Paulina's toolbox

A remote MCP server. Endpoint: https://mcp.35-189-248-35.nip.io/mcp (Streamable HTTP, protocol versions 2025-11-25, 2025-06-18, 2025-03-26).

What the tools do

Tool	What it does	Input	Result
`memo_write`	Saves a note on the server. Returns the new note's id.	`text`	`id`
`memo_search`	Finds saved notes whose text contains the query (case-insensitive; every word must match). An empty query returns all notes. Newest first.	`query`	`notes`
`upload`	Stores a file on this server and returns a public link to it, served by this server. Give the file as base64 in content_base64, as plain text in content_text, or as a source_url to copy from. Max 25 MB.	`filename, content_base64, content_text, source_url, mime_type`	`url, id, size, mime_type`
`transcribe`	Turns audio at a url (mp3, wav, m4a, ogg, flac, webm) into timestamped text segments; start and end are in seconds.	`url`	`segments, language`

Every result comes back as structuredContent that matches the tool's outputSchema, plus the same JSON as text.

Every call to /mcp needs an OAuth 2.1 bearer token. Without one the server answers 401 with a WWW-Authenticate header that points to the protected resource metadata.
This server is its own authorization server: metadata. Clients register with Dynamic Client Registration (/register) or use a Client ID Metadata Document (an https URL as client_id).
Authorization code flow with PKCE (S256 only). Tokens are bound to the resource https://mcp.35-189-248-35.nip.io/mcp; scope mcp.
Only those the owner lets in can use it: the consent page asks for the owner's passphrase before it issues a code.
Access tokens live 60 minutes; refresh tokens 30 days and rotate on use.

Notes from memo_write: text, id, time, and which client wrote it. Kept until the owner deletes them.
Files from upload: the bytes, name, type and size. Anyone with the link can open a file; links are unguessable.
Audio for transcribe is fetched, sent to a speech model on the owner's LLM gateway, and not stored. Transcripts are not stored.
OAuth: registered clients (name, redirect URIs) and hashes of codes and tokens. No passwords or emails of callers.
A short request log (time, path, status, tool name) for debugging. No request bodies.

Owner: Paulina Wawdysz (MEGA.dev S02E03).