--- title: "AWS Labs Finch: review, setup & limitations · Undominated.ai" canonical: https://undominated.ai/mcp-servers/awslabs-finch/ description: "Builds and pushes container images through the local Finch CLI, with additional ECR repository support." --- # AWS Labs Finch: review, setup & limitations · Undominated.ai > Builds and pushes container images through the local Finch CLI, with additional ECR repository support. [← Explore all mcp servers](/mcp-servers/) AWS DATA SERVICES / AWS Labs # AWS Labs Finch Builds and pushes container images through the local Finch CLI, with additional ECR repository support. [See setup guidance ↓](#setup)[Original source ↗](https://github.com/awslabs/mcp) SOURCE REVIEW Reviewed 2026-10-14 Evidence 7 linked sources Publisher AWS Labs Licence [Apache-2.0 ↗](https://github.com/awslabs/mcp/blob/8840003820a78dd018561d55c7ab12fcdd708464/LICENSE) Revision 8840003820a7 [Read what was—and wasn’t—checked ↓](#review) “A Model Context Protocol (MCP) server for Finch that enables generative AI models to build and push container images through finch cli leveraged MCP tools.” [AWS Labs · upstream description ↗](https://github.com/awslabs/mcp/blob/8840003820a78dd018561d55c7ab12fcdd708464/src/finch-mcp-server/README.md) Our analysis follows below. 01 / THE REASONING ## Why this made the selection. - Specialized publisher integration with documented IAM and data access boundaries. - Build a reviewed local container context in an existing Finch environment. - The catalogue has the Docker MCP gateway and not this Finch server. - The README separates a default mode that blocks new AWS resources from an explicit --enable-aws-resource-write flag. ### A good fit for - Build a reviewed local container context in an existing Finch environment. - Publish a deliberately selected image to an authorized registry after inspecting the resulting tag/digest. - Building a local Finch image from an MCP client that should not create an ECR repository ### Weigh up before choosing - Default AWS-resource-write mode blocks ECR pushes and ECR creation; non-ECR pushes and local builds remain available. It is not a global read-only mode. - Finch VM initialization/start and credential-helper configuration can change local state. ECR helper configuration may restart the VM. - Image builds execute Dockerfile steps and pushes publish content to a registry; review build context, secrets and destination independently of the MCP prompt. - The monorepo now recommends Agent Toolkit for AWS for production. This specialized local server remains documented; its leaf and root documentation were checked for deprecation. - This review did not execute the resource. - There is no standalone shell install line. The package name appears inside JSON and badges, so install.command is null. - The README says ECR credential-helper setup may modify finch.yaml. That file was not inspected. - The README does not contain the word License. The directory LICENSE file is Apache-2.0, so there is no README conflict to record. 02 / THE REVIEW RECORD ## What we actually inspected. Source review has boundaries. A clear record is more useful than a “safe” badge. ### Material inspected - src/finch-mcp-server/README.md - src/finch-mcp-server/pyproject.toml - src/finch-mcp-server/awslabs/finch_mcp_server/server.py - Root README.md and LICENSE - src/finch-mcp-server/LICENSE ### Our findings - finch_push_image checks the AWS-write boolean only inside the ECR branch; other registry pushes proceed to push_image. Startup ensures a running Finch VM. - The default JSON config runs uvx awslabs.finch-mcp-server@latest without the write flag and sets transportType to stdio. - In that mode the README says finch_build_container_image works, and finch_create_ecr_repo and finch_push_image return an error and do not create or modify AWS resources. - Write mode adds --enable-aws-resource-write. The introduction also says credential-helper setup only modifies finch.yaml. ### Not established by this review - Server startup, authentication, live tool execution and security isolation were not tested. - Published package/container parity with a source revision and hosted implementation internals were not tested. - The resource was not executed and its tools were not called. - Finch was not installed. - No image was built and no ECR API was called. The review applies to the material and revision named here. A newer upstream release can change its behavior. 03 / PUT IT TO WORK ## Connect a server deliberately. [Upstream setup instructions ↗](https://github.com/awslabs/mcp/blob/8840003820a78dd018561d55c7ab12fcdd708464/src/finch-mcp-server/README.md) DOCUMENTED COMMAND uvx awslabs.finch-mcp-server@latest Copy command ↗ Copying does not execute this command. It may retrieve a newer version than the reviewed source. - Install and configure Finch CLI and its VM in addition to Python/uv. - Start without AWS-write enablement and inspect the selected Dockerfile/build context; file logging can be disabled as shown. - Review image destination and credentials before a push. ECR permissions and any write-enable launcher require separate verification before use. ### Before you start - Python3.10+, uv and an installed supported Finch CLI/VM. - Registry credentials for pushes; AWS credentials and ECR permissions only for ECR tasks. ### Documented configuration example Use the client and authentication context described in the setup guidance. Configuration formats vary between hosts. { "mcpServers": { "awslabs-finch": { "command": "uvx", "args": [ "awslabs.finch-mcp-server@latest" ], "env": { "AWS_PROFILE": "YOUR_RESTRICTED_PROFILE", "AWS_REGION": "us-east-1", "FINCH_DISABLE_FILE_LOGGING": "true" } } } } Copy configuration ↗ ### Compatibility Python3.10+, uv and an installed supported Finch CLI/VM. · Registry credentials for pushes; AWS credentials and ECR permissions only for ECR tasks. · Kiro · Cursor · VS Code ### Implementation Python · python ### Transports stdio ### AWS data services - Runs local Finch subprocesses, can build/push images and optionally create ECR repositories with AWS permissions. - Build container images through Finch in the default mode - Create or push ECR repositories only with --enable-aws-resource-write - May modify finch.yaml when configuring the ECR credential helper, as the README states ### Cost model AWS service, model, query and storage charges apply; running the MCP process does not include those services. 04 / FOLLOW THE EVIDENCE ## The source trail. Our notes are separate from the original resource. Check upstream before adopting a new version. - [Publisher setup, capabilities and operating boundaries ↗](https://github.com/awslabs/mcp/blob/8840003820a78dd018561d55c7ab12fcdd708464/src/finch-mcp-server/README.md) Checked 2026-10-14 https://github.com/awslabs/mcp/blob/8840003820a78dd018561d55c7ab12fcdd708464/src/finch-mcp-server/README.md Supports: summary, install, configExample, access, limitations, bestFor, review, compatibility, transports - [Pinned package and implementation ↗](https://github.com/awslabs/mcp/blob/8840003820a78dd018561d55c7ab12fcdd708464/src/finch-mcp-server/pyproject.toml) Checked 2026-10-14 https://github.com/awslabs/mcp/blob/8840003820a78dd018561d55c7ab12fcdd708464/src/finch-mcp-server/pyproject.toml Supports: summary, install, configExample, access, limitations, bestFor, review, compatibility, transports - [Pinned package and implementation ↗](https://github.com/awslabs/mcp/blob/8840003820a78dd018561d55c7ab12fcdd708464/src/finch-mcp-server/awslabs/finch_mcp_server/server.py) Checked 2026-10-14 https://github.com/awslabs/mcp/blob/8840003820a78dd018561d55c7ab12fcdd708464/src/finch-mcp-server/awslabs/finch_mcp_server/server.py Supports: summary, install, configExample, access, limitations, bestFor, review, compatibility, transports - [Pinned package and implementation ↗](https://github.com/awslabs/mcp/blob/8840003820a78dd018561d55c7ab12fcdd708464/README.md) Checked 2026-10-14 https://github.com/awslabs/mcp/blob/8840003820a78dd018561d55c7ab12fcdd708464/README.md Supports: summary, install, configExample, access, limitations, bestFor, review, compatibility, transports - [Applicable licence ↗](https://github.com/awslabs/mcp/blob/8840003820a78dd018561d55c7ab12fcdd708464/LICENSE) Checked 2026-10-14 https://github.com/awslabs/mcp/blob/8840003820a78dd018561d55c7ab12fcdd708464/LICENSE Supports: license - [Finch MCP README ↗](https://github.com/awslabs/mcp/blob/8840003820a78dd018561d55c7ab12fcdd708464/src/finch-mcp-server/README.md) Checked 2026-10-14 https://github.com/awslabs/mcp/blob/8840003820a78dd018561d55c7ab12fcdd708464/src/finch-mcp-server/README.md Supports: default mode versus write flag - [Directory LICENSE ↗](https://github.com/awslabs/mcp/blob/8840003820a78dd018561d55c7ab12fcdd708464/src/finch-mcp-server/LICENSE) Checked 2026-10-14 https://github.com/awslabs/mcp/blob/8840003820a78dd018561d55c7ab12fcdd708464/src/finch-mcp-server/LICENSE Supports: Apache License Version 2.0 KEEP COMPARING ## Other approaches to consider. Related by category or shared topics. These are alternatives to inspect, not a measured quality order. [### AWS Labs Amazon Translate ↗ Translates text and manages document translation jobs and custom terminology with AWS Translate.](/mcp-servers/awslabs-translate/)[### AWS Labs HealthImaging ↗ Searches and manages medical imaging datastores, image sets and DICOM lifecycle operations.](/mcp-servers/awslabs-healthimaging/)[### AWS Labs HealthLake ↗ Discovers HealthLake datastores and reads or manages FHIR resources, with an explicit read-only mode.](/mcp-servers/awslabs-healthlake/) [AI Tools ↗](/tools/)[Skills ↗](/skills/)[Agents ↗](/agents/)[MCP Servers ↗](/mcp-servers/)[Workflows ↗](/workflows/) ## Continue your investigation - [Inspect resource evidence](/tools/) - [Choose a host](/agents/) - [Inspect reusable workflows](/skills/) - [Use Undominated data](/api/)