Overview
The Metablox MCP Server lets AI assistants — such as Claude, Cursor, Perplexity, and other MCP-compatible clients — interact with your Metablox account. Through it, an AI assistant can create and manage your memories, organize collections, upload photos, and more — all with your explicit permission.
Metablox provides two server modes to suit different integration needs:
Remote Server (Streamable HTTP)
Hosted at https://metablox.co/mcp/. Cloud-based AI platforms connect over HTTPS using OAuth 2.1 bearer tokens. No local installation required.
Local Server (stdio)
Runs on your machine as python -m mcp_server. For desktop AI tools like Claude Desktop and Cursor that connect via stdin/stdout. Full feature set including Blox info, leaderboards, and auctions.
Quick Start
Remote Server (Claude, Perplexity, etc.)
If your AI tool supports remote MCP connections, point it at the Metablox endpoint — no local setup needed.
-
Enable MCP in your Metablox account
Go to Account Settings → MCP Access on metablox.co and flip the master toggle on. Choose which permissions to grant (e.g., read memories, create collections).
-
Authorize your AI app
When your AI client connects, you'll be redirected to Metablox to approve the requested scopes. After approval, the app receives an OAuth 2.1 access token automatically.
-
Start using it
Ask your AI assistant things like "Show me my recent memories" or "Create a new collection called Vacation 2025". The assistant will use the MCP tools on your behalf.
Local Server (Claude Desktop, Cursor)
-
Install dependencies
pip install "mcp[cli]>=1.2.0" httpx python-dotenv -
Configure environment
Create a
.envfile in the project root (or set the variables directly):# .env METABLOX_API_BASE_URL=https://metablox.co/api/v1 METABLOX_API_TOKEN=your_api_token_here -
Add the server to your AI client
In your client's MCP configuration file (e.g.,
claude_desktop_config.json):{ "mcpServers": { "metablox": { "command": "python", "args": ["-m", "mcp_server"], "env": { "METABLOX_API_BASE_URL": "https://metablox.co/api/v1", "METABLOX_API_TOKEN": "your_api_token_here" } } } } -
Verify the connection
Open your AI client and ask it to call
get_my_profile. If it returns your Metablox profile, you're all set.
Authentication
Remote Server — OAuth 2.1 with PKCE
The remote MCP server uses OAuth 2.1 with PKCE (Proof Key for Code Exchange) for secure authorization. This is the same flow used by modern mobile and single-page apps, and it means client secrets are never exposed.
Authorization Flow
1. Your AI client redirects the user to POST /users/mcp/authorize/ with a code_challenge (S256), requested scopes, and a redirect_uri.
2. The user reviews the requested scopes and approves access on Metablox.
3. Metablox redirects back with an authorization code.
4. The client exchanges the code + code_verifier at POST /api/mcp/token to receive an access token and refresh token.
5. The client includes the access token as Authorization: Bearer <token> in all MCP requests.
Token Details
Access tokens expire after 30 days. Refresh tokens expire after 90 days. When you refresh a token, the old token is atomically deactivated and a new token pair is issued (token rotation). Both MCP <token> and Bearer <token> header formats are accepted.
Local Server — API Token
The local server authenticates using a static API token set via the METABLOX_API_TOKEN environment variable. Alternatively, you can call the login tool at runtime with your username and password to obtain a session token.
Token Info Endpoint
/api/v1/mcp/token-info
Validates a token and returns its scopes, client ID, and expiry. Useful for debugging authorization issues.
Scopes & Permissions
Access is controlled at three levels: OAuth scopes requested by the app, user-level permission toggles, and per-tool enable/disable switches. All three must allow an action for it to succeed.
Available Scopes
memory:read READView your memoriesmemory:create WRITECreate new memoriesmemory:update WRITEEdit your memoriesmemory:delete DELETEDelete your memoriescollection:read READView your collectionscollection:create WRITECreate new collectionscollection:update WRITEEdit your collectionscollection:delete DELETEDelete your collectionsprofile:read READView basic profile infomemory:discover READSearch other people's public memories (opt-in)graph:read READExplore the public memory knowledge graph (opt-in)User Permission Controls
Every user has a master toggle and granular per-resource permissions on their MCP settings page. Even if an app requests memory:delete, the operation will fail unless the user has also enabled memory deletion in their settings.
Per-Tool Controls
Individual tools can be disabled by the user via the MCP settings page. For example, you might allow list_memories but disable delete_memory — giving you precise control over what any connected AI can do.
Management Endpoints
/api/mcp/settings — View your current MCP permissions/api/mcp/settings/update — Update permission toggles/api/mcp/tools — List available MCP tools/api/mcp/tools/update — Enable/disable specific tools/api/mcp/revoke — Revoke an app's accessRemote Server
The remote MCP server is hosted at https://metablox.co/mcp/ and uses Streamable HTTP transport. AI platforms send MCP protocol messages over HTTPS, and the server translates them into authenticated Metablox API calls.
Connection Details
Endpoint: https://metablox.co/mcp/
Transport: Streamable HTTP (stateless)
Auth: Authorization: Bearer <mcp_access_token>
The remote server exposes the core memory and collection tools. For the full set of tools (including Blox info, leaderboards, and auctions), use the local server.
Local Server
The local server runs on your machine and communicates with your AI client over stdio. It provides the complete tool set — memories, collections, moments, marks (reactions), Blox info, leaderboards, and auctions.
Requirements
Python 3.12+ and the following packages:
mcp[cli]>=1.2.0
httpx>=0.27.0
python-dotenv>=1.0.0
Environment Variables
| Variable | Description | Default |
|---|---|---|
| METABLOX_API_BASE_URL | Base URL for the Metablox API | https://metablox.co/api/v1 |
| METABLOX_API_TOKEN | Your API authentication token | (none) |
| METABLOX_MCP_TOKEN | MCP-specific token (uses MCP permission-checked endpoints) | (none) |
Running Standalone
# From the metablox-app root directory
python -m mcp_server
Tools Reference
Below is the complete set of tools available through the Metablox MCP server. Tools marked REMOTE are available on both the remote and local servers. All others are local-server only.
list_memories READ REMOTE List the user's memories (up to 50)
Returns memory titles, IDs, status, privacy level, location, dates, and engagement stats. No parameters required — operates on the authenticated user.
Scope required: memory:read
get_memory READ REMOTE Get full details of a memory
Retrieves all details for a specific memory including content, images, location, and engagement data.
| Parameter | Type | Description |
|---|---|---|
| memory_idreq | integer | The numeric memory ID |
Scope required: memory:read
create_memory WRITE REMOTE Create a new memory
Creates a new memory with text, images, location, and date information.
| Parameter | Type | Description |
|---|---|---|
| titlereq | string | Title of the memory |
| content | string | Text content / description |
| status | string | d (draft, default) or p (published) |
| privacy_level | string | public, friends, followers, or private |
| country | string | Country name |
| image_uris | list[string] | Image URLs to attach |
| cover_img | string | Cover image URL (defaults to first image) |
| memory_date_year | integer | Year the memory took place |
| memory_date_month | integer | Month (1–12) |
| memory_date_day | integer | Day (1–31) |
| latitude | float | Location latitude |
| longitude | float | Location longitude |
Scope required: memory:create
update_memory WRITE REMOTE Update an existing memory
Updates one or more fields on a memory you own. Only provided fields are changed.
| Parameter | Type | Description |
|---|---|---|
| memory_idreq | integer | The memory to update |
| title | string | New title |
| content | string | New text content |
| status | string | d (draft), p (published), or w (withdrawn) |
| privacy_level | string | New privacy level |
| country | string | New country |
| image_uris | list[string] | New image URLs (replaces existing) |
| cover_img | string | New cover image URL |
| latitude | float | New latitude |
| longitude | float | New longitude |
Scope required: memory:update
delete_memory DELETE REMOTE Permanently delete a memory (two-step)
Deletes a memory permanently. This is a two-step process for safety: the first call (without confirmation_token) returns a confirmation token. The second call with that token executes the deletion.
| Parameter | Type | Description |
|---|---|---|
| memory_idreq | integer | The memory to delete |
| confirmation_token | string | Token from the first call to confirm |
Scope required: memory:delete
upload_memory_photos WRITE REMOTE Upload photos to a memory
Uploads and attaches photos to an existing memory. Photos are automatically processed — resized, checked for NSFW content, and thumbnails are generated. Supports both URL and base64 input; prefer URLs when possible.
| Parameter | Type | Description |
|---|---|---|
| memory_idreq | integer | The memory to attach photos to |
| photosreq | list[object] | Each object must contain either url (preferred) or data (base64). Optionally includes filename. |
| set_cover | boolean | Set the first uploaded photo as the cover image (default: false) |
Scope required: memory:update
discover_memories READ Discover public memories from other users
Returns a feed of public memories from across the platform. No parameters required. Available on the local server only.
set_memory_privacy WRITE Change a memory's privacy level
| Parameter | Type | Description |
|---|---|---|
| memory_idreq | integer | The memory to update |
| privacy_levelreq | string | public, friends, followers, or private |
list_collections READ REMOTE List the user's collections
Returns all memory collections for the authenticated user.
Scope required: collection:read
search_collections READ REMOTE Find your collections by name or description
Searches the authenticated user's own collections. Call it before create_collection so an agent reuses an existing collection instead of creating a duplicate: matching is case-insensitive and word-order-insensitive, so it finds "History of Wimbledon" when asked for "Wimbledon history". Results are ranked best match first and each carries a match label — exact, name, partial (see matched_words) or description — plus memory_count, cover_img and url. The top-level exact_match is the collection to add to when the name is already taken.
| Parameter | Type | Description |
|---|---|---|
| qreq | string | Name or key words to look for |
| limit | integer | Maximum results, 1–50 (default 20) |
Scope required: collection:read
get_collection READ REMOTE Get collection details with memories
| Parameter | Type | Description |
|---|---|---|
| collection_idreq | integer | The collection ID |
Scope required: collection:read
create_collection WRITE REMOTE Create a new collection
Run search_collections first and add to an existing match instead of creating a duplicate. A name the user already has (compared ignoring case) is rejected with 409 Conflict; the body's existing_collection gives the id to add to.
| Parameter | Type | Description |
|---|---|---|
| namereq | string | Name for the collection |
| memory_ids | list[integer] | Optional list of memory IDs to add |
Scope required: collection:create
update_collection WRITE REMOTE Update a collection's name or add memories
| Parameter | Type | Description |
|---|---|---|
| collection_idreq | integer | The collection to update |
| name | string | New name |
| add_memory_ids | list[integer] | Memory IDs to add to the collection |
Scope required: collection:update
delete_collection DELETE REMOTE Delete a collection (memories are preserved)
Permanently deletes a collection. Memories within the collection are NOT deleted — only the collection itself is removed. Uses the same two-step confirmation process as delete_memory.
| Parameter | Type | Description |
|---|---|---|
| collection_idreq | integer | The collection to delete |
| confirmation_token | string | Token from the first call to confirm |
Scope required: collection:delete
find_related READ REMOTE Related content for a memory, collection, place, or entity — with reasons
Pass exactly one target. Each result is labeled with its relations (curated, co_collected, same_place, same_block, same_subject, thematic) and carries a source citation block.
| Parameter | Type | Description |
|---|---|---|
| memory_id | integer | Related memories for this memory |
| collection_id | integer | Related collections + suggested memories |
| place_id | string | Related places (plc_… id) |
| entity_id | string | Entity, its memories, co-occurring entities (ent_… id) |
| relations | string | Comma-separated relation filter (memory targets) |
| limit | integer | Max results, 1–25 (default 10) |
Scope required: graph:read
get_memory_context READ REMOTE Knowledge card: entities, place, collections, related memories
| Parameter | Type | Description |
|---|---|---|
| memory_idreq | integer | The memory to contextualize |
Scope required: graph:read
get_place_knowledge READ REMOTE Place dossier: memories by kind, collections, entities, related places
| Parameter | Type | Description |
|---|---|---|
| place_id | string | Opaque place id (plc_…), preferred |
| latitude | float | With longitude: nearest active place |
| longitude | float | |
| limit | integer | Max items per section, 1–25 |
Scope required: graph:read
search_entities READ REMOTE Find people, series, events, organizations, eras by name or alias
Matches canonical names and localized aliases in any script (e.g. both “Hibike! Euphonium” and 「響け!ユーフォニアム」).
| Parameter | Type | Description |
|---|---|---|
| qreq | string | Name fragment (min 2 chars) |
| limit | integer | Max results, 1–25 |
Scope required: graph:read
get_entity READ REMOTE One entity with its public memories and co-occurring entities
| Parameter | Type | Description |
|---|---|---|
| entity_idreq | string | Opaque entity id (ent_…) |
| limit | integer | Max memories/related entities, 1–25 |
Scope required: graph:read
get_timeline READ REMOTE Chronological memories for a place or entity
Builds a timeline from the memories' (possibly fuzzy) dates — the history of a stadium, or a person's life across places. Pass exactly one of place_id / entity_id.
| Parameter | Type | Description |
|---|---|---|
| place_id | string | Opaque place id (plc_…) |
| entity_id | string | Opaque entity id (ent_…) |
| year_from | string | Earliest year, inclusive |
| year_to | string | Latest year, inclusive |
| limit | integer | Max results, 1–100 (default 50) |
Scope required: graph:read
upload_moment WRITE Upload a short-lived moment (72 hours)
Creates a moment — a short-lived piece of content visible for 72 hours, similar to a "story."
| Parameter | Type | Description |
|---|---|---|
| user_idreq | integer | Your Metablox user ID |
| titlereq | string | Title of the moment |
| contentreq | string | Text content |
| image_paths | list[string] | Local file paths to images |
| latitude | float | Location latitude |
| longitude | float | Location longitude |
mark_memory WRITE React to a memory with a mark
| Parameter | Type | Description |
|---|---|---|
| memory_idreq | integer | The memory to react to |
| mark_typereq | string | 1 = Inspiring, 2 = Heartwarming, 3 = Enjoyable, 4 = Solemn |
| user_idreq | integer | Your Metablox user ID |
login AUTH Log in and store auth token
Authenticates with Metablox and stores the token for all subsequent requests. Only needed for the local server when no API token is configured.
| Parameter | Type | Description |
|---|---|---|
| usernamereq | string | Metablox username or email |
| passwordreq | string | Account password |
get_my_profile READ Get the authenticated user's profile
Returns profile info including stats, social accounts, and connection counts. No parameters required.
get_user READ Look up a user by ID
| Parameter | Type | Description |
|---|---|---|
| user_idreq | integer | The user ID to look up |
get_block_info READ Get info about a Blox in a city
| Parameter | Type | Description |
|---|---|---|
| cityreq | string | City slug (e.g., new-york) |
| block_numreq | string | Block number within the city |
get_my_assets READ List owned Blox/properties
| Parameter | Type | Description |
|---|---|---|
| user_idreq | integer | Your Metablox user ID |
get_leaderboard READ View leaderboard and your ranking
| Parameter | Type | Description |
|---|---|---|
| user_idreq | integer | Your Metablox user ID |
get_active_auctions READ List active landmark auctions
Returns all currently active landmark auctions. No parameters required.
place_bid WRITE Place a bid on an auction
| Parameter | Type | Description |
|---|---|---|
| auction_idreq | integer | The auction to bid on |
| amountreq | float | Bid amount |
Rate Limits
The MCP API enforces rate limiting at three levels to ensure fair usage and platform stability:
Per-Token Rate Limit
Each access token has its own rate limit. If you exceed it, you'll receive a 429 Too Many Requests response. Wait and retry.
Per-Application Rate Limit
All tokens issued to a single MCP application share an aggregate rate limit.
Write Operation Throttle
Write operations (create, update, delete) have a stricter rate limit than read operations to protect data integrity.
Retry-After header value when available.
Audit Log
Every MCP operation is recorded in an audit log. You can review exactly what any connected AI assistant has done on your behalf — which tools were called, what resources were accessed or modified, and when.
/api/mcp/audit-logEach log entry includes the action performed, the resource type and ID, the application that made the request, your IP address, user agent, and a timestamp. Use this to monitor AI assistant activity and verify that connected apps are behaving as expected.
Troubleshooting
Common Issues
"MCP access is not enabled"
The master MCP toggle is off for your account. Go to Account Settings → MCP Access on metablox.co and enable it.
"Permission denied" on a specific tool
Check three things: (1) the OAuth scope was requested and approved during authorization, (2) the corresponding resource permission is enabled in your MCP settings, and (3) the specific tool hasn't been disabled in your per-tool settings.
"Token expired" or authentication failures
Access tokens expire after 30 days. Use the refresh token to get a new one, or re-authorize the app. You can check token status via GET /api/v1/mcp/token-info.
Local server won't start
Ensure you have Python 3.12+ and all dependencies installed: pip install "mcp[cli]>=1.2.0" httpx python-dotenv. Verify your .env file is in the project root with valid values.
Photo upload rejected
Uploaded photos are checked for NSFW content. If a photo is flagged, it will be rejected. Supported formats are JPEG, PNG, GIF, and WEBP. When using URLs, ensure they're publicly accessible.
Getting Help
If you're still stuck, reach out to [email protected] or visit the Metablox Support Center. When reporting an issue, include your audit log entries and the error response from the MCP tool call.