# chaandannn/finopsmcp [Health: Active] **Category:** ☁️ Cloud Platforms **Repository:** https://github.com/chaandannn/finopsmcp **GitHub Stars:** 18 **Views:** 2 **Installs:** 0 **Upvotes:** 0 **Directory Page:** https://allmcps.com/mcp/chaandannn-finopsmcp ## Description Local-first FinOps copilot. Connect AWS, Azure, GCP, Kubernetes, and 15+ SaaS and AI bills, then ask cost questions in Claude or Cursor, find waste, and get the fix as a pull request you approve. Read-only; your credentials and bill stay on your machine. uvx nable. ## Tools Capabilities this server exposes over MCP: - **connect_aws** — Connect an AWS account from inside your MCP client, no terminal needed. Propose-then-confirm and local-only. It reads AWS credentials that already exist on this machine (named profiles, environment, the default chain), verifies each against STS, and connects the one you choose. It never creates, modifies, or deletes anything in your AWS account, and credentials stay on this machine. Call it with no arguments first to see which accounts are available (nothing is stored). Then call it again with account_id set to the one to connect. Examples: - "Connect my AWS account" - "Use the credentials on this machine to connect AWS" - **connect_azure** — Guide connecting Azure while keeping the service-principal secret off the model. Azure has no local credentials nable can safely auto-detect, so connecting needs a client secret. Unlike connect_aws and connect_gcp (which read credentials already on the machine, so nothing sensitive passes through this conversation), an Azure secret would have to be pasted into the chat to reach a tool argument, which routes it through the model provider. nable does not do that. This tool returns the Cloud Shell script and has you finish the connect in your OWN terminal with `finops setup azure`, which encrypts the secret into your local vault. The model never sees the secret. Examples: - "Connect Azure" - "How do I connect my Azure subscription?" - **get_cost_summary** — Get total spend summarized by service, account, and region. Examples: - "How much did we spend last month?" - "Give me an AWS cost summary for January" - **estimate_change_cost** — Cost preflight for a proposed change: what it costs and whether it fits budget. Agent-native. Call this BEFORE applying an infrastructure change to get a machine verdict (ok / warn / over_budget / no_budget) plus the monthly and annual cost delta and the budget headroom. Read-only: it estimates and checks, it never applies anything. Describe the change one of these ways: - terraform_plan_json / terraform_plan_file / tf_dir : a Terraform plan - helm_diff : output of `helm diff upgrade` or a values.yaml diff - monthly_delta_usd : a known monthly cost delta (escape hatch for any change the estimators don't parse, e.g. "launch a db.r6g.4xlarge") budget_name selects which budget to check against; default is the first active budget. With no budget configured the verdict is "no_budget" and the cost delta is still returned. Good triggers: "will this fit my budget", "what will this terraform/helm change cost before I apply it", "cost preflight", "can the agent afford this change". Examples: - "What would this change cost per month?" - "Preflight the cost of this terraform plan" - **connect_gcp** — Connect a Google Cloud billing account from inside your MCP client, no terminal. Propose-then-confirm and local-only. It reads Google Cloud credentials that already exist on this machine (GOOGLE_APPLICATION_CREDENTIALS or gcloud Application Default Credentials), lists the open billing accounts they can see, and connects the one you choose. It never changes anything in GCP, and credentials stay on this machine. Call it with no arguments to see the billing accounts available (nothing is stored). Then call it again with billing_account_id set to connect one. Examples: - "Connect my Google Cloud billing" - "Use my gcloud login to connect GCP" - **list_connected_providers** — List every cloud, SaaS, and LLM provider nable knows, each marked connected or not-configured, plus the active plan. The starting point for "what am I connected to" and for spotting which connector still needs credentials (each not-configured entry names the setup command to run). Examples: - "Which providers are connected?" - "Is GCP set up yet?" - **check_ai_budget** — Advisory gate: before a big task, is the agent about to blow its AI budget? Call this before an expensive run. Returns a verdict (ok / warn / over), the reason, and a recommendation. Advice only, it never blocks; relay the verdict and let the human decide. Pass estimated_next_tokens to test whether the next task would tip a token budget over. - **check_action_policy** — Advisory policy gate: should a proposed remediation action proceed? The request-path guardrail, advisory. Describe a remediation action you are considering (action_type), optionally with the change to cost (a Terraform plan, a helm diff, or a known monthly delta), and nable returns a machine verdict against your human-authored policy: - allow: reversible, allowlisted, and within budget. A human can apply it. - escalate: a one-way door (delete, terminate, buy a commitment) or an over-budget / large-cost change. A human must review it first. - block: the action type is not in your allowlist. ADVICE ONLY. nable never applies the action, a human does. This is the propose-only guardrail; nable does not auto-execute anything. action_type examples: rightsizing, tag_fix, stop_idle, spot_migration, ticket (reversible); idle_cleanup, purchase_commitment, terminate_instance, delete_resource (one-way). Policy knobs via env: FINOPS_POLICY_MAX_AUTO_USD, FINOPS_POLICY_ALLOWED_ACTIONS (comma-separated). Read-only. Good triggers: "can the agent do X", "is this action within policy", "should I apply this fix", "is it safe to auto-apply this". Examples: - "Is this apply within policy?" - "Check this change against our cost guardrails" - **what_can_nable_do** — Show everything nable can do, tailored to what you've connected. Call this when the user asks "what can you do?", "what features do you have?", "what should I try first?", "show me what's available", or "help". Always call it right after a user connects their first account, so they see what just became possible. Pass detailed=True to also list the underlying tool names. Examples: - "What can nable do?" - "List your capabilities" - **nable_setup_status** — Agent-driven onboarding: what is connected, what credentials are already on this machine, and the exact command to connect each remaining provider. Call this when the user asks to connect a provider, says setup is incomplete, or asks what they are missing. Detected ambient credentials (gcloud login, env keys, ~/.modal.toml) mean the connect is ONE terminal command with no secrets involved; run it for the user or hand them the command. Rules for the agent, and they are hard rules: - NEVER ask the user to paste an API key or secret into the chat. For paste-a-key providers, have them run the setup command in their own terminal; it deep-links the key page and stores the key locally. - Prefer the zero-secret paths: `finops connect` (batch-connects everything detected) and `finops setup gcp` / ambient AWS, where no secret ever passes through the conversation. Examples: - "Connect my GCP costs" - "What providers am I missing?" ## Claude Desktop Quick Installation Install path detected from listing signals. Uses `uvx` (confidence: high): ```json "mcpServers": { "finopsmcp": { "command": "uvx", "args": ["nable"] } } ``` ## Documentation & README # nable **See where your cloud and AI bills go, and spend less. Runs in your terminal or inside Claude, Cursor, and VS Code.** [![PyPI](https://img.shields.io/pypi/v/finops-mcp?label=pypi&color=4db8d4)](https://pypi.org/project/finops-mcp/) [![PyPI Downloads](https://static.pepy.tech/personalized-badge/finops-mcp?period=total&units=INTERNATIONAL_SYSTEM&left_color=BLACK&right_color=GREEN&left_text=downloads)](https://pepy.tech/projects/finops-mcp) [![Tests](https://github.com/getnable/finopsmcp/actions/workflows/test.yml/badge.svg)](https://github.com/getnable/finopsmcp/actions/workflows/test.yml) [![License: Apache-2.0](https://img.shields.io/badge/license-Apache--2.0-4db8d4)](LICENSE) [![MCP Toplist](https://mcptoplist.com/badge/io.github.getnable%2Ffinops-mcp.svg)](https://mcptoplist.com/server/io.github.getnable%2Ffinops-mcp) You do not need to be a cloud-cost expert. nable does three things: - **Shows what you spend** across AWS, Azure, GCP, Kubernetes, and 15+ AI and SaaS providers, in one place. - **Finds what you are wasting** (idle servers, oversized databases, forgotten storage) and puts a dollar figure on each one. - **Fixes it, with your approval,** by opening a pull request, then checks your next bill to prove the saving was real. Everything runs on your machine, read-only, and your billing data never leaves it. ## Try it ```bash uvx nable scan ``` ```text nable scan · profile prod account 3521… · this account only scanning 17 regions … us-east-1 ......... 3 findings eu-west-1 ......... 1 finding ──────────────────────────────────────────── $2,140/mo recoverable $1,200/mo 3 idle NAT gateways, us-east-1 $610/mo 14 unattached EBS volumes (2.1 TB), us-east-1 $330/mo idle RDS instance (db.r5.xlarge, <2% CPU), eu-west-1 run `nable scan --spend` for the spend breakdown (uses Cost Explorer, ~$0.02) ``` Reads only free cloud APIs, so scanning never adds to your bill. `uvx nable scan --demo` runs on sample data with no account at all. Add `--json` for CI, or `--spend` for a deeper breakdown. ![nable demo: a sample bill in seconds](https://raw.githubusercontent.com/getnable/finopsmcp/main/docs/demo.gif) ## Use it in your editor `uvx nable` runs as a local MCP server inside Claude, Cursor, and VS Code, on your existing Claude or Cursor membership, no API key and no per-token cost. Then ask: - "Why did our AWS bill jump last month?" - "How much are we spending on OpenAI and Anthropic?" - "Which instances should we downsize?" - "Open a Jira ticket for any waste over $200/mo" ## Setup Requires Python 3.11+. Need `uv`? `curl -LsSf https://astral.sh/uv/install.sh | sh` (or `brew install uv`). ```bash uvx nable ``` The setup wizard finds AWS or GCP credentials already on your machine (an SSO login, a CLI profile, or default credentials), connects the one you pick, and configures your editor. Usually you never type a key. **Cursor one-click:** [`Add nable to Cursor`](https://github.com/chaandannn/finopsmcp/blob/HEAD/cursor://anysphere.cursor-deeplink/mcp/install?name=nable&config=eyJjb21tYW5kIjogInV2eCIsICJhcmdzIjogWyItLXB5dGhvbiIsICIzLjEyIiwgImZpbm9wcy1tY3AiXX0=) Free forever for the local tool. A hosted version for teams (dashboards without a terminal, SSO, scheduled reports, always-on agents) is at [getnable.com/pricing](https://getnable.com/pricing).
Manual editor config — only needed if setup didn't auto-configure If `finops setup` doesn't auto-configure, run: ```bash finops setup claude ``` Or add manually to `claude_desktop_config.json`: **With uvx (recommended):** ```json { "mcpServers": { "nable": { "command": "uvx", "args": ["--python", "3.12", "finops-mcp"] } } } ``` **With absolute path:** ```json { "mcpServers": { "nable": { "command": "/usr/local/bin/finops-mcp" } } } ``` Use the path from `which finops-mcp`. Config file locations: - **macOS**: `~/Library/Application Support/Claude/claude_desktop_config.json` - **Windows**: `%APPDATA%\Claude\claude_desktop_config.json` - **Linux**: `~/.config/Claude/claude_desktop_config.json` > **Why uvx?** Claude Desktop is a GUI app and doesn't inherit your shell's PATH. uvx runs finops-mcp in its own isolated environment. It's the most reliable option on corporate machines with managed Python installs.
Give your agent cost controls — a pre-action budget gate for coding agents nable is not just tools your agent reads from. It is a pre-action gate your agent calls **before** it makes a cost-affecting change: it prices the change, checks it against your budget, and offers a cheaper path. It never applies anything itself. Propose-only, your agent proposes and a human approves. Add one line to your agent's system prompt (Claude Code, Cursor, or any MCP client): > Before you apply any infrastructure change (a terraform apply, a helm upgrade, > creating or resizing a resource) or start an expensive job, first call > `check_action_policy` with the action and the change (a terraform plan, a helm > diff, or a `monthly_delta_usd`). Relay the verdict, the dollar impact, and the > cheaper path when one is offered. Never apply a `block` or an `escalate` action; > surface it to the human. nable is advisory and propose-only. The gate returns `allow` / `warn` / `block` / `escalate` against your policy, the monthly and annual dollar impact, and a spot alternative when the change is compute. One-way doors (delete, terminate, buy a commitment) and over-budget changes always escalate to a human. **And a budget for the agent itself.** Run `nable ai-budget` once, it asks whether you are on a flat plan or a metered API and what you pay, then remembers. On a flat plan it tracks how much subsidized compute you pull for your fixed fee and warns before you run low; on metered it gates on a dollar spend cap. `check_ai_budget` does the same for the agent mid-task. It reads your Claude Code usage locally, nothing uploaded. Add to your system prompt: > Before starting a large task, call `check_ai_budget`. If it returns `warn` or > `over`, tell me where I stand before continuing. It reports your real usage and burn rate against your budget, not a fabricated percentage of a plan's hidden rate limit.
Connectors (17) — every provider and what it pulls, plus Azure roles | Provider | What it pulls | |---|---| | AWS | Cost Explorer (free tier) · CUR via S3 (Pro: line-item granularity, savings plans, reservations) | | Azure | Cost Management API · Advisor cost recs · VM rightsizing (Azure Monitor) · native budgets · forecast | | GCP | Cloud Billing API + BigQuery export | | Datadog | Usage Metering API v2: real dollar amounts | | Snowflake | ACCOUNT_USAGE.METERING_HISTORY | | Langfuse | Daily metrics API: model cost, token usage, trace volume | | MongoDB Atlas | Invoice API | | Twilio | Usage Records API | | Cloudflare | Billing API | | Vercel | Invoice API (Enterprise) | | New Relic | Data ingest + user counts | | Stripe | Fees and billing activity | | Databricks | DBU usage and SQL warehouse spend | | OpenAI | API usage and token spend by model | | Anthropic | Claude API usage and token spend | **Azure roles.** The Azure tools span three RBAC roles, granted to the service principal on each subscription (run `finops doctor` to check): ```bash # repeat per subscription az role assignment create --assignee --role 'Cost Management Reader' --scope /subscriptions/ az role assignment create --assignee --role Reader --scope /subscriptions/ az role assignment create --assignee --role 'Monitoring Reader' --scope /subscriptions/ ```
FAQ — free vs paid, providers, how it compares to Cost Explorer / Vantage **Is nable free?** Yes. The terminal scan, every cost query, anomaly detection, all waste and rightsizing findings, and every connector are free forever. The agent team, ticket auto-creation, scheduled digests, and commitment recommendations are Pro. **Does my billing data leave my machine?** No. nable is local-first and read-only by default. It reads your cost data on your machine and never uploads it, and you can confirm the no-egress behavior in the source. **What clouds and providers does it support?** AWS, Azure, GCP, and Vertex; Kubernetes (Kubecost, OpenCost); AI and LLM providers (OpenAI, Anthropic, Bedrock, OpenRouter, LiteLLM, Modal, Together, Replicate, Cohere, Mistral, Langfuse); data platforms (Databricks, Snowflake, MongoDB); and SaaS (Datadog, New Relic, Cloudflare, Twilio, Vercel, Stripe). **How is it different from AWS Cost Explorer?** Cost Explorer is AWS-only and console-bound. nable is cross-cloud, runs in your terminal and in Claude/Cursor, covers AI and GPU spend no cloud console shows, and proposes fixes as pull requests. `nable scan` also makes zero paid API calls by default. **Is there an open-source alternative to Vantage or CloudHealth?** nable is an open-source (Apache-2.0), local-first alternative for cost queries, waste detection, rightsizing, and AI/GPU cost, running on your machine instead of a hosted SaaS.
Troubleshooting — install and setup fixes ```bash finops-doctor # checks credentials, DB, network, audit log finops setup claude # re-run editor configuration only ``` | Symptom | Fix | |---|---| | Tools don't appear in Claude | Switch to uvx config or use absolute path | | `command not found: finops-mcp` | Re-install with `pip install finops-mcp` or use `uvx` | | AWS returns no data | Run `finops setup aws` | | `No matching distribution found for finops-mcp` | Your Python is older than 3.11. Install on 3.11+ (`uvx --python 3.12 nable`, or `python3.11 -m pip install finops-mcp`). | | `cryptography` build error / `maturin failed` | uv tried to compile on Python 3.10. Use 3.11+: `uvx --python 3.12 nable`. | | Corporate SSL errors | `pip install --trusted-host pypi.org --trusted-host files.pythonhosted.org finops-mcp` | | Works at home, not at work | Use `uvx` (corporate IT often strips custom PATH entries) |
## License Apache-2.0 in full. The hosted enterprise layer (web dashboard, SSO, control plane) lives in a separate private repo. Full tool list in [CAPABILITIES.md](https://github.com/chaandannn/finopsmcp/blob/HEAD/CAPABILITIES.md). [getnable.com](https://getnable.com) · [Docs](https://getnable.com/docs) · [Privacy](https://getnable.com/privacy) · [Security](https://scorecard.dev/viewer/?uri=github.com/getnable/finopsmcp) mcp-name: io.github.getnable/finops-mcp