To set up the Medplum [`Bot`](/content/docs/api/fhir/medplum/bot/index.html) framework locally, Medplum offers VM Context [`Bots`](/content/docs/api/fhir/medplum/bot/index.html). VM Context allows bots to spin up a local thread inside your server, rather than using an isolated lambda.

Before enabling VM Context [Bots](/content/docs/api/fhir/medplum/bot/index.html), you must first enable bots on your project. To do so, follow these steps:

1. Log in to your [Super Admin Project](/content/docs/self-hosting/super-admin-guide/index.html).
2. Access your [Project](/content/docs/api/fhir/medplum/project/index.html) resource.
3. Go to the `Edit` tab.
4. In the `Features` section, add the `bot` feature.

note

The `defaultProjectFeatures` server config setting is used for default features when your project is being set up. Editing this config setting will not update your project to enable bots.

Once this is done, you can enable VM Context bots. There are two steps to set up VM context bots:

1. Enable VM Context [`Bots`](/content/docs/api/fhir/medplum/bot/index.html) on your server config.
2. Set your [`Bot's`](/content/docs/api/fhir/medplum/bot/index.html) runtime version to VM Context.

To enable VM Context [`Bots`](/content/docs/api/fhir/medplum/bot/index.html) on your server, set `vmContextBotsEnabled: true` in both the AWS parameter store and your local `config.json` file.

All [`Bots`](/content/docs/api/fhir/medplum/bot/index.html) have a field for `runtimeVersion`, which can be set to either `awslambda` or `vmcontext`. To use your [`Bot`](/content/docs/api/fhir/medplum/bot/index.html) locally, set this field to `vmcontext`.

Using VM Context allows you to use resources more efficiently, however it can also have security and isolation concerns if used in an untrusted environment. For this reason, it is important to only use VM Context [`Bots`](/content/docs/api/fhir/medplum/bot/index.html) in trusted environments.

danger

**The `node:vm` module is not a security mechanism. Do not use it to run untrusted code.**

The code for these bots runs in the server, so they can potentially have access to sensitive information when run in production environments without appropriate safety measures.