hqr MCP server

A remote MCP server owned by Hankier (hqr). Endpoint: https://mcp.hqrlabs.pl/mcp (Streamable HTTP, MCP 2026-07-28; 2025-11-25 and older clients are served statelessly too).

Tools

Tool	Input	Result (structured content)
`memo_write`	`{ text }`	`{ id }`: saves a note.
`memo_search`	`{ query }`	`{ notes: [{ id, text, created_at, client }] }`: notes whose text contains the query (case-insensitive), newest first, at most 50.
`upload`	`{ filename, content_base64 \| text \| source_url, content_type? }`	`{ url, id, size, content_type }`: stores the file and returns a public link under `https://mcp.hqrlabs.pl/files/`, served by this server. Max 20 MB.
`transcribe`	`{ url }`	`{ segments: [{ start, end, text }] }`: speech to text with Whisper (Cloudflare Workers AI); `start`/`end` in seconds from the start of the audio. Max 20 MB.

Every result returns structuredContent that matches the tool's declared outputSchema. Clients on MCP 2026-07-28 also get a one-line text summary; 2025-era clients get the same JSON as text. Errors are tool results with isError: true that name the input that failed and why.

Sign-in

OAuth 2.1 with PKCE (S256). Calls to /mcp without a valid token get 401 with a WWW-Authenticate header naming the protected resource metadata at https://mcp.hqrlabs.pl/.well-known/oauth-protected-resource/mcp. This server is its own authorization server (metadata at https://mcp.hqrlabs.pl/.well-known/oauth-authorization-server).

Clients register with a Client ID Metadata Document (preferred) or Dynamic Client Registration.
On the consent page the owner sees the client's name, its domain and where the tokens go, and approves with the owner password. Nobody else can approve; there are no other accounts.
Scope: mcp (all four tools). Access tokens last 1 hour; refresh tokens up to 30 days. Tokens are bound to the resource https://mcp.hqrlabs.pl/mcp.

Data kept

Notes: text, time saved, and the name and ID of the client that saved it. Kept until the owner deletes them. Every client the owner lets in can search all notes.
Uploads: the file, its name, type, size, time and client ID. Public to anyone with the link. Kept until the owner deletes them.
Audio for transcription: fetched, sent to Cloudflare Workers AI and not stored; the transcript is returned, not kept.
Sign-in: client registrations, grants and hashed tokens in Cloudflare KV; they expire with the tokens.
Request logs: Cloudflare Workers observability (method, path, status), kept by Cloudflare for a few days.

Runs on Cloudflare Workers (D1, R2, KV, Workers AI). Contact: the owner, via the course.