io.github.munhq/cloud-tools

Multi-cloud cost, inventory and waste analysis in Rust — exposed as an MCP server so an AI agent can query spend and waste directly, and as an HTTP API for everything else.

It reports spend and waste: idle instances, oversized nodes, previous-generation hardware, unattached resources, and commitments you are not using.

Eight tools, one shape

Every tool takes cloud and nothing else it does not need. Credentials never appear in a tool call — the server reads them from its own environment, so the agent never handles a secret and never needs to be told one.

{ "cloud": "aws" }
{ "cloud": "gcp" }

Start with check_access. It takes no arguments, contacts no cloud, and reports which clouds this server can reach and what is missing for the ones it cannot.

A dash is not a silent empty result. The tool answers, for example, waste analysis is not implemented for ovh; supported: aws, gcp, so an agent cannot read a gap as a clean bill.

Reading a zero correctly

get_waste and get_inventory return a coverage field and an errors list. A zero total means one of two entirely different things:

A partial result is not a clean bill of health.

Configuring the server

Credentials are read from the environment of the machine running cloud-tools. Nothing is stored, and every call is read-only.

AWS

Resolved in this order, first match winning:

1. AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY
2. ~/.aws/credentials, profile from AWS_PROFILE, otherwise [default]
3. An ECS task role
4. An EC2 instance role

An SSO-only profile is not read directly. Export it first: aws configure export-credentials --profile <name> --format env.

To scan a different account, pass a role to assume. A role ARN is not a secret, so it stays an argument:

{ "cloud": "aws", "target": { "role_arn": "arn:aws:iam::…:role/ReadOnly" } }

CLOUD_TOOLS_AWS_ROLE_ARN and CLOUD_TOOLS_AWS_EXTERNAL_ID set a default for that, if every call should assume the same role.

get_waste reads EC2 instances, volumes, snapshots, AMIs, Elastic IPs, key pairs and reserved instances; RDS; S3; Lambda; DynamoDB; ECS; ElastiCache; load balancers; NAT gateways; CloudWatch log groups with no retention; and Compute Optimizer. Idle and oversized come from CloudWatch CPU series, so they are measured rather than guessed.

GCP

Application Default Credentials

... View full README on GitHub