Krzysztof's tools

A remote MCP server of one person, built in the MEGA.dev course (S02E03, November 2026). Endpoint: https://mcp.minutkaapp.pl/mcp. Protocol revision 2026-07-28; 2025-11-25 clients are served too.

Tools

Tool	Input	Result
`memo_write`	`{ text }`	`{ id }`. Saves a note on this server.
`memo_search`	`{ query }`	`{ notes: [{ id, text, createdAt }] }`. Word match, best first; empty query gives the newest notes. Up to 20.
`upload`	`{ name?, mimeType?, content \| text \| url }`	`{ url, id, name, mimeType, bytes }`. Stores the file and serves it at `/files/<id>/<name>` for anyone with the link. Limit 10 MB.
`transcribe`	`{ url }`	`{ segments: [{ start, text }], language?, durationSeconds?, truncated?, fullUrl? }`. `start` in seconds; the text block holds the plain transcript. The result stays within 1 KB: a longer transcript is kept whole as a JSON file on this host (segments with start, end, text) and `fullUrl` links to it. Audio up to 25 MB.

Every result comes back as structuredContent matching the tool's declared outputSchema, plus a text block (the same JSON; for transcribe the plain transcript). A failed call returns isError: true with one plain sentence that names what failed, for transcribe the url.

Sign-in

The endpoint takes OAuth 2.1 bearer tokens only. A call without a valid token gets 401 with WWW-Authenticate: Bearer resource_metadata="https://mcp.minutkaapp.pl/.well-known/oauth-protected-resource/mcp".

Protected resource metadata: /.well-known/oauth-protected-resource/mcp (also at the root path).
Authorization server: this same host. Metadata at /.well-known/oauth-authorization-server.
Clients register with POST /register (dynamic client registration) or present a Client ID Metadata Document (an https client_id URL). Redirect URIs must be https, or http on localhost.
Flow: authorization code with PKCE S256, resource=https://mcp.minutkaapp.pl/mcp, iss on the redirect. The owner approves each client on the consent page with a password only they know. Nobody else can let a client in.
Access tokens live 7 days, refresh tokens 90 days and rotate on use. Scope: mcp.

Data kept here

Notes: text, time saved and the client id that saved it. Kept until the owner deletes them.
Uploads: the file bytes, name, type, size, time and client id. Public to anyone with the link, which holds a random id. Kept until the owner deletes them.
Transcripts: not stored. The audio is downloaded, sent to the speech-to-text provider (OpenAI, model whisper-1) and dropped. The provider's own retention applies to that request.
OAuth state: registered clients, pending codes (10 minutes), tokens with expiry. No passwords besides the owner's, which lives only in the server's environment.
Logs: method, path, status and timing per request, kept on the host. No tokens, no note text.

Rate limits: 5 consent attempts and 30 token requests per minute per address; 120 tool calls per minute per token. Health: /health.