This Streamable HTTP MCP server exposes four protected tools at /mcp.
memo_write accepts {text: string} and returns {id: string}.memo_search accepts {query: string} and returns {notes: [{id, text, created_at}]}.upload accepts {filename: string, content_base64: string, content_type?: string}; it returns {url: string}. The link is public to anyone who has it.transcribe accepts {url: string} and returns timestamped segments with start, end, and text.OAuth 2.1 authorization-code flow with PKCE protects MCP calls. The owner must sign in before the browser consent page allows or denies client access. Consent forms are protected against cross-site requests. Tokens are audience-bound to this server.
Memos, uploaded file bytes, OAuth client registrations, consent state, and access tokens are stored in the server's SQLite database. Public uploads remain available by their unguessable links. Audio files are downloaded temporarily for local Whisper transcription and deleted after the call; transcripts are returned to the caller and are not stored.