Deployment

@invokta/deploy turns an engine with an MCP Streamable HTTP entry point into a reviewable container build context. It generates text files but does not run a package manager, compiler, container tool, or shell command.

Install the development toolkit
Terminal window
```
yarn add --dev @invokta/deploy
```
Scaffold the deployment boundary
Terminal window
```
invokta-deploy init
```
The command creates:
- invokta.deploy.json
- src/mcp-http.ts
- src/http-auth.ts
- src/env.ts
- .env.example
Existing files are never overwritten. The generated authentication module fails closed until you implement the identity check.
Build the engine
Terminal window
```
yarn build
```
The deployment manifest identifies the compiled HTTP entry point. Keep the engine build deterministic and verify it before packaging.
Generate the container context
Terminal window
```
invokta-deploy package
```
Invokta validates the manifest, package.json, one supported lockfile, and the compiled entry point before writing anything. It then generates a Dockerfile, .dockerignore, bounded health check, and operator notes.

The current package command expects a standalone engine project as its build context. Point it at the engine package rather than a monorepo workspace container that depends on files outside that context.

Probe the deployed endpoint

invokta-deploy probe \
  --url https://engine.example/mcp \
  --expect alive

An alive probe accepts either a valid MCP initialization response or an HTTP 401 Bearer challenge. A ready probe requires a valid initialization result:

ENGINE_PROBE_TOKEN="replace-at-runtime" \
  invokta-deploy probe \
    --url https://engine.example/mcp \
    --expect ready \
    --bearer-env ENGINE_PROBE_TOKEN

Generated files are source files

Commit and review the generated container context. Every generated file carries an Invokta marker, and the toolkit overwrites only files carrying that marker. An unmarked file produces a conflict instead of being replaced.

The generated .dockerignore excludes .env*, test output, coverage, Git data, and local dependencies. Credentials enter at runtime through the deployment platform.

For HTTP adapter behavior, including Host and Origin validation, see the @invokta/mcp reference. The @invokta/deploy reference lists the manifest fields, ownership rules, probe grammar, limits, exit codes, and programmatic API.