memo

A remote MCP server that keeps notes, stores files and transcribes audio.

Endpoint: https://memo.ataga.ovh/mcp — Streamable HTTP, MCP revision 2025-11-25 (older revisions 2025-06-18 and 2025-03-26 work too). This server is a student project, not a product.

What the tools do

Tool	Input	Result
`memo_write`	`{ text: string }`	`{ id, text, createdAt }` — the note is saved on this server.
`memo_search`	`{ query?: string }`	`{ notes: [{ id, text, createdAt }] }` — case-insensitive substring match, newest first. An empty query returns every note.
`upload`	`{ name?, mime?, content_base64?, text? }`	`{ url, id, name, size }` — the file is stored here and `url` is public: anyone with it can open the file.
`transcribe`	`{ url: string }`	`{ segments: [{ start, end, text }], duration }` — `start` and `end` are seconds.

Every tool declares an output schema and returns structured content that matches it, plus the same data as text.

How sign-in works

The server is its own authorization server. A client registers itself by dynamic client registration, then opens an authorization page. The owner of this server reads that page and enters a pass phrase to approve the client. The client then trades a PKCE authorization code for a bearer token, valid for 12 hours, with a refresh token valid for 30 days.

Protected resource metadata: /.well-known/oauth-protected-resource/mcp
Authorization server metadata: /.well-known/oauth-authorization-server
Registration: POST /register (public)
Approval: GET /authorize, then POST /approve with the pass phrase
Token and refresh: POST /token
Revocation: POST /revoke

Every endpoint under /mcp needs a bearer token. Requests without one get 401 and a WWW-Authenticate header that points at the protected resource metadata above.

What data it keeps

Notes: the text, an id and the time of the call. Kept until deleted by hand.
Uploaded files: the bytes, name, content type and size, plus a public link. Kept until deleted by hand.
OAuth records: registered client names, and access and refresh tokens. Kept on this server; no password and no email address is stored.
Server logs: request paths and errors, kept by the host's container log for a short time. Note text, file contents and tokens are not logged.

transcribe is the one tool that sends data off this host: the audio file at the given url is passed to an OpenAI-compatible model service (OpenRouter) to make the transcript. The other three tools keep everything on this server. No analytics, no cookies, no third-party trackers.

Taking it down

The owner can revoke a token at POST /revoke or delete the whole data directory on the host.

Back