Personal MCP tools

This server gives its owner and explicitly approved MCP clients one shared home for notes, file uploads, and audio transcription. The MCP endpoint is /mcp. It supports MCP 2026-07-28 and 2025-11-25 over Streamable HTTP, using JSON responses. It has no SSE subscription stream.

Tools and schemas

Use tools/list to read the exact input and output JSON Schemas. Successful calls and tool errors both return structuredContent matching the declared outputSchema, plus the same JSON as text for older clients.

memo_write

Accepts text (1-64,000 characters), stores it unchanged, and returns id. All approved clients share the owner's notebook.

memo_search

Accepts query and returns notes containing id, text, and created_at (Unix seconds). Search is a literal Unicode case-insensitive substring. An empty query lists recent notes. Results are newest first, limited to 100; truncated reports additional matches.

upload

Accepts filename and content_base64 (standard base64 of the real file bytes), with optional content_type (a MIME type). Returns url on this same server. Maximum decoded size is 25 MiB. The link needs no sign-in: anyone who has it can download the file. Do not upload secrets.

transcribe

Accepts url pointing to public HTTP(S) audio or an uploaded file. Returns language and segments with start, end (seconds), and text. Runs the multilingual Whisper small model locally on CPU; audio is not sent to a model API. Maximum 25 MiB and five minutes. One transcription runs at a time, with a 150-second execution limit. Silence may return an empty list. Private/reserved networks and credentials in URLs are rejected, including after redirects; outbound connections are pinned to validated DNS addresses.

Sign-in and consent

Unauthenticated MCP calls receive HTTP 401 with OAuth protected resource discovery. Resource and authorization-server metadata are public. OAuth authorization code flow requires PKCE S256, the exact registered redirect URI, and resource pointing to this server's /mcp endpoint. Dynamic registration is available for public clients using token endpoint authentication method none; registration alone grants no tool access.

The owner must enter their private owner password and press Approve for each authorization. The consent page names the client and redirect address. Scope mcp grants all four tools and access to the shared notebook. Approval uses a short-lived CSRF-protected same-origin form. Access tokens expire after one hour. Refresh tokens rotate and expire after 30 days. Reusing an already-rotated refresh token revokes that client's grant. Tokens are resource-bound, and only hashes are stored. To revoke a client, use /oauth/revoke with its token and client_id. The owner can revoke all grants using the server's revoke-all command.

Stored data and limits

The owner's VPS retains note text, normalized search text, timestamps, uploaded file bytes and names, OAuth client registrations, approved grants, and hashes of tokens and the owner password. Notes and uploaded files remain until the owner deletes them; there is no automatic expiration or backup. The note budget is 64 MiB and public uploads have a 512 MiB total budget. Data survives container restarts in a private host directory.

Downloaded transcription audio lives in a temporary directory and is removed after processing, including errors. A prior upload remains public until the owner removes it. Transcripts are returned to the caller but are not stored as notes automatically. Server access logs omit request bodies, authorization headers, OAuth codes, and URL query strings. The owner's separate course request log is private and masks credentials.

There is no paid transcription API. Existing VPS and bandwidth charges still apply. Installation downloads open-source software and model weights. HTTPS uses Caddy and public certificate authorities; the hostname appears in public certificate-transparency logs. The operator is the VPS owner.

Operational plan

Caddy terminates public HTTPS on ports 80/443. A non-root application container is reachable only on the private Docker network. It has CPU, memory, process, request, and storage limits. The owner password stays out of MCP configuration and client tokens. Only authorized clients may invoke tools. Download links, this page, health, and OAuth metadata are deliberately public.