A personal remote MCP server for one owner's approved agents. Endpoint: /mcp.
Supports MCP 2026-07-28 (stateless per-request metadata) and
2025-11-25 (legacy initialize). Streamable HTTP returns JSON.
{text}, stores a durable note,
returns {id}.{query}, returns
{notes: [{id, text, created_at}]}. Case-insensitive substring matching;
an empty query returns the newest 100 notes, newest first.{filename, content_base64, content_type?}.
Standard base64 bytes, maximum 20 MiB. Returns {url} on this same host.
Anyone with the returned link can download the file, without sign-in.
Links contain 256 random bits. No file listing. Do not upload secrets.
Total file storage is limited to 512 MiB.{url} for public HTTP/HTTPS audio,
returns {segments: [{start, end, text}]}, timestamps in seconds.
Multilingual Whisper small runs on this machine's CPU. No paid API; no audio goes
to a transcription provider. Maximum 20 MiB and 15 minutes; one call at a time.
Silence may produce no segments. Invalid audio returns a tool execution error.Each tool declares inputSchema and outputSchema. Successful calls return validated structuredContent and matching serialized text. Errors use isError or JSON-RPC errors.
Tools require a bearer access token issued by this server for this exact MCP resource. Missing, invalid or expired tokens receive 401 with protected-resource metadata. OAuth discovery supports Client ID Metadata Documents (CIMD), plus dynamic client registration for older clients. OAuth 2.1 authorization code flow requires PKCE S256, exact registered redirect URIs, and the resource parameter. Access tokens last one hour; refresh tokens last 30 days, rotate on every use, and token-family reuse revokes access.
The owner enters a private local password on the consent page, checks the client and redirect host, and explicitly presses Approve. Registering a client alone grants no access. Only the owner can grant access; this site offers no public account creation. Approved clients share this owner's notebook and can see notes written by other approved clients. Do not approve an unknown client. The /revoke endpoint and local management command revoke access.
Origin header filtering is disabled at the owner's request. This differs from the MCP transport's required Origin validation for DNS-rebinding protection. Bearer authentication, explicit owner approval, CSRF form tokens and PKCE remain required.
SQLite on this machine stores notes, upload metadata, cached transcripts and OAuth records. Uploaded bytes are stored on disk. Notes, uploads and transcript caches remain until the owner deletes them with the local management command. Tokens are stored as hashes, not plaintext; authorization codes expire after five minutes and can be used once. Unapproved consent requests expire after ten minutes. The owner password is verified with scrypt.
Private request/reply audit logs remain on this machine until the owner deletes them; they may contain note and transcript text but redact credentials. The server does not publish source files, logs, private credentials, or its database. HTTPS certificates are renewed by Caddy. Downloads reject private, loopback and link-local destinations, pin validated DNS results, validate every redirect, and enforce time and size limits. Uploads are downloads with attachment headers and cannot run scripts in this site's origin. Requests are rate-limited.
To disconnect: revoke the client's tokens. To remove public files: delete them locally. To take this server offline: stop the schema-first and caddy services.