema.json",
  "name": "support-agent",
  "main": "src/index.ts",
  "compatibility_date": "2026-10-08",
  "agent_memory": [
    { "binding": "MEMORY", "namespace": "support-agent" }
  ]
}

After running npx wrangler types, this Worker stores an explicit preference and recalls it. The profile name is deliberately supplied by the URL so the isolation boundary is visible; production code should derive it from authenticated identity, never an untrusted query parameter.

export default {
  async fetch(request: Request, env: Env): Promise<Response> {
    const url = new URL(request.url);
    const profile = await env.MEMORY.getProfile("user-42");

    if (request.method === "POST") {
      await profile.remember({
        content: "User 42 prefers TypeScript examples.",
        sessionId: "onboarding"
      });
      return new Response("stored", { status: 201 });
    }

    const result = await profile.recall("preferred code language", {
      responseLength: "short"
    });
    return Response.json({ answer: result.answer, count: result.count });
  }
} satisfies ExportedHandler<Env>;

This is runnable against the documented Workers binding, but it is intentionally smaller than Cloudflare’s full chat tutorial. For automatic extraction, call ingest() in batches after idle time or compaction—not after every turn. Current documented limits include 500 messages per ingest call, 32 KB per message, and a 1 KB recall query. Cloudflare says it is not billing during private beta and promises at least 30 days’ notice before charging.

The authority boundary top results omit

Retrieval quality and authority are different properties. A recalled preference can be useful even when imperfect. A deployment runbook cannot silently drift because an extractor interpreted a conversation differently. Divide memory by the consequence of being wrong:

Knowledge	Primary home	Why
Personal preferences, prior support context	Cloudflare Agent Memory	Profile-scoped retrieval and automatic extraction reduce plumbing.
Current conversation and tool state	Agent Session / Durable Object	High-frequency runtime state should stay close to execution.
Architecture decisions, runbooks, product rules	Readable versioned files	Humans can review exact wording, ownership, history, and corrections.
Search over large changing relationships	Zep/Graphiti or another graph layer	Temporal relationships benefit from graph-native retrieval.
Agent-owned evolving context	Letta MemFS	Git-backed context repositories suit agents that actively reorganize their own memory.

Meshnote fills the readable project-truth role: agents maintain Markdown wikis through MCP, while people can inspect and self-host the files. That makes it complementary to runtime recall rather than a forced replacement. The pattern also lets Claude Code, Cursor, Codex, and other MCP clients share the same decisions; see the cross-tool memory architecture.

How Cloudflare compares honestly

Option	Best fit	Main trade-off
Cloudflare Agent Memory	Managed scoped recall inside Workers applications	Private beta; extracted and synthesized memory is less directly reviewable than canonical files.
Mem0	Adding a dedicated memory API to an existing agent stack	Convenient extraction and hybrid retrieval, but governance and canonical-document workflows need deliberate design.
Zep / Graphiti	Temporal facts and changing entity relationships	Richer time-aware graph model brings more conceptual and operational complexity.
Letta	Stateful agents that own and edit their context	Strong agent-centric runtime model; it may be more runtime commitment than an app needs.
Native ChatGPT or Claude memory	Personal continuity within one vendor’s product	Simple for users, but not a shared application database or portable team knowledge base.
Readable MCP wiki	Auditable, shared, agent-agnostic project knowledge	Requires an explicit write policy; structured semantic recall may still deserve a separate index.

Do not choose from a benchmark headline alone. The vector versus readable memory comparison explains why retrieval scores do not measure correction, provenance, export, or human review.

Run a six-case authority drill

Before production, seed a test tenant and run this drill. It is the original element missing from the three leading pages: it evaluates not just recall, but whether the system preserves authority under change.

1. Isolation: store contradictory preferences in two profiles. Each profile must return only its own fact.
2. Supersession: change “TypeScript” to “Python.” Normal recall should surface the new preference without erasing the fact that a change occurred.
3. Provenance: ask where a critical instruction came from. Decide whether a synthesized answer and candidate IDs are sufficient, or whether the instruction belongs in a cited file.
4. Human correction: repair a wrong architecture decision without replaying a chat. If reviewers cannot make and verify the correction directly, move that class of knowledge to the readable layer.
5. Deletion: delete one session and then the profile. Verify that unrelated profiles remain intact and that your application stops retrieving deleted data.
6. Runtime exit: disable the memory integration. Confirm that critical runbooks and decisions are still understandable from exported, versioned project files.

A failure does not necessarily reject Cloudflare. It tells you where its boundary should sit. Runtime recall can remain managed while durable project truth lives in a system designed for review and portability.

A production rule that stays simple

Let Cloudflare remember what helps the application respond. Promote only stable, consequential knowledge into readable project memory. Require a title, scope, source, and correction path for every promoted page. Never let an extracted preference silently overwrite a security rule or operating procedure.

For teams building on Workers, that split gives you fast managed recall without turning every synthesized memory into policy. If you want the authoritative layer to remain Markdown your agents can maintain over MCP, Start syncing — $8/mo. For an owned team deployment, Self-hosted for teams from $10/seat/month.

Related Reading

• Persistent Memory for LLM Agents: A Production Architecture
• Shared Memory Across AI Tools: A Practical MCP Architecture
• Vector Memory vs Readable Memory
• MCP Memory Server: A Practical Guide