MEGA memo, upload and transcribe MCP server

This is a private remote Model Context Protocol server. Its endpoint is https://srv2092601.hstgr.cloud/mcp (Streamable HTTP, protocol revision 2026-07-28; older clients may use 2025-11-25, 2025-06-18 or 2025-03-26). Only apps the owner lets in can use it.

What the tools do

ToolInputResultWhat it does
memo_write{ text }{ id, created_at }Saves a note (up to 20000 characters).
memo_search{ query, limit? }{ notes: [{ id, text, created_at, text_truncated? }], truncated?, match_count? }Finds notes. Notes containing the whole query come first, then notes containing all its words, then any of them; newest first within each group. An empty query lists the newest notes.
upload{ filename?, content_base64? | content_text? | url?, mime_type? } (exactly one content source){ url, id, filename, size, mime_type, expires_at }Stores a file (max 10 MB) on this server and returns a link under https://srv2092601.hstgr.cloud/files/ that anyone can open.
transcribe{ url, language? }{ segments: [{ start, end, text }], language, duration, truncated?, segment_count? }Downloads audio from a public https/http URL (max 25 MB, max 10 minutes) and turns it into timestamped text. start and end are seconds. Runs open-source Whisper on this server (small, or small.en for English, for clips up to 45 s; base for longer ones).

Every tool declares an input schema and an output schema, and every result is returned as structuredContent matching that output schema plus a text block for older clients: the same JSON when it is small, otherwise a short summary. Each tool result is kept under 1 KB: start/end are rounded to 0.01 s, and when a result would be larger, memo_search returns fewer notes (or a shortened note) and transcribe returns the first segments, with truncated: true and the total count.

How sign-in works

  1. A request without a token gets 401 with WWW-Authenticate: Bearer resource_metadata="https://srv2092601.hstgr.cloud/.well-known/oauth-protected-resource/mcp".
  2. That protected resource metadata names this host as the OAuth 2.1 authorization server (https://srv2092601.hstgr.cloud/.well-known/oauth-authorization-server).
  3. Apps identify themselves with a Client ID Metadata Document (an https client_id URL) or register through Dynamic Client Registration at https://srv2092601.hstgr.cloud/register.
  4. The app sends the user to https://srv2092601.hstgr.cloud/authorize with PKCE (S256) and resource=https://srv2092601.hstgr.cloud/mcp. The consent page shows which app is asking and where it will send you back; only the server owner can approve, by entering the owner password. Anyone else can only deny.
  5. The app exchanges the code at https://srv2092601.hstgr.cloud/token for an access token (valid 1 hour, bound to https://srv2092601.hstgr.cloud/mcp) and a rotating refresh token (valid 30 days). Tokens can be revoked at https://srv2092601.hstgr.cloud/revoke; the owner can revoke all of them at any time.

What data it keeps

DataKeptFor how long
Notes from memo_writeText, id, time, id of the app that wrote itUntil the owner deletes them
Files from uploadThe file, its name, type and size, the app id; publicly readable by anyone with the link30 days, then deleted
Audio for transcribeNot stored. It is downloaded, written to a private temporary file, transcribed on this server, and the file is deleted as soon as the transcript is ready. Audio is not sent to any third party.Not kept
Registered appsName, redirect URIs and other registration metadata; only a hash of any client secretUntil the owner removes them
Sign-in dataOnly SHA-256 hashes of codes and tokens, with app id and expiryCodes 5 minutes, access tokens 1 hour, refresh tokens 30 days
LogsTime, method, path, status, duration, tool name, app id. No note text, file contents, tokens or passwords.System journal rotation

Data lives on this server's disk only and is not shared with anyone.