cloudcostwise

Find AWS waste from your terminal or your AI assistant. cloudcostwise runs CloudWise's open waste checks on your own machine, with your own read-only AWS credentials.

• Nothing is sent to CloudWise. The only network calls are AWS API calls in your account. No signup, no IAM role for a third party, no telemetry. Used through an AI assistant (MCP), the findings go to that assistant like any tool output.
• It cannot change anything. Every AWS call goes through a guard that refuses any operation that isn't a Describe, List, Get, Search or Lookup, whatever your credentials allow.
• 20 of CloudWise's 46 service checks: EC2, Lambda, SageMaker, WorkSpaces, Lightsail, EBS, S3, EFS, ECR, RDS, DynamoDB, ElastiCache, Elastic IPs, NAT gateways and load balancers, VPC endpoints, dangling DNS records, CloudWatch logs and dashboards, security posture, RI/Savings Plans opportunities, and Compute Optimizer.

Install and run

pipx install cloudcostwise          # or: uvx cloudcostwise scan
cloudcostwise scan                      # us-east-1 plus your profile's region
cloudcostwise scan --profile prod --regions all
cloudcostwise scan --format json > waste.json

Options:

What AWS's free tools don't flag

This tool has 42 proven checks (L2 or above in VALIDATION.md: each fired on a real AWS resource built to trigger it and stayed silent on a healthy twin). 15 of them flag waste that none of AWS's own tools flag, and 9 more go further than the closest AWS check, going by AWS's lists of what its tools cover (Trusted Advisor, Cost Optimization Hub, Compute Optimizer; checked 2026-10-07).

For idle EC2, RDS and NAT gateways, rightsizing and Savings Plans, AWS's tools cover the same ground: use them too. Trusted Advisor's cost checks need a Business, Enterprise or Unified Operations support plan; Cost Optimization Hub and Compute Optimizer are free.

The hosted CloudWise product adds 14 more proven checks that none of AWS's tools flag, across AWS Backup, AppSync, Elastic Beanstalk, Glue, KMS, Step Functions.

A few of them on our test account, where the resources are deliberately tiny (which is why the amounts are cents). Excerpt of a scan (0.1.3, us-east-1):

old_ecr_images  x1  $0.06/mo
    us-east-1       cwfx-old-ecr-images                         $0.06/mo
untagged_ecr_images  x1  $0.02/mo
    us-east-1       cwfx-untagged-ecr-images                    $0.02/mo
idle_efs  x1  $0.01/mo
    us-east-1       fs-090bfb32bd49de8b7                        $0.01/mo
no_retention_log_group  x1  $0.01/mo
    us-east-1       /aws/lambda/cwfx-clo464-docdb-connect       $0.01/mo

Use it from Claude Code, Codex or any MCP client

cloudcostwise mcp runs the same scan as an MCP server (stdio). Then ask your assistant: "Where am I wasting money on AWS?"

The plugin and registry entries start the server with uvx, so install uv first (brew install uv or pipx install uv).

Claude Code, as a plugin (asks for your AWS profile):

/plugin marketplace add cloudwise-app/cloudcostwise
/plugin install cloudcostwise@cloudcostwise

Claude Code, as a plain MCP server:

claude mcp add cloudcostwise -- uvx cloudcostwise mcp
# a specific profile:
claude mcp add cloudcostwise -e AWS_PROFILE=prod -- uvx cloudcostwise mcp

Codex (~/.codex/config.toml):

[mcp_servers.cloudcostwise]
command = "uvx"
args = ["cloudcostwise", "mcp"]
env = { AWS_PROFILE = "prod" }

Tools, all read-only: scan, list_findings, explain_finding, fix_guidance. fix_guidance returns the steps and AWS CLI command as text for you to review; nothing is ever executed. The assistant is told about the Cost Explorer cost before it scans, and include_cost_explorer=false skips it.

Permissions

ReadOnlyAccess (AWS managed) is enough. The minimal policy the checks use is in docs/iam-policy.json. It was derived from a scan of an account with most supported resource types; if a check lacks a permission, the scan says so in its data warnings instead of failing.

How the numbers are counted

Each finding shows an estimated monthly saving. Advisory waste types, ones CloudWise could not validate against a real AWS resource, are listed but never added to the total.

What the hosted product adds

The other 26 service checks (Glue, ECS, Step Functions, Backup, CloudFront, commitments and more), history and trends, alerts, and safe automated fixes: https://cloudcostwise.io/connect?utm_source=cloudcostwise&utm_medium=cli.

License

FSL-1.1-ALv2. Each release becomes Apache-2.0 two years after it ships.

How we know it's right

See VALIDATION.md: the validation level of every waste type this tool reports, from L0 (unit-tested) to L2 (fired on a real AWS resource and stayed silent on a healthy twin) and beyond.