mega-tools
A remote MCP server. Four tools, one home. It is mine, it is yours to use, and it stays where it is.
The tools
| Tool | What it does | Input | Result |
|---|---|---|---|
| memo_write | Saves a note on the server and returns its id. | { text } | { id } |
| memo_search | Finds saved notes whose text contains the query. Case-insensitive substring match. An empty query returns every note, newest first. | { query } | { notes: [{ id, text, createdAt, updatedAt }] } |
| upload | Stores a file on the server and returns a link anyone can open. Give the file as url (the server downloads it), content (text), content_base64 (bytes), or path (a file already in the server data folder). | { url | content | content_base64 | path, filename? } | { url, id, filename, bytes } |
| transcribe | Turns audio or video at a link into timestamped text. The server downloads the file, transcribes it locally, and returns the segments. start is in seconds from the beginning. | { url } | { segments: [{ start, end, text }] } |
Every tool declares an input schema and an output schema, and every answer comes back as structured content that matches the output schema it declares.
How sign-in works
Only a client I approved can call the tools. The sign-in is OAuth 2.1 with PKCE, run by this server itself:
- A client registers itself with POST https://mcp.srv1421711.hstgr.cloud/register (dynamic client registration) and gets a client id. A public client gets no secret.
- It sends the browser to https://mcp.srv1421711.hstgr.cloud/authorize. I see the request and press Approve or Deny. Nothing else is needed from me, and the client cannot skip this step.
- On Approve the server hands out a one-time code. The client exchanges it for an access token at POST https://mcp.srv1421711.hstgr.cloud/token, proving it holds the PKCE verifier.
- The access token is a bearer token. It goes in the Authorization header on every call to https://mcp.srv1421711.hstgr.cloud/mcp. Refresh tokens work too, and tokens can be revoked.
The metadata for this lives at https://mcp.srv1421711.hstgr.cloud/.well-known/oauth-protected-resource and https://mcp.srv1421711.hstgr.cloud/.well-known/oauth-authorization-server. This page is named there as the resource_documentation of the resource.
What data it keeps
- Notes. The text passed to memo_write, with an id and a timestamp. They stay until the data folder is wiped.
- Uploaded files. The bytes of anything passed to upload, with a name and a size. The link returned points at this server and is readable by anyone who has it.
- Sign-in records. Registered clients, issued tokens and their scopes. Tokens are random strings; passwords are never stored.
- A request log. One line per request: method, tool, arguments with tokens masked, and the outcome. It is for me, not for the tools.
Nothing is shared with a third party. Transcription runs on the machine that serves this page; no audio leaves it.
The protocol
This server speaks the current MCP revision, 2026-07-28: stateless, with the protocol version in the _meta of every request and server/discover to advertise what it supports. It also answers the older, initialize-based revisions so older clients still work. Versions: 2026-07-28, 2025-11-25, 2025-06-18.