cloudsealed-mcp

cloudsealed-mcp

MCP server that gives AI agents (Claude Code, Claude Desktop, Cursor, etc.)direct access to two deterministic CloudSealed analysis engines:

• cloudsealed_analyze_billing_waste — cost anomaly detection over acloud billing export (AWS/GCP/Azure/generic), usingcloudsealed-jit'srolling-median + MAD baseline. Runs locally, no network call.
• cloudsealed_score_architecture_risk — deterministic, auditablearchitecture risk scoring (single point of failure, excessive coupling,scalability gap) from a declared system inventory, backed byPredictive-ML-Core.

Both tools are read-only: they never write files, and the only network calleither one makes is the architecture tool talking to the Predictive-ML-Coreservice you point it at.

Install

# recommended: no local install, uvx fetches and runs it on demand
uvx cloudsealed-mcp

# or, from source until this is published to PyPI
pip install git+https://github.com/cloudsealed/cloudsealed-mcp

Configure your MCP client

Add to your client's MCP config (.mcp.json for Claude Code,claude_desktop_config.json for Claude Desktop, Cursor's MCP settings, etc.):

{
  "mcpServers": {
    "cloudsealed": {
      "command": "uvx",
      "args": ["cloudsealed-mcp"]
    }
  }
}

Restart the client, and both tools become available to the agent.

cloudsealed_score_architecture_risk needs a running Predictive-ML-Core

cloudsealed_analyze_billing_waste works out of the box — the analysisengine is a pure Python dependency, no server involved.

cloudsealed_score_architecture_risk calls the Predictive-ML-Core HTTP API.By default it looks for one at http://localhost:8092. Start one with:

docker run -p 8092:8092 cloudsealed/predictive-ml-core

To point at a different deployment (self-hosted or otherwise), set:

export PREDICTIVE_ML_CORE_URL="https://your-deployment"
export PREDICTIVE_ML_CORE_API_KEY="..."   # only if that deployment requires one

Example prompts

• "Here's our AWS Cost and Usage Report for last month — find the costanomalies and tell me what to fix first." (paste the CSV; the agent callscloudsealed_analyze_billing_waste)
• "We have a checkout-api (CRITICAL, public-facing, no declared auth), anorders-db (CRITICAL), and a third-party payment-gateway. What's ourbiggest architecture risk?" (the agent callscloudsealed_score_architecture_risk)

Why deterministic engines, not another LLM call

Both underlying engines score with explicit, auditable rules — not a model.Every anomaly and every risk score traces back to a specific rule and astated rationale (seeJIT's METHODOLOGY.mdandPredictive-ML-Core's METHODOLOGY.md).That means an agent calling these tools gets a reproducible, explainableanswer instead of a second opinion from another LLM.

FAQ

What's an MCP server, and why not just ask the agent to write the analysiscode itself? MCP (Model Context Protocol) lets an agent call a real toolinstead of generating code from scratch each time. The underlying engineshere are deterministic and already tested/benchmarked — an agent callingthem gets a reproducible answer, not a fresh guess with its own bugs.

Which clients support this? Any MCP client: Claude Code, Claude Desktop,Cursor, Windsurf, and others that read a standard mcpServers config block.

Is there a hosted version, or do I need to run anything locally?cloudsealed_analyze_billing_waste needs nothing but the uvx invocation.cloudsealed_score_architecture_risk needs a Predictive-ML-Core instancereachable at PREDICTIVE_ML_CORE_URL — self-hosted via Docker by default(see above), or your own deployment.

Does this send my billing data anywhere? No — the billing analysis runsentirely in-process. Only the architecture tool makes a network call, andonly to whichever PREDICTIVE_ML_CORE_URL you configure.

Development

pip install -e ".[dev]"
python -m py_compile src/cloudsealed_mcp/server.py

License

MIT. See LICENSE.