A single-owner remote MCP server for MEGA.dev S02E03. The endpoint is /mcp.
It supports MCP revision 2026-07-28 and the preceding handshake-era revision via the official Python MCP SDK.
All four tools declare JSON input and output schemas, and return matching structuredContent.
{text}; saves the exact note text (1–20,000 characters) and returns {id}.{query}; performs a case-insensitive literal-substring search and returns {notes: [{id, text, created_at}]}, newest first, up to 200 matches. An empty query returns recent notes.{filename, content_base64, content_type?}; stores decoded bytes and returns {url}. Nonempty files up to 20 MiB are accepted, with 200 MiB total storage. The URL is served by this server and is public to anyone holding the link for seven days. Files are served as downloads, not executed as pages.{url}; reads a public HTTPS audio file or an uploaded file, and returns {segments: [{start, end, text}]}. Timestamps are seconds from the audio's beginning. It uses multilingual Whisper small locally on CPU; it does not call a paid or external speech-to-text API. Audio is limited to 20 MiB and ten minutes. Private-network URLs, unsafe redirects, credentials in URLs, and non-HTTPS downloads are blocked.This server has one owner and no public account creation. MCP calls need a bearer access token issued specifically for this endpoint.
Unauthenticated requests return 401 and advertise OAuth protected-resource metadata at /.well-known/oauth-protected-resource/mcp.
That document points to this plan through resource_documentation and to the authorization server metadata.
Clients use OAuth authorization code flow with S256 PKCE and the MCP resource indicator. Client ID Metadata Documents are supported; dynamic registration is also available for older clients. Registering a client alone grants no access. The owner must enter their private owner password and explicitly approve the named client in a browser. The consent page identifies the client and its callback URL and explains the granted access.
The toolbox scope permits all four tools. Every approved client shares the same owner's notebook.
Access tokens expire after one hour. Optional offline_access grants rotating refresh tokens valid up to 30 days;
reuse of an old refresh token revokes that authorization's token family. Tokens are bound to the client and this MCP endpoint.
The owner can revoke a client locally; clients can revoke their tokens at /oauth/revoke.
A separate, private local-harness credential expires after seven days.
Notes, uploaded bytes, client metadata, approved grants and token hashes persist in a private SQLite database and private upload directory on the owner's machine. Notes remain until the owner deletes them. Upload links expire after seven days; expired blobs are removed during maintenance. Temporary authorization requests expire after ten minutes and single-use authorization codes after two minutes. Expired grants are removed during maintenance. The owner password is verified using a salted scrypt hash; access and refresh tokens are stored as hashes.
Downloaded audio is processed in memory and not retained as a separate file. Transcripts are returned to the caller, not automatically saved as notes. Private local audit logs record requests and replies with passwords and authorization credentials redacted; logs may contain note text and transcription results. The owner controls log retention and deletion. Logs, the database, owner credentials and source directories are never served as public files.
Only health status, OAuth discovery and client registration, this plan, consent pages, and intentionally public upload links are unauthenticated. The MCP endpoint checks authorization on every request. Host validation, request limits, rate limits and download address validation apply. Origin-header validation is disabled by the owner's choice. OAuth consent still requires the owner password, explicit approval, a browser-bound CSRF token, and S256 PKCE.
The application listens on loopback. The public address is https://34.52.243.212.nip.io/mcp,
served directly by this machine behind a local HTTPS reverse proxy. No Cloudflare tunnel is used.
The server is available only while this machine and its server processes run.
The hostname and issued certificate are public. Stopping the HTTPS service withdraws public access;
deleting an uploaded blob revokes its link.