Original Reddit post

I’ve been running a personal MCP server on my NAS for a few weeks as a custom connector in Claude (web, desktop, mobile). It has grown to about 50 tools: notes, subscriptions, documents, a reading list, even desk clocks. I turned the setup into a small template. How it’s built:

• Cloudflare Tunnel: outbound only, no port forwarding, the MCP container publishes no port at all
• Cloudflare Access in front: e-mail policy, optional MFA, and managed OAuth so Claude’s connector login just works (redirects limited to claude.ai / claude.com)
• The server checks the Access JWT on every request itself (signature, audience, issuer, expiry, e-mail allow list). A request that bypasses Access, e.g. from another container, gets 401
• FastMCP with stateless HTTP, DNS rebinding protection, an audit log of every write with the caller’s e-mail
• Hardened containers: non-root, read-only, no capabilities; the tunnel token is only readable by cloudflared The template ships with four simple notes tools on SQLite so it runs on any NAS immediately; you replace them with your own. The README walks through the Cloudflare part step by step. Lessons learned that are in the README:
• After adding tools, disconnect and reconnect the connector, and use a new chat (open chats keep the old tool list)
• The “revoke existing tokens” button in Access changes the AUD tag and your server will reject everything until you update it
• An “authentication method = SMS” Access rule locks everyone out Tested: 23 automated checks (protocol, tools, and the JWT check with forged, expired, wrong-audience and wrong-email tokens), and the compose stack comes up healthy. The Cloudflare steps come from my running setup; I didn’t redo them with a fresh account for the template, and Cloudflare renames menus now and then. Repo: https://github.com/Githubtezla/nas-mcp-server Built with Claude Code. Feedback welcome, especially if you get it running on Synology/QNAP/Unraid. submitted by /u/telsaton

Originally posted by u/telsaton on r/ClaudeCode