bro — plan

bro is Maciek Sitkowski's personal MCP server on Cloudflare Workers. It gives his agents, and agents he lets in, one place for notes, files and speech-to-text. MCP endpoint: https://bro.sitkowski.dev/mcp (Streamable HTTP, MCP revision 2026-07-28; 2025-era clients are served statelessly).

Tools

Tool	Input	Result	What it does
`memo_write`	`{ text }`	`{ id, created_at }`	Saves a text note (up to 20000 characters) exactly as written.
`memo_search`	`{ query, limit? }`	`{ notes: [{ id, text, created_at, source }] }`	Finds notes, newest first. Every query word must match the start of a word in the note; if none match, the whole query is tried as a substring. An empty query lists the newest notes. `source` names the client that saved the note.
`upload`	`{ filename, text \| base64 \| source_url, content_type? }`	`{ url, id, filename, size, content_type }`	Stores a file (up to 20971520 bytes) and returns a link under `https://bro.sitkowski.dev/files/`. Anyone with the link can open it.
`transcribe`	`{ url, language? }`	`{ segments: [{ start, end, text }] }`	Fetches audio from the URL and turns speech into timestamped text with Cloudflare Workers AI (`@cf/openai/whisper-large-v3-turbo`). `start` and `end` are seconds. An `upload` link works as input.

Every tool declares an output schema, and every successful result returns matching structuredContent. The text content mirrors it: the same JSON, except transcribe, which gives one [start] text line per segment so long audio stays small. Expected failures (bad URL, file too large, audio that cannot be read) come back as tool results with isError: true and a message that says what to change.

Sign-in

bro is an OAuth 2.1 authorization server for its own MCP resource. Its protected resource metadata is at https://bro.sitkowski.dev/.well-known/oauth-protected-resource/mcp; authorization server metadata at https://bro.sitkowski.dev/.well-known/oauth-authorization-server.
Clients identify with a Client ID Metadata Document (an https client_id) or register at https://bro.sitkowski.dev/register (dynamic client registration). PKCE with S256 is required. Tokens are bound to the resource https://bro.sitkowski.dev/mcp (RFC 8707).
When a client asks for access, bro shows a consent page with the client's name, its domain and where the tokens go. After Approve, Maciek signs in through Cloudflare Access (Google or a one-time PIN). Only his account is allowed; anyone else is refused.
Access tokens last 1 hour; refresh tokens 30 days. Maciek can revoke any client's grant.

Data it keeps

Notes: text, time saved, the signed-in owner and the client that saved it, in Cloudflare D1. Kept until Maciek deletes them. All clients he lets in share the same notes.
Files: uploaded bytes, name and type, in Cloudflare R2, public by link. Kept until Maciek deletes them.
Audio for transcribe: fetched for the call, sent to Cloudflare Workers AI, not stored by bro.
Sign-in: client registrations (90 days), grants and tokens in Cloudflare KV. bro keeps the owner's email from Cloudflare Access and no password.
Logs: Cloudflare Workers request logs with short retention. Tool inputs are not logged on purpose.