mcp-home

A personal remote MCP server: one home for a few tools any MCP client can reach once its owner lets it in.

Endpoint

MCP endpoint: https://mac-mini-arkadiusz.tail5d2a2d.ts.net/mcp (Streamable HTTP, POST only, JSON responses).

Protocol versions: 2026-07-28 (stateless; per-request _meta, server/discover) and 2025-11-25 through the initialize handshake for older clients. No sessions are kept.

Tools

Every successful call returns structuredContent that matches the tool's outputSchema, and the same JSON as text. Input that does not fit the schema comes back as a tool error (isError: true) with the reason.

Tool	Input	Result	What it does
`memo_write`	`{ text }`	`{ id, created_at }`	Saves a text note (up to 20,000 characters).
`memo_search`	`{ query }`	`{ notes: [{ id, text, created_at }] }`	Notes that contain every word of the query, case-insensitive, newest first, at most 50. An empty query lists the newest notes.
`upload`	`{ filename, content_base64, mime_type? }`	`{ url, filename, mime_type, size }`	Stores a file (up to 25 MB) and returns a public link served by this server at `https://mac-mini-arkadiusz.tail5d2a2d.ts.net/files/…`. Anyone with the link can open it; the link contains a random 144-bit id. Media, images, PDF and plain text open in the browser; other types download.
`transcribe`	`{ url }`	`{ language, segments: [{ start, end, text }] }`	Downloads audio from a public http(s) URL (or reads a link from `upload`), and transcribes it on this server with whisper.cpp. `start` and `end` are seconds. Up to 30 minutes of audio. No audio leaves this machine.

Sign-in

OAuth 2.1 with PKCE (S256). This server is both the resource server and the authorization server.
Protected resource metadata: https://mac-mini-arkadiusz.tail5d2a2d.ts.net/.well-known/oauth-protected-resource/mcp. Authorization server metadata: https://mac-mini-arkadiusz.tail5d2a2d.ts.net/.well-known/oauth-authorization-server.
Clients identify themselves with a Client ID Metadata Document (an https client_id) or register at https://mac-mini-arkadiusz.tail5d2a2d.ts.net/register (Dynamic Client Registration, kept for older clients).
Nobody gets in by registering. Every sign-in stops at a consent page that shows the client's name and where it will be sent back; only the owner can approve it, with the owner passphrase. Five wrong passphrases lock approvals for 15 minutes.
Access tokens are opaque, last one hour and are accepted only for https://mac-mini-arkadiusz.tail5d2a2d.ts.net/mcp (the resource they were issued for). Refresh tokens last 30 days and rotate on every use; reusing an old one revokes the whole sign-in.
Scope: mcp (all four tools). Limits: 120 requests a minute and 20 transcriptions an hour per client.

Data it keeps

Notes: text, id, time saved, and which client saved it. Kept until the owner deletes them.
Uploaded files: the bytes, file name, media type, size, time and client. Public to anyone with the link. Kept until the owner deletes them.
Audio for transcription: held in a temporary folder only while it is transcribed, then deleted. The transcript is returned, not stored.
Sign-in records: registered clients (name, redirect URIs), and SHA-256 hashes of codes and tokens until they expire. Raw tokens are never stored.
Log: time, client id, method and tool name, status and duration of each call. No note text, file content or tokens.

Everything lives on one computer owned by the operator. Nothing is shared with third parties.