gc-tools

A remote MCP server: one person's home for notes, files and transcription. Endpoint: https://gc-tools-dc0.pages.dev/mcp (Streamable HTTP, protocol 2026-07-28, and 2025-11-25 for older clients).

What the tools do

Tool	Input	Result	What it does
`memo_write`	`{ text }`	`{ id }`	Saves a note.
`memo_search`	`{ query }`	`{ notes: [{ id, text, author, createdAt }] }`	Finds notes that contain every word of the query, ignoring case, newest first, at most 50.
`upload`	`{ filename, content, mimeType? }`, content is base64	`{ url, name, mimeType, size }`	Stores a file, up to 10 MiB, and gives back a link anyone can open. This server serves the link.
`transcribe`	`{ url }`	`{ segments: [{ start, end, text }], text, language, duration }`	Fetches audio from a public URL, up to 25 MiB, and returns timestamped text. `start` and `end` are in seconds.

Every successful result is structured content that matches the output schema in tools/list, with the same JSON in a text block. A failure comes back with isError and a sentence that says what to do.

How sign-in works

OAuth 2.1 with PKCE (S256). This host is both the MCP server and its authorization server.

A call without a valid token gets 401 and a WWW-Authenticate header that points to the protected resource metadata, then to the authorization server metadata.
The client identifies itself with a Client ID Metadata Document, or registers at /register. Neither grants anything.
The client sends its person to /authorize. The page shows who is asking and where the approval goes. Only the owner of this server can approve, with the owner passcode. No other way in exists.
The client trades the code at /token for an access token (one hour) and a refresh token (30 days, single use). Tokens are bound to https://gc-tools-dc0.pages.dev/mcp and work nowhere else.

Anyone can open a link from upload. Everything else needs a token. Everyone let in shares the same notes and files.

What data it keeps

Notes: the text, the name of the client that wrote it and the time, until the owner deletes them.
Files: the bytes, the name, the media type, the name of the client that sent it and the time, until the owner deletes them. Anyone with the link can read a file, so do not upload secrets.
Clients: the client id, the name it gave and its redirect addresses.
Tokens and codes: only SHA-256 hashes, removed after they expire.
Audio for transcribe: not kept. It is fetched, sent to Cloudflare Workers AI (Whisper) and dropped. The transcript is returned and not stored.

The data sits in a Cloudflare D1 database on the owner's account. The server runs on Cloudflare Pages. It sets no cookies and no analytics.