A private Model Context Protocol server at https://mcp.sdet.it/mcp.
It speaks MCP 2026-07-28 (stateless Streamable HTTP) and also accepts 2025-11-25 clients that use the initialize handshake.
Only clients the owner approves can use it.
| Tool | Input | Result | What it does |
|---|---|---|---|
memo_write | { text } | { id, created_at } | Saves a text note (max 100 000 characters). |
memo_search | { query?, limit? } | { notes: [{ id, text, created_at }] } | Case-insensitive search: a note matches if it contains the whole query or every word of it. Empty query returns all notes. Newest first, default limit 100. |
upload | { filename, content_base64, content_type? } | { url, id, filename, size, content_type } | Stores a file (max 20 MB decoded) and returns a link under https://mcp.sdet.it/files/… that anyone with the link can open without signing in. Filenames are reduced to A-Z a-z 0-9 . _ -. Images, audio, PDF and plain text open in the browser; everything else downloads as an attachment. |
transcribe | { url } | { segments: [{ start, end, text }], language? } | Downloads audio or video from a public http(s) URL (max 50 MB, 60 s download limit; private and internal network addresses are refused), converts it with ffmpeg and transcribes it on this server with whisper.cpp (multilingual base model, language auto-detected). start/end are seconds. |
Every result is returned as structuredContent matching the tool's declared outputSchema, plus the same JSON as text. Problems (bad input, failed download) come back as tool results with isError: true.
https://mcp.sdet.it/mcp without a token and gets 401 with a WWW-Authenticate header pointing to the protected resource metadata (https://mcp.sdet.it/.well-known/oauth-protected-resource/mcp).https://mcp.sdet.it/.well-known/oauth-authorization-server).client_id; preferred) or registers through Dynamic Client Registration at https://mcp.sdet.it/register (kept for older clients).access_denied. Wrong passphrases are rate-limited.resource parameter https://mcp.sdet.it/mcp. It receives an access token (valid 60 minutes) bound to that resource, and a refresh token (valid 30 days, rotated on every use).Tokens issued for any other resource are rejected. The only scope is mcp, which covers all four tools.
| Data | Kept? | How long |
|---|---|---|
| Notes (text, id, creation time) | Yes, in a file on this server | Until deleted on request |
| Uploaded files (bytes, sanitized name, type, size, upload time) | Yes, on this server's disk, publicly readable by link | Until deleted on request |
Audio sent to transcribe | Only in a temporary folder while it is processed | Deleted as soon as the call ends |
| Transcripts | No. Returned to the caller only | Not stored |
| Registered OAuth clients (client id, name, redirect URIs, hashed secret) | Yes | Until deleted on request |
| Access and refresh tokens | Only as SHA-256 hashes, with client id, audience and expiry | Removed after they expire or are revoked |
| Request log (time, method, path without query, status, duration, JSON-RPC method and tool name, client IP) | Yes, in the server's standard output. Tokens, passphrases, note text and file contents are never logged | As long as the host keeps container logs |
To delete notes, files, a client registration or tokens, contact darek@sdet.it and give the note ids, file links or client id. A client can also revoke its own tokens at https://mcp.sdet.it/revoke (RFC 7009).