Connect an AI assistant

Finitizer exposes a tenant's cost intelligence over the Model Context Protocol, so any MCP-capable assistant can answer "what is my biggest AWS savings opportunity this week?" from your own data, in the tool you already have open.

• Endpoint: https://mcp.finitizer.com/mcp
• Authentication: a tenant-scoped API key, sent as a Bearer token on every request
• Clouds: AWS and Google Cloud

The whole setup is three steps, and the product shows them with your key already filled in under Settings → MCP Access.

1. Get an API key

A Finitizer administrator does this once per tenant, in Settings → MCP Access:

1. Enable MCP for the tenant. Keys cannot be created while it is off, and turning it off later blocks every existing key within seconds.
2. New key. Name it after where it will live ("Claude Desktop, Priya"), pick scopes, pick an expiry (90 days by default), and create it.
3. Copy the key now. It is shown once. Finitizer stores only a hash.

Scopes: read covers queries, summaries, tasks and anomalies; sql also allows guardrailed free-form SELECT; write allows opening infrastructure-as-code pull requests. Start with read.

Every key is tied to one tenant. Whichever client asks, a tool call sees only that tenant's data.

2. Connect your client

Claude Desktop and claude.ai

Both share one dialog: Settings → Connectors → Add custom connector.

• Name: Finitizer
• URL: https://mcp.finitizer.com/mcp
• Authentication: No sign-in. This server uses API keys, not OAuth.
• Request headers: Authorization with the value Bearer fzr_.... Include Bearer and the space.

No "Request headers" section in your dialog? Header authentication in the connector dialog is a beta that Anthropic is rolling out per organisation. Until yours has it, Claude Desktop can connect through its config file instead. Add this to claude_desktop_config.json (macOS: ~/Library/Application Support/Claude/, Windows: %APPDATA%\Claude\), then restart Claude Desktop. Node.js 18 or newer must be installed on that machine.

{
  "mcpServers": {
    "finitizer": {
      "command": "npx",
      "args": [
        "-y", "mcp-remote", "https://mcp.finitizer.com/mcp",
        "--transport", "http-only",
        "--header", "Authorization:${FINITIZER_MCP_AUTH}"
      ],
      "env": { "FINITIZER_MCP_AUTH": "Bearer fzr_..." }
    }
  }
}

Keep the bearer value in the env block. Claude Desktop on Windows does not escape spaces inside args, so an inline "Authorization: Bearer fzr_..." arrives mangled.

Claude Code

claude mcp add --transport http --scope user finitizer https://mcp.finitizer.com/mcp --header "Authorization: Bearer fzr_..."

--scope user makes the server available in every project. Drop it to limit it to the current folder. claude mcp list shows the connection state.

Cursor

In ~/.cursor/mcp.json (or Cursor Settings → MCP):

{
  "mcpServers": {
    "finitizer": {
      "url": "https://mcp.finitizer.com/mcp",
      "headers": { "Authorization": "Bearer fzr_..." }
    }
  }
}

VS Code (GitHub Copilot agent mode)

Use your user-level MCP configuration (Command Palette → MCP: Open User Configuration) rather than a workspace file, so the key is never committed with a repository:

{
  "servers": {
    "finitizer": {
      "type": "http",
      "url": "https://mcp.finitizer.com/mcp",
      "headers": { "Authorization": "Bearer fzr_..." }
    }
  }
}

Any other MCP client

Point it at https://mcp.finitizer.com/mcp over Streamable HTTP and send Authorization: Bearer fzr_... on every request.

3. Ask something

• "Using Finitizer, what's my total AWS savings opportunity?"
• "Show my top 10 AWS optimization tasks by monthly savings."
• "Which EC2 instances are idle?"
• "Any AWS cost anomalies this week?"
• "What are my 5 most expensive BigQuery queries?"
• "Compare my AWS and Google Cloud savings opportunities."

Name the cloud in your question. Several tools default to Google Cloud when you do not. If your client surfaces MCP prompts, four packaged workflows are available: weekly_finops_report, cost_analysis, anomaly_triage and optimization_playbook.

Read tools are marked read-only, so Claude runs them without asking for approval on every call. The one tool that writes anywhere, create_iac_pull_request, opens a pull request for human review and needs the write scope.

What the server guarantees

• Tenant isolation. The tenant comes from the API key, never from a header or a tool argument. Free-form SQL is validated to be a single SELECT restricted to your own datasets.
• Read-only by default. Nothing is executed against your cloud.
• Cost control. Free-form SQL is dry-run first and refused above a scan budget; every query carries a byte cap and a timeout.
• Auditability. Every tool, resource and prompt call is logged with the key, latency and status. Administrators can revoke a key, or disable MCP for the tenant, in seconds.

Troubleshooting