AWS DATA SERVICES / AWS Labs
AWS Labs Finch
Builds and pushes container images through the local Finch CLI, with additional ECR repository support.
“A Model Context Protocol (MCP) server for Finch that enables generative AI models to build and push container images through finch cli leveraged MCP tools.”
01 / THE REASONING
Why this made the selection.
- Specialized publisher integration with documented IAM and data access boundaries.
- Build a reviewed local container context in an existing Finch environment.
- The catalogue has the Docker MCP gateway and not this Finch server.
- The README separates a default mode that blocks new AWS resources from an explicit --enable-aws-resource-write flag.
02 / THE REVIEW RECORD
What we actually inspected.
Source review has boundaries.
A clear record is more useful than a “safe” badge.
Material inspected
- src/finch-mcp-server/README.md
- src/finch-mcp-server/pyproject.toml
- src/finch-mcp-server/awslabs/finch_mcp_server/server.py
- Root README.md and LICENSE
- src/finch-mcp-server/LICENSE
Our findings
- finch_push_image checks the AWS-write boolean only inside the ECR branch; other registry pushes proceed to push_image. Startup ensures a running Finch VM.
- The default JSON config runs uvx awslabs.finch-mcp-server@latest without the write flag and sets transportType to stdio.
- In that mode the README says finch_build_container_image works, and finch_create_ecr_repo and finch_push_image return an error and do not create or modify AWS resources.
- Write mode adds --enable-aws-resource-write. The introduction also says credential-helper setup only modifies finch.yaml.
Not established by this review
- Server startup, authentication, live tool execution and security isolation were not tested.
- Published package/container parity with a source revision and hosted implementation internals were not tested.
- The resource was not executed and its tools were not called.
- Finch was not installed.
- No image was built and no ECR API was called.
The review applies to the material and revision named here. A newer upstream release can change its behavior.
03 / PUT IT TO WORK
Connect a server deliberately.
DOCUMENTED COMMAND
uvx awslabs.finch-mcp-server@latestCopying does not execute this command. It may retrieve a newer version than the reviewed source.
- Install and configure Finch CLI and its VM in addition to Python/uv.
- Start without AWS-write enablement and inspect the selected Dockerfile/build context; file logging can be disabled as shown.
- Review image destination and credentials before a push. ECR permissions and any write-enable launcher require separate verification before use.
Before you start
- Python3.10+, uv and an installed supported Finch CLI/VM.
- Registry credentials for pushes; AWS credentials and ECR permissions only for ECR tasks.
Documented configuration example
Use the client and authentication context described in the setup guidance. Configuration formats vary between hosts.
{
"mcpServers": {
"awslabs-finch": {
"command": "uvx",
"args": [
"awslabs.finch-mcp-server@latest"
],
"env": {
"AWS_PROFILE": "YOUR_RESTRICTED_PROFILE",
"AWS_REGION": "us-east-1",
"FINCH_DISABLE_FILE_LOGGING": "true"
}
}
}
}04 / FOLLOW THE EVIDENCE
The source trail.
Our notes are separate from the original resource.
Check upstream before adopting a new version.
https://github.com/awslabs/mcp/blob/8840003820a78dd018561d55c7ab12fcdd708464/src/finch-mcp-server/README.md
Supports: summary, install, configExample, access, limitations, bestFor, review, compatibility, transports
https://github.com/awslabs/mcp/blob/8840003820a78dd018561d55c7ab12fcdd708464/src/finch-mcp-server/pyproject.toml
Supports: summary, install, configExample, access, limitations, bestFor, review, compatibility, transports
https://github.com/awslabs/mcp/blob/8840003820a78dd018561d55c7ab12fcdd708464/src/finch-mcp-server/awslabs/finch_mcp_server/server.py
Supports: summary, install, configExample, access, limitations, bestFor, review, compatibility, transports
https://github.com/awslabs/mcp/blob/8840003820a78dd018561d55c7ab12fcdd708464/README.md
Supports: summary, install, configExample, access, limitations, bestFor, review, compatibility, transports
- Applicable licence ↗Checked
https://github.com/awslabs/mcp/blob/8840003820a78dd018561d55c7ab12fcdd708464/LICENSE
Supports: license
- Finch MCP README ↗Checked
https://github.com/awslabs/mcp/blob/8840003820a78dd018561d55c7ab12fcdd708464/src/finch-mcp-server/README.md
Supports: default mode versus write flag
- Directory LICENSE ↗Checked
https://github.com/awslabs/mcp/blob/8840003820a78dd018561d55c7ab12fcdd708464/src/finch-mcp-server/LICENSE
Supports: Apache License Version 2.0