Sight Cache

Sight Cache — A serverless camera history pipeline built on Cloudflare that gives AI agents a compact, inspectable visual memory through MCP.

How it works

Administrator <--> Cloudflare Access <--> Admin Worker
                                                +--> D1 devices + token hashes
                                                `--> Collector Token (shown once)

RTSP camera --> FFmpeg Collector --> Ingest Worker --> D1 activity
                                                   `--> R2 original JPEGs

MCP client <--> Access Managed OAuth <--> Image Worker
                                          ^  |  |
Hourly cron --> Queue ---------------------'  |  +--> Cloudflare Images
R2 original JPEGs ----------------------------'  `--> R2 contact sheets + manifests

Related MCP server: C2PA Intake Verifier MCP

Components

Cloudflare services

This project uses the following Cloudflare services and Workers features:

MCP inspection

The Image Worker exposes a stateless /mcp endpoint protected by Cloudflare Access Managed OAuth.

Hourly windows contain 60 one-minute samples across six contact sheets. Minute windows contain 12 five-second samples across two contact sheets and are built on the first request after a five-minute finalization delay.

Storage layout

Object keys use the normalized UTC capture time:

frames/{deviceId}/{YYYY}/{MM}/{DD}/{HH}/{mm}/{UTC_TIMESTAMP}.jpg

contact-sheets/v1/{deviceId}/{YYYY}/{MM}/{DD}/{HH}/
|-- manifest.json
|-- generations/{generationId}/sheet-{NN}.jpg
`-- {mm}/
    |-- manifest.json
    `-- generations/{generationId}/sheet-{NN}.jpg

The hour-level manifest publishes scheduled hourly sheets. A minute directory contains its on-demand sheets.

Requirements

• Node.js 24.19.0 or later

• FFmpeg, or Docker with Compose, for the Collector

• A reachable RTSP camera stream

• Cloudflare Workers Paid plan

Getting started

Install all workspace dependencies and run the available type checks:

npm ci
npm run typecheck

Before deployment, provision the shared D1 database and R2 bucket, the contact-sheet Queues, and the required Access applications, then complete each wrangler.jsonc for your environment.

Apply the D1 migration from the repository root:

# Local D1
npm run dev:migrate --workspace admin-worker

# Remote D1
npm run prod:migrate --workspace admin-worker

Run each service in its own terminal:

npm run dev --workspace admin-worker
npm run dev --workspace ingest-worker
npm run dev --workspace image-worker
npm start --workspace @sight-cache/collector

Create a device in the Admin Worker, save the Collector Token when it is shown, then configure apps/collector/.env from apps/collector/.env.example with the Ingest URL, token, and RTSP URL. See each component guide for its detailed configuration and behavior.

After completing the account-specific configuration and applying the remote D1 migration, deploy the Workers:

npm run deploy --workspace admin-worker
npm run deploy --workspace ingest-worker
npm run deploy --workspace image-worker

Security and retention

• Protect the Admin Worker and every route that can reach /mcp with the matching Cloudflare Access applications.

• Every identity admitted by the MCP Access policy can currently inspect every active device. Keep that policy restricted until per-device authorization is implemented.

• Before enabling image ingestion, consider configuring the shared R2 bucket with a lifecycle rule that expires objects after 14 days.

Documentation

• Collector

• Admin Worker

• Ingest Worker

• Image Worker and MCP