An MCP server that can actually do things
A Model Context Protocol server exposing read tools and approval-gated write tools — the full remediation funnel — to Claude Desktop, Code, and Cursor. Competitor MCPs are read-only.
Read-only MCP servers can answer questions but can’t change anything safely. Wiring an agent to real actions usually means bypassing your guardrails.
Built to do the work, not just show it
Read tools
Query cost trends, findings, and more from your agent of choice.
Gated write tools
Create approvals and drive executions — through the same funnel, gates intact.
Machine-token auth
Scoped, revocable API tokens authenticate the agent; no route becomes public.
Stateless + fleet-safe
The endpoint is stateless, so any serving task can field the next call.
From signal to result
Connect
Point Claude Desktop/Code/Cursor at the MCP endpoint with a machine token.
Read
The agent pulls live cost + findings.
Act (gated)
Write tools create approvals + run executions with every gate applied.
- Every tool calls the existing route in-process, so audit, bell, Slack card, safety, and rollback all still fire.
- Read tools preserve tenant isolation at the route layer; write tools preserve the whole funnel.
- Proven in prod: 9 tools, live Cost Explorer data, and both gates firing on a real token.
Questions
Can an agent change my cloud?
Only through approval-gated write tools that run the full funnel — admin role, paid tier, safety, and rollback all apply.
Which clients are supported?
Any MCP client — Claude Desktop, Claude Code, and Cursor are documented.