{"slug": "show-hn-cloudrift-read-only-aws-waste-scan-now-call-from-your-agent-mcp", "title": "Show HN: Cloudrift – read-only AWS waste scan, now call from your agent(MCP)", "summary": "Cloudrift, a read-only AWS waste scanner, is now available as a command-line tool that estimates monthly costs of wasted resources without modifying or deleting anything. The tool, installable via npm or Homebrew, requires Node.js 20+ and read-only IAM permissions, and supports interactive wizard or flag-based analysis across multiple regions. It identifies waste in EBS volumes, Elastic IPs, RDS instances, load balancers, EC2 instances, EBS snapshots, and NAT gateways, with estimated costs per resource type.", "body_md": "**Scans AWS accounts for wasted resources and estimates the monthly cost of that waste.**\n\nRead-only. No telemetry. Never deletes, modifies, or stops anything — reports only.\n\n```\nnpm install -g @cloudrift/cli\ncloudrift\n```\n\nmacOS/Linux via Homebrew: `brew install elleVas/cloudrift/cloudrift`\n\nThat's it — no subcommand needed, the interactive wizard walks you through region and scanner selection. Requires **Node.js 20+** and AWS credentials with [read-only IAM permissions](https://github.com/elleVas/cloudrift/blob/main/docs/en/iam-permissions.md) (`aws configure`\n\n, or env vars — see [full setup](#full-setup-fresh-aws-credentials-from-source) below if you need that first).\n\nPrefer flags over the wizard (scripts, CI)? Same tool, same output:\n\n```\ncloudrift analyze -r us-east-1 eu-west-1 --pdf\n```\n\nSee [docs/en/usage.md](https://github.com/elleVas/cloudrift/blob/main/docs/en/usage.md) for every flag.\n\n⚠️ Disclaimer:cloudrift reports estimated waste and recommendations only — it never deletes, modifies, or stops any AWS resource. All findings should be validated by your infrastructure team before taking action. The maintainers assume no liability for actions taken based on this report.Contact:[raffaelevasini@gmail.com]·[GitHub]·\n\n**📑 Table of contents**\n\n**Full setup** — fresh AWS credentials, from source\n\n```\nnpm install -g @cloudrift/cli\n# or run it once-off, without installing:\nnpx @cloudrift/cli analyze\n```\n\n**Or via Homebrew** (macOS/Linux):\n\n```\nbrew install elleVas/cloudrift/cloudrift\n```\n\n**From source** (for contributing, or to run unreleased changes):\n\n```\ngit clone <repo-url>\ncd cloudrift\npnpm install\npnpm nx build cli   # output compiled to apps/cli/dist/\n```\n\nThree options, in order of preference:\n\n**Option A — AWS CLI (recommended if you already have it installed)**\n\n```\naws configure\n# enter: Access Key ID, Secret Access Key, default region (e.g. us-east-1), output format (json)\n```\n\nThis creates `~/.aws/credentials`\n\nwith the `default`\n\nprofile.\n\n**Option B — Edit ~/.aws/credentials manually**\n\n```\n[default]\naws_access_key_id     = AKIAIOSFODNN7EXAMPLE\naws_secret_access_key = wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY\n```\n\n**Option C — Environment variables**\n\n```\nexport AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE\nexport AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY\nexport AWS_DEFAULT_REGION=us-east-1\n```\n\nVerify:`aws sts get-caller-identity`\n\nshould return your account ID without errors.\n\nThe AWS user/role must have the policy listed in [Required IAM permissions](https://github.com/elleVas/cloudrift/blob/main/docs/en/iam-permissions.md). If using an IAM user, attach it from the [IAM Console](https://console.aws.amazon.com/iam/) → User → Add permissions → Create inline policy.\n\n```\n# npm install:\ncloudrift                                      # no subcommand, in a real terminal: interactive wizard\ncloudrift analyze                              # scan us-east-1 (default)\ncloudrift analyze -r us-east-1 eu-west-1       # scan multiple regions\n\n# From source:\nnode apps/cli/dist/main.js analyze\nnode apps/cli/dist/main.js analyze -r us-east-1 eu-west-1\n```\n\nThe account ID is auto-detected via STS. If everything is configured correctly you'll see tables listing the wasted resources found and an estimated total cost. If the account has no wasted resources you'll see \"No wasted resources found\".\n\n| Resource | Waste condition | Estimated cost (us-east-1) |\n|---|---|---|\nEBS Volumes |\nUnattached (`state: available` ) |\ngp3: $0.08/GB-mo · gp2: $0.10/GB-mo · io1: $0.125/GB-mo |\nElastic IPs |\nUnassociated (no EC2/NAT binding) | $3.60/month fixed |\nRDS Instances |\nStopped (still billed for storage) | gp2/gp3: $0.115/GB-month |\nLoad Balancers |\nNo registered targets (ALB/NLB) | ~$16.20/month fixed |\nEC2 Instances |\nStopped — attached EBS volumes keep billing | Sum of attached EBS volumes |\nEBS Snapshots |\nSource volume deleted (orphan snapshots) | $0.05/GB-month |\nNAT Gateways |\nZero outbound traffic in the last 14 days | ~$32.40/month fixed |\nEBS gp2→gp3 |\nIn-use gp2 volume upgradeable to gp3 (savings, not waste) | Saving: gp2 − gp3 price × GB (≈ $0.02/GB-mo) |\nEBS Volumes (idle) |\nAttached (in-use) but zero I/O in the last 14 days | gp3: $0.08/GB-mo · gp2: $0.10/GB-mo · io1: $0.125/GB-mo |\nEC2 Instances (underutilized) |\nRunning, max CPU ≤ 5% over 14 days — rightsizing candidate, requires `--live-pricing` |\nSaving: real price difference to one size down in the same family (e.g. `m5.2xlarge` →`m5.xlarge` ), $0 if not derivable — verify RAM/network before acting |\nRDS Instances (underutilized) |\nAvailable, max CPU ≤ 5% over 14 days — rightsizing candidate, requires `--live-pricing` |\nSaving: real price difference to one size down in the same family, $0 if not derivable — verify storage I/O/connections before acting |\nCloudWatch Log Groups |\nNo retention policy configured (logs grow forever) | $0.03/GB-month |\nOrphaned ENIs |\n`Status: available` (not attached to any instance) |\n$0 (hygiene flag, not a direct cost) |\nS3 Buckets (no lifecycle) |\nNo lifecycle configuration — rightsizing candidate | $0 (hygiene flag, no dollar basis — check object age / S3 Storage Lens before acting) |\nLambda Functions (underutilized) |\n(Near-)zero invocations over 7 days | $0 (hygiene flag — pay-per-use Lambda has no direct cost when unused) |\nEFS File Systems (unused) |\nNo mount targets, or mounted with zero I/O in the last 14 days | $0.30/GB-month (Standard storage) |\nDynamoDB Tables (overprovisioned) |\nPROVISIONED mode, read/write capacity utilization < 10% over 7 days — rightsizing candidate | Saving: (current − recommended RCU/WCU) × real unit price; recommended = avg consumed rate × 3x headroom (no peak datapoints available), floored at 1 unit — verify traffic spikes before acting |\nElastiCache Clusters (idle) |\nZero client connections in the last 14 days, requires `--live-pricing` |\nFull node-hour cost (node billed regardless of usage) |\nRedshift Clusters (idle) |\nZero database connections in the last 14 days, requires `--live-pricing` |\nFull node-hour cost × number of nodes |\nOpenSearch Domains (idle) |\nNear-zero search/indexing requests in the last 14 days (below the internal cluster-chatter threshold — health checks/ISM polling never hit literal zero), requires `--live-pricing` |\nFull instance-hour cost × instance count |\nMSK Clusters (idle) |\nProvisioned mode, zero broker traffic in the last 14 days, requires `--live-pricing` |\nFull broker-hour cost × number of brokers |\nFSx File Systems (idle) |\nZero read/write I/O in the last 14 days | $0.093–$0.14/GB-month depending on file system type |\nDocumentDB Instances (idle) |\nZero database connections in the last 14 days, requires `--live-pricing` |\nFull instance-hour cost |\nNeptune Instances (idle) |\nZero query traffic in the last 14 days, requires `--live-pricing` |\nFull instance-hour cost |\nAmazon MQ Brokers (idle) |\nZero network traffic in the last 14 days, requires `--live-pricing` |\nFull broker-hour cost (×2 for ACTIVE_STANDBY_MULTI_AZ) |\nWorkSpaces (idle) |\nAlwaysOn, no user connection in the last 30 days, requires `--live-pricing` |\nFull bundle monthly cost |\nSite-to-Site VPN Connections (idle) |\nZero tunnel traffic in the last 14 days | ~$36.50/month fixed |\nTransit Gateway Attachments (idle) |\nZero traffic in the last 14 days | ~$36.50/month fixed |\nKinesis Streams (idle, Provisioned mode) |\nZero incoming records in the last 14 days (On-Demand mode out of scope — pay-per-use) | ~$10.95/month per shard |\nSQS Dead Letter Queues (abandoned) |\nIdentified as a DLQ (RedrivePolicy/naming), oldest unconsumed message older than 14 days | $0 (hygiene flag — SQS has no storage cost) |\nCloudWatch Log Groups (orphaned Lambda) |\n`/aws/lambda/*` log group whose function no longer exists |\n$0.03/GB-month (stored log data) |\nAurora Serverless v2 (overprovisioned Min ACU) |\nMin ACU floor set well above the observed peak ACU over 7 days — rightsizing candidate | Saving: (Min ACU − suggested Min ACU) × $87.60/ACU-month |\nSageMaker Notebook Instances (idle) |\n`InService` , max CPU ≤ 2% over 7 days, requires `--live-pricing` |\nFull instance-hour cost |\nSageMaker Endpoints (idle) |\n`InService` , zero invocations over 7 days, requires `--live-pricing` |\nFull instance-hour cost × instance count |\nSageMaker Models (orphaned, no endpoint) |\nNot referenced by any endpoint config — model-namespace hygiene | $0 (no dollar basis — artifact size isn't returned by any `DescribeModel` /`ListModels` field) |\nDev/PR Environments (ghost, all resources inactive) |\nResources grouped by tag or naming pattern, all inactive for 7+ days | Estimated total cost of the resource group |\nEKS Node Groups (overprovisioned) |\nCPU requested < 30% of allocatable per Container Insights, requires `--live-pricing` |\nSaving: (nodes − suggested nodes) × instance price |\nEKS Orphaned PVC Volumes |\nKubernetes-provisioned EBS volume unattached, or its owning cluster no longer exists | gp3: $0.08/GB-mo · gp2: $0.10/GB-mo (same table as EBS Volumes) |\nAMIs (unused) |\nSelf-owned AMI not referenced by any instance or launch template | Cost of the backing EBS snapshot(s), $0.05/GB-month |\nECR Images (untagged) |\nDangling image (no tag) in any repository | $0.10/GB-month |\nS3 Multipart Uploads (abandoned) |\nIncomplete multipart upload, never completed or aborted | $0.023/GB-month (Standard storage rate on the uploaded parts) |\nRDS Manual Snapshots (old) |\nManual snapshot older than the grace period | $0.095/GB-month |\nSecrets Manager Secrets (unused) |\nNever accessed, or not accessed in the last 30 days | $0.40/secret/month fixed |\nCodePipeline Pipelines (stale) |\nNo execution within the grace period (or never executed since creation) | $1.00/month fixed per pipeline |\n\nEvery finding is also tagged `waste`\n\nor `optimization`\n\n: `waste`\n\nis money being spent now and feeds the headline total and the CI gate; `optimization`\n\n(gp2→gp3, EC2/RDS underutilized, S3 no-lifecycle, Lambda underutilized, DynamoDB overprovisioned, Aurora Serverless overprovisioned, SageMaker Models orphaned, EKS Node Groups overprovisioned) is a saving opportunity that keeps the resource, shown separately and never gated. Within `optimization`\n\n, a finer `confidence`\n\naxis says how defensible the dollar figure is: `measured`\n\n(every `waste`\n\nkind — a real price × an observed quantity), `derived`\n\n(gp2→gp3, EC2/RDS underutilized, DynamoDB/Aurora Serverless/EKS Node Groups overprovisioned — a real price *difference*, still advisory, needs verifying) or `heuristic`\n\n(S3 no-lifecycle, Lambda underutilized, SageMaker Models orphaned — no real dollar basis at all, these always report $0 rather than a guess).\n\nHonest caveat (Lambda):we only check invocation count over the lookback window, nothing else. We donotrightsize memory allocation — that requires Lambda Insights (extra cost, must be enabled per-function), which isn't part of a zero-extra-IAM read-only scan. A function with zero invocations has, by definition, $0 direct cost (pay-per-use); the value of this finding is hygiene (dead code, unnecessary IAM roles/event sources), not a dollar saving. It also won't catch idleProvisioned Concurrency, whichisbilled regardless of invocations — out of scope for now.\n\nHonest caveat (rightsizing):the underutilized check is a single-metric heuristic — max CPU below a threshold over the lookback window, nothing else. It doesnotlook at RAM, network throughput, IOPS or connection counts, so it can't tell youwhichsmaller instance type actually fits. We do this because it requires no extra IAM permissions and works the same on every account; we don't replace[AWS Compute Optimizer], which models multiple metrics and recommends a specific target type. Treat our finding as \"go check this instance,\" not as a sizing recommendation — cross-check with Compute Optimizer (or your own metrics) before resizing.\n\nHonest caveat (EKS):the node-overprovisioned check reads Container Insights'node-levelCPU/memory aggregates (`node_cpu_request`\n\n/`node_cpu_limit`\n\n) via the AWS API only — it never sees individual Pod requests/limits and never talks to the Kubernetes API (no kubeconfig, see ADR-0066). If Container Insights isn't enabled on the cluster, the scanner reports nothing rather than guessing. Treat the suggested node count as a starting point for investigation, not a sizing recommendation. Separately, the orphaned-PVC-volume check can only recover the owning cluster's name from the legacy`kubernetes.io/cluster/<name>`\n\ntag — CSI-driver-provisioned volumes without`--extra-tags`\n\nwon't carry it, so those volumes are only ever flagged via the unattached check, never the deleted-cluster check.\n\nHonest caveat (real-AWS verification):36 of the 44 scanners have found real waste against a live AWS account (33 original +`ami-unused`\n\n,`ecr-image-untagged`\n\n,`s3-multipart-upload-abandoned`\n\n, confirmed 2026-07-22). A further 2 —`rds-manual-snapshot-old`\n\n,`secretsmanager-unused`\n\n— ran end-to-end against the same real account with zero SDK/IAM/parsing errors, but found nothing to flag (no manual snapshot existed to list; the test secret was younger than the 30-day grace period), so the call and response-shape are confirmed live but the finding-and-policy path isn't yet. The next 5 —`rds-underutilized`\n\n,`environment-ghost`\n\n,`sqs-dlq-abandoned`\n\n,`aurora-serverless-overprovisioned`\n\n,`eks-node-overprovisioned`\n\n— are unverified by design, not oversight: they need resources that have accumulated real, organic usage patterns over 7–14 days, which a short-lived synthetic test stack can't produce. One more,`codepipeline-pipeline-stale`\n\n(added 2026-07-23), hasn't had a real-AWS run at all yet — pending the next verification cycle. All 44 are covered by unit tests and fixture-replay contract tests (mocked AWS responses) regardless of live-verification status. See[docs/en/testing.md]for the full breakdown.\n\n**False-positive guards (waste policies):**\n\n**Grace period**— resources younger than 7 days (configurable via`--min-age-days`\n\n) are never reported. For EC2 the stop time is reconstructed from`StateTransitionReason`\n\n; for NAT Gateways and Load Balancers the creation time is used.**Exclusion tag**— any resource tagged`cloudrift:ignore`\n\n(configurable via`--ignore-tag`\n\n) is skipped. Caveat: anyone with tag-write access to a resource can apply this tag to hide it from scans — the same trust boundary as any other AWS permission, see[SECURITY.md](/elleVas/cloudrift/blob/main/SECURITY.md#tag-based-exclusion-is-a-trust-boundary-not-a-security-control).**AMI-bound snapshots**— orphan snapshots referenced by a registered AMI are not reported (they cannot be deleted anyway).\n\nPrices vary by region. The tool uses region-specific pricing for:\n\n`us-east-1`\n\n,`us-west-2`\n\n,`eu-west-1`\n\n,`eu-central-1`\n\n,`ap-southeast-1`\n\n,`ap-northeast-1`\n\n. Every report states the date the price table was last verified (`prices as of`\n\n).\n\nBeyond waste detection, cloudrift can also compare and chart your actual AWS bill via Cost Explorer:\n\n```\ncloudrift cost                          # this month so far vs. the same days last month, by service\ncloudrift trend --months 12             # monthly spend over the last 12 months, ANSI bar chart\n```\n\n⚠️ Unlike every scanner above (free describe/list calls),`cost`\n\n/`trend`\n\ncallAWS Cost Explorer, which bills $0.01 per request— the only commands in cloudrift that can incur an AWS charge. Both ask for confirmation before the first call (skip it with`-y`\n\n/`--yes`\n\n); closed billing periods are cached on disk so repeat runs for the same dates don't bill you again. See[docs/en/usage.md]for the full flag reference.\n\nA separate hygiene scan, deliberately outside the cost-waste model above: things left dead or unused in the account that cost **$0** (so they're invisible to `analyze`\n\n's cost-based criteria) but are still worth cleaning up or reviewing.\n\n```\ncloudrift dead-resources                              # every check, us-east-1\ncloudrift dead-resources -r us-east-1 eu-west-1        # multiple regions (regional checks only — see below)\ncloudrift dead-resources --scanners iam-user-inactive  # only one check\n```\n\n| Check | Flags | Severity | Default threshold |\n|---|---|---|---|\nEC2 Key Pairs (unused) |\nNot referenced by any running/stopped instance | info | 7-day grace period (`--min-age-days` ) |\nEC2 Reserved Instances (expiring soon) |\nActive, term ends within the threshold | warning | 30 days |\nEC2 Security Groups (unused) |\nNot referenced by any network interface (`default` group excluded) |\ninfo | none — no creation date exposed by the API |\nCloudWatch Log Groups (empty) |\nNever stored any events | info | 7-day grace period (`--min-age-days` ) |\nACM Certificates (unused) |\nNot attached to any AWS resource | info | 7-day grace period (`--min-age-days` ) |\nCloudFormation Stacks (stuck) |\n`CREATE_FAILED` /`ROLLBACK_FAILED` /`DELETE_FAILED` /`UPDATE_ROLLBACK_FAILED` |\ncritical | 7-day grace period (`--min-age-days` ) |\nCloudWatch Alarms (orphaned) |\nStuck in `INSUFFICIENT_DATA` |\nwarning | 7-day grace period (`--min-age-days` ) |\nIAM Users (inactive) |\nNo console login or access-key use | warning | 90 days (or never, past the 7-day creation grace period) |\nIAM Policies (unattached) |\nCustomer-managed, zero attachments (AWS-managed policies excluded — you can't delete those anyway) | info | 7-day grace period (`--min-age-days` ) |\nIAM Roles (unused) |\nNever assumed, or not within the threshold (service-linked roles excluded) | warning | 90 days (or never, past the 7-day creation grace period) |\nIAM Access Keys (stale) |\nActive key not rotated within the threshold | warning | 90 days |\nRoute53 Hosted Zones (empty) |\nNo records beyond the default NS/SOA pair | info | none — no creation date exposed by the API |\nS3 Buckets (empty) |\nZero objects | info | 7-day grace period (`--min-age-days` ) |\nIAM Instance Profiles (unattached) |\nNot attached to any EC2 instance in any AWS region | info | 7-day grace period (`--min-age-days` ) |\nSNS Topics (no subscriptions) |\nZero subscriptions | info | none — no creation date exposed by the API |\nEventBridge Rules (no targets) |\nNo targets configured (default event bus only) | info | none — no creation date exposed by the API |\nECR Repositories (empty) |\nZero images | info | 7-day grace period (`--min-age-days` ) |\nStep Functions State Machines (never executed) |\nSTANDARD-type, zero executions (EXPRESS excluded) | info | 7-day grace period (`--min-age-days` ) |\n\n**IAM, Route53, and (for this command) S3 are global AWS services**: those seven checks run once per scan regardless of how many `--regions`\n\nyou pass, never once per region — the other eleven checks are genuinely regional. See [ADR-0078](https://github.com/elleVas/cloudrift/blob/main/docs/adr/0078-dead-resources-parallel-domain.md)/[ADR-0079](https://github.com/elleVas/cloudrift/blob/main/docs/adr/0079-dead-resources-global-scope-scanners.md) for the design behind this split, `--format json`\n\n/`csv`\n\n/`--pdf`\n\nfor machine-readable/shareable output. See [docs/en/usage.md](https://github.com/elleVas/cloudrift/blob/main/docs/en/usage.md#dead-resources--deadunused-resource-hygiene) for the full flag reference.\n\nA third, separate domain: risky **configuration** on resources that are actively in use (unlike `dead-resources`\n\nabove, which finds abandoned ones) — IAM/account hygiene, network exposure, public storage, encryption at rest, and visibility/audit. All 29 checks are read-only (`Describe*`\n\n/`Get*`\n\n/`List*`\n\nonly). See [ADR-0081](https://github.com/elleVas/cloudrift/blob/main/docs/adr/0081-resource-security-parallel-domain.md).\n\n```\ncloudrift resource-security                                    # every check, us-east-1\ncloudrift resource-security -r us-east-1 eu-west-1              # multiple regions (regional checks only — see below)\ncloudrift resource-security --scanners iam-root-mfa-disabled    # only one check\n```\n\n| Check | Flags | Severity |\n|---|---|---|\nRoot Account (MFA disabled) |\n`iam:GetAccountSummary` → `AccountMFAEnabled` |\ncritical |\nIAM Users (MFA disabled) |\nNo MFA device registered | warning |\nIAM Access Keys (rotation overdue) |\nActive key older than 90 days (CIS 1.14) | warning |\nRoot Account (active access key) |\n`AccountAccessKeysPresent` |\ncritical |\nAccount Password Policy (weak or missing) |\nShort of the CIS baseline, or absent | warning |\nEC2 Security Groups (open ingress on sensitive ports) |\n`0.0.0.0/0` /`::/0` on SSH/RDP/database ports |\ncritical |\nEC2 Default Security Groups (permissive) |\nDefault VPC security group still has rules | warning |\nS3 Buckets (public) |\nPublic via ACL and/or bucket policy | critical |\nEC2 Snapshots (public) |\n`createVolumePermission` granted to `all` |\ncritical |\nEBS Volumes (unencrypted) |\nNot encrypted at rest | warning |\nRDS Instances (unencrypted) |\nStorage not encrypted at rest | warning |\nS3 Buckets (default encryption missing) |\nNo default server-side encryption | warning |\nRDS Instances (publicly accessible) |\nReachable from outside its VPC | critical |\nCloudTrail (no multi-region trail) |\nNo trail with multi-region logging | warning |\n\n**IAM, S3 (bucket listing), and CloudTrail are global for this command**: those eleven checks run once per scan regardless of how many `--regions`\n\nyou pass, never once per region — the other eighteen checks are genuinely regional. `--format json`\n\n/`csv`\n\n/`--pdf`\n\nfor machine-readable/shareable output, no `--min-age-days`\n\n(a security misconfiguration is a risk from the moment it exists). See [docs/en/usage.md](https://github.com/elleVas/cloudrift/blob/main/docs/en/usage.md#resource-security--security-posture-scan) for the full flag reference.\n\n`analyze`\n\n, `dead-resources`\n\n, and `resource-security`\n\neach append a full snapshot of their own report to a local per-account SQLite file (`~/.cloudrift/trends/<account-id>.db`\n\n) every time they run — best-effort, never blocking the scan, never uploaded anywhere. `history`\n\nreads it back:\n\n```\ncloudrift history                              # every snapshot on record, most recent first\ncloudrift history --domain cloud-cost --limit 10\ncloudrift history --html                       # self-contained HTML trend report, all 3 domains stacked on one page\n```\n\nThe `--html`\n\nchart differs by domain: `cloud-cost`\n\nis a single dollar-waste line (plus a linear projection and a \"top resource types by waste\" list); `dead-resources`\n\n/`resource-security`\n\nchart critical/warning/info as three separate lines with a legend, matching the PDF/table severity breakdown (`resource-security`\n\nalso gets a plain-language risk narrative, deliberately no dollar figure). The combined report leads with a 3-tile executive summary for a CTO/CEO audience.\n\nSee [ADR-0099](https://github.com/elleVas/cloudrift/blob/main/docs/adr/0099-local-trend-store.md)/[ADR-0100](https://github.com/elleVas/cloudrift/blob/main/docs/adr/0100-history-comparison-and-html-report.md) and [docs/en/usage.md](https://github.com/elleVas/cloudrift/blob/main/docs/en/usage.md#history--local-scan-history) for the full flag reference (including `--compare`\n\nand single-domain `--html`\n\n).\n\n`analyze`\n\n, `dead-resources`\n\n, `resource-security`\n\n, and `history --compare`\n\ncan send a summary to Slack, a generic webhook, or email — `--notify-slack`\n\n, `--notify-webhook`\n\n, `--notify-email <address>`\n\n. Best-effort and never blocking: a broken webhook logs a warning, the scan itself is unaffected. Fires only when there's something worth reporting (critical/warning findings, waste over `costAlertThresholdUsd`\n\n, or a worsening trend on `history --compare`\n\n) — a clean run stays quiet. **Slack gets an alert only** (title + counts, e.g. \"3 critical, 14 warning, 0 info\") — deliberately no per-finding detail, so a scheduled pipeline scanning several accounts never turns the channel into an unreadable wall of text; the webhook and email payloads include the top findings, since a machine consumer or a personal inbox can handle the extra detail without cluttering a shared channel.\n\n```\ncloudrift resource-security --notify-slack\ncloudrift analyze --notify-email team@example.com\n```\n\nEvery credential (`SLACK_WEBHOOK_URL`\n\n, `CLOUDRIFT_WEBHOOK_URL`\n\n, `CLOUDRIFT_SMTP_HOST`\n\n/`PORT`\n\n/`USER`\n\n/`PASSWORD`\n\n/`FROM`\n\n) comes from the environment, never a flag — set it in your shell or as a CI secret, never in a committed file. See [docs/en/usage.md](https://github.com/elleVas/cloudrift/blob/main/docs/en/usage.md#history--local-scan-history) for the full reference.\n\nRun cloudrift as a local [MCP](https://modelcontextprotocol.io) server over stdio, so an AI agent — Claude Code, Kiro, VS Code Copilot Chat (Agent mode) — can call `analyze_cloudrift`\n\n(or the narrower `analyze_cloud_waste`\n\n/`analyze_dead_resources`\n\n/`analyze_resource_security`\n\n/`get_cost_trend`\n\n), `get_resource_types`\n\n, and `get_required_iam_permissions`\n\ndirectly instead of you running the CLI by hand. It inherits the same AWS credentials as every other command; see [ADR-0082](https://github.com/elleVas/cloudrift/blob/main/docs/adr/0082-mcp-server-second-input-adapter.md).\n\n```\ncloudrift mcp\n```\n\nSee [docs/en/mcp-server.md](https://github.com/elleVas/cloudrift/blob/main/docs/en/mcp-server.md) for client configuration (Kiro, VS Code, Claude Code) and [docs/en/usage.md](https://github.com/elleVas/cloudrift/blob/main/docs/en/usage.md#mcp--run-cloudrift-as-a-local-mcp-server) for the `CLOUDRIFT_DISABLE_MCP`\n\nkill switch.\n\nThe full reference — flags, config file, pricing sources, CI/CD, IAM permissions, contributing, architecture — lives in [ docs/](https://github.com/elleVas/cloudrift/tree/main/docs/): English in\n\n[, Italian in](https://github.com/elleVas/cloudrift/tree/main/docs/en/)\n\n`docs/en/`\n\n[.](https://github.com/elleVas/cloudrift/tree/main/docs/it/)\n\n`docs/it/`\n\n| Guide | Content |\n|---|---|\n|\n\n[docs/en/configuration.md](https://github.com/elleVas/cloudrift/blob/main/docs/en/configuration.md)`cloudrift.config.json`\n\nfields, overrides, false-positive tuning[docs/en/pricing-sources.md](https://github.com/elleVas/cloudrift/blob/main/docs/en/pricing-sources.md)[docs/en/ci-cd.md](https://github.com/elleVas/cloudrift/blob/main/docs/en/ci-cd.md)[docs/en/iam-permissions.md](https://github.com/elleVas/cloudrift/blob/main/docs/en/iam-permissions.md)[docs/en/development.md](https://github.com/elleVas/cloudrift/blob/main/docs/en/development.md)[docs/en/releasing.md](https://github.com/elleVas/cloudrift/blob/main/docs/en/releasing.md)`@cloudrift/cli`\n\nis built and published to npm[docs/en/architecture.md](https://github.com/elleVas/cloudrift/blob/main/docs/en/architecture.md)[docs/en/technical-choices.md](https://github.com/elleVas/cloudrift/blob/main/docs/en/technical-choices.md)[docs/en/how-it-works.md](https://github.com/elleVas/cloudrift/blob/main/docs/en/how-it-works.md)[docs/en/testing.md](https://github.com/elleVas/cloudrift/blob/main/docs/en/testing.md)[docs/en/vertical-scanners.md](https://github.com/elleVas/cloudrift/blob/main/docs/en/vertical-scanners.md)[docs/en/adding-a-resource.md](https://github.com/elleVas/cloudrift/blob/main/docs/en/adding-a-resource.md)[docs/en/mcp-server.md](https://github.com/elleVas/cloudrift/blob/main/docs/en/mcp-server.md)`cloudrift mcp`\n\n[docs/en/remediation-effort.md](https://github.com/elleVas/cloudrift/blob/main/docs/en/remediation-effort.md)Apache License 2.0 — see [LICENSE.md](https://github.com/elleVas/cloudrift/blob/main/LICENSE.md). Free to use, modify, and distribute, including commercially.", "url": "https://wpnews.pro/news/show-hn-cloudrift-read-only-aws-waste-scan-now-call-from-your-agent-mcp", "canonical_source": "https://github.com/elleVas/cloudrift/", "published_at": "2026-08-04 13:09:05+00:00", "updated_at": "2026-08-04 13:22:54.596605+00:00", "lang": "en", "topics": ["developer-tools"], "entities": ["Cloudrift", "AWS", "Node.js", "Homebrew", "npm", "IAM", "EBS", "RDS"], "alternates": {"html": "https://wpnews.pro/news/show-hn-cloudrift-read-only-aws-waste-scan-now-call-from-your-agent-mcp", "markdown": "https://wpnews.pro/news/show-hn-cloudrift-read-only-aws-waste-scan-now-call-from-your-agent-mcp.md", "text": "https://wpnews.pro/news/show-hn-cloudrift-read-only-aws-waste-scan-now-call-from-your-agent-mcp.txt", "jsonld": "https://wpnews.pro/news/show-hn-cloudrift-read-only-aws-waste-scan-now-call-from-your-agent-mcp.jsonld"}}