Cloudwright

Architecture intelligence for cloud engineers.

Cloudwright bridges the gap between a whiteboard sketch and deployable infrastructure. Describe a system in natural language, and Cloudwright produces a structured architecture spec, cost estimates, compliance reports, Terraform/CloudFormation code, diagrams, and diffs — all from a single format called ArchSpec.

HIPAA-compliant healthcare API on AWS — 12 components with VPC boundaries, cost breakdown ($2,263/mo), compliance validation (HIPAA 60%), and eight export formats including Terraform, CloudFormation, and ASCII architecture diagrams.

Architecture Diagram	Cost Breakdown

Web UI — interactive React Flow diagrams with tier-based layout, service-category color coding, boundary grouping, per-component cost overlay, and compliance validation.

Installation

pip install 'cloudwright-ai[cli]'          # CLI
pip install 'cloudwright-ai[web]'          # CLI + Web UI
pip install cloudwright-ai-mcp             # MCP server for AI agents

Set an LLM provider key (required for design, modify, chat, adr; all other commands work offline):

export ANTHROPIC_API_KEY=sk-ant-...
# or
export OPENAI_API_KEY=sk-...

# Design from natural language
cloudwright design "3-tier web app on AWS with Redis and PostgreSQL"

# Estimate cost with production-realistic workload profiles
cloudwright cost spec.yaml --workload-profile medium
cloudwright cost spec.yaml -w enterprise --pricing-tier reserved_1yr

# Validate compliance
cloudwright validate spec.yaml --compliance hipaa,soc2

# Export Terraform
cloudwright export spec.yaml --format terraform -o ./infra

# Compare cost across clouds
cloudwright cost spec.yaml --compare gcp,azure

# Security scan
cloudwright security spec.yaml

# Import existing infrastructure
cloudwright import terraform.tfstate -o spec.yaml

# Interactive multi-turn design
cloudwright chat           # terminal
cloudwright chat --web     # browser UI

What's New

v1.1.0 — Security Hardening, OpenAI Support, Docker (2026-04-04)

v1.1.0 — API key enforcement, OpenAI provider routing, provider-aware service normalization, Docker deployment, and security headers.

Security hardening, reliability fixes, and multi-provider LLM support across all 4 packages. 32 files changed, 389 insertions.

Security. Web server now requires CLOUDWRIGHT_API_KEY at startup (fail-fast). New SecurityHeadersMiddleware adds X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Content-Security-Policy, and Referrer-Policy to all responses. Rate limiter returns Retry-After header on 429s. X-Forwarded-For parsing behind reverse proxy via CLOUDWRIGHT_TRUST_PROXY. Client-supplied assistant-role m

... View full README on GitHub