🌙 Now in beta · free during beta

Turn any MCP service into
a secure public endpoint.

Point Finch at a Mac mini, a Pi, or the server humming under your desk. You write the tool logic. Finch handles auth, routing, and hosting. Outbound-only: nothing listens, no ports to open.

Get started →See how it works
✓ Speaks MCP: Claude, Cursor, any client✓ One command to set up✓ Encrypted in transit · payloads not retained
🔒 Authed at the door
● 3 online
🐦 Finchmaray.finchmcp.com

Your services

3 online · 1 offline
🐦web-scraperonline…/web-scraper/mcpCopy
🐦transcribeonline…/transcribe/mcpCopy
🐦embeddingsonline…/embeddings/mcpCopy
🐦finance-toolsoffline—
Works with every client that speaks MCP Claude Cursor Windsurf any MCP client
WHY FINCH

Skip the auth stack.

Your MCP server already works on localhost. Making it safely reachable from anywhere is the part nobody wants to build.

WITHOUT FINCH
  • ✗Rent and patch a VPS
  • ✗Open a port or babysit a tunnel
  • ✗Set up TLS and renew certs
  • ✗Write an auth layer yourself
  • ✗Issue, rotate, and revoke keys by hand
  • ✗Track who can reach what
WITH FINCH
$ fastmcp run server.py
$ finch add . --service localhost:8000
✓ https://you.finchmcp.com/notes/mcp
  • ✓Public URL with TLS
  • ✓Auth checked before anything reaches your box
  • ✓Keys and access managed in one dashboard
HOW IT WORKS

From cold box to live endpoint in a minute

One command up. One URL out. That's the whole loop.

Pick a box

Anything that stays on and runs a shell: a Mac mini, a Pi, a spare Linux box. If it can run a process, it can run Finch.

Connect it

Run one line. The box dials out to Finch and comes online. No port-forwarding, no firewall holes.

curl -fsSL https://finchmcp.com/install | sh

Hand off the URL

Each service gets its own MCP endpoint. Drop the URL into any client. Auth is already handled.

maray.finchmcp.com/printer/mcp
ABILITIES

What can you put behind it?

Bring any MCP server, ready-made or your own. Finch wraps it in auth and a URL. Each one becomes a tool your agent can call.

🖨️

Print things

"Hey Claude, print this shipping label."

→ the thermal printer on your desk

📚

Search your notes

"Find what I wrote about the cabin trip."

→ a vault index that never leaves the box

🎙️

Transcribe audio

"Turn this voice memo into notes."

→ local Whisper, no upload

💸

Crunch finances

"How much did I spend on groceries?"

→ your ledgers, parsed in place

🌐

Read the web

"Summarize this page for me."

→ a fetch tool on your own residential IP

🏠

Run your home

"Kick off tonight's backup."

→ lights, backups, whatever the box can reach

DASHBOARD

Every service, one dashboard.

See what's online at a glance, copy any endpoint in a tap, and add a box in under a minute.

✓
Live statusGreen for every box that's online. Read the whole fleet in half a second.
✓
One-tap endpointsCopy any MCP endpoint straight into your client. Masked by default, full when you copy.
✓
Honest statesOnline, offline, or invited. Finch tells you the truth about what's actually reachable.
Open the dashboard →
🐦 Finchdashboard

Your services

4 online · 2 offline · 1 invited
🐦thermal-printerin use…/printer/mcpCopy
🐦web-scraperonline…/scraper/mcpCopy
🐦embeddingsonline…/embeddings/mcpCopy
🐦nightly-backupsoffline—
SAFETY

Outbound-only, auth-first, by construction.

Security isn't a setting in Finch. It's the wiring. Every endpoint gets all of this by default.

🚪

Auth at the door

Every caller is verified by Finch before a single request reaches your box.

🕳️

No open ports

Your box dials out. It never accepts connections. Runs behind home NAT, CGNAT, any firewall with zero inbound setup.

🔑

You hold the keys

Mint access, see who's holding it, revoke in one tap. Keys are shown once, then masked.

🏡

Payloads aren't retained

Requests are encrypted in transit and handled in memory while Finch relays them. Ordinary request and response bodies aren't logged or stored; only documented operational metadata is retained.

PRICING

Plans

FREE IN BETA

Hobby

Freefor you & small groups

Free for you and a few friends. No artificial limits.

  • ✓Unlimited services & boxes
  • ✓Up to 3 users
  • ✓Hosted MCP endpoints + hub domain
  • ✓OAuth at the door
  • ✓Live traffic view
Get started →

Team

Freein beta

Control which users and agents can reach which services.

  • ✓Everything in Hobby
  • ✓Unlimited users, roles & admin
  • ✓ACLs: per-user and per-agent access by tag, group, or key
  • ✓Custom domains
  • ✓Audit logs
Get started →

Enterprise

Contact us

Need SSO, an SLA, or something bespoke? Let’s talk.

  • ✓Everything in Team
  • ✓SSO / SAML
  • ✓SLA & priority support
  • ✓Dedicated onboarding
Contact us

Team plan features are free during beta. Questions? Email hello@aviary.run.

QUESTIONS

Good to know

Do I have to write the MCP server myself? +
Only if you want to. Finch hosts the server, it doesn't write it. Bring a FastMCP (or any MCP) server and Finch wraps it in auth and a public URL. If you've shipped a FastMCP server, you already know the shape. Or grab a ready-made server and put it on a box in a minute.
Is it actually safe to put my box on the internet? +
You're not exposing anything. Your box never opens a port or accepts an inbound connection. It dials out to Finch over an outbound tunnel and only answers calls you've authorized. Finch verifies every caller at the door before anything reaches your code. No reverse proxy, no exposed IP, no CGNAT gymnastics.
Which clients can call it? +
Anything that speaks MCP: Claude, Cursor, Windsurf, and a growing list of clients, plus your own code over the protocol. If it can add an MCP server by URL, it works with Finch out of the box.
What happens when my box goes offline? +
Finch marks the endpoint "offline" so you always know, and reconnects it the moment the box is back. No re-running the installer, no re-pasting URLs.
Can Finch read or store my requests? +
Finch is not end-to-end encrypted: its Cloudflare-hosted relay handles request and response plaintext in memory while forwarding it. Ordinary MCP request and response bodies aren't logged or stored. Finch retains operational metadata such as the timestamp, route, caller, status, and latency. Dashboard Test Chat is separate and sends chat and tool data to Cloudflare Workers AI.
What can I actually expose through it? +
Anything you can wrap as an MCP tool: printing, transcription, a notes index, web fetch, home automation, your own scripts. Start from a ready-made ability or bring your own server.
Is it free? +
Yes. Finch is in beta, so it's free to use right now. Paid plans come later, once it's out of beta. We'll give you plenty of warning before anything changes.

Put your first service online.

One command on your box, one URL in your client. No card, no rented servers, no open ports.

Get started →See how it works