Skip to content
Agentmart
Submit a tool

Cloudwright

Cloud architecture and migration planning with costs, controls, evidence, and deployable IaC.

Connector by xmpuspus · GitHub account verified by the MCP Registry

IndexedMITLocal (stdio)★ 33
Write a review

Install

Works with Claude Code, Codex, VS Code, Cursor, Windsurf, Claude Desktop. Read the repository before you give any tool access to your data.

npx agentmarket install connector/xmpuspus-cloudwright

Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.

Get the weekly diff

The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.

We use your email only for this newsletter. Privacy

About

Cloud architecture and migration planning with costs, controls, evidence, and deployable IaC.

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list, install config and code. Checked Oct 26, 2026.

Tools
16 read · 1 write · 0 delete · 7 not yet classified
Secrets
None asked for
Install scripts
None found
Runs as
Python package

Tools by what they do 24

Read from the source code; the running server may list different tools.

Read 16 · Look things up without changing anything.

  • analyze_blast_radius
  • catalog_search
  • chat_list_sessions
  • compare_provider_costs
  • compare_providers
  • diff_architectures
  • estimate_cost
  • lint_architecture
  • list_services
  • plan_infrastructure
  • scan_compliance_controls
  • scan_terraform
Show 4 more tools
  • score_architecture
  • security_scan
  • validate_compliance
  • verify_migration

Write 1 · Create, change, send or run things.

  • modify_architecture

Not yet classified 7 · We could not tell from the name and description.

  • chat_create_session
  • chat_delete_session
  • chat_send
  • design_architecture
  • export_architecture
  • plan_migration
  • review_architecture

Network hosts it talks to 13

  • cdn.jsdelivr.net · found in code
  • cloudbilling.googleapis.com · found in code
  • cloudwright.ai · found in code
  • cyclonedx.org · found in code
  • d2lang.com · found in code
  • focus.finops.org · found in code
  • github.com · found in code
  • glama.ai · found in code
  • icons.terrastruct.com · found in code
  • lawphil.net · found in code
  • prices.azure.com · found in code
  • pricing.us-east-1.amazonaws.com · found in code
  • privacy.gov.ph · found in code

Files it touches

  • ~/.aws/credentials
  • Your home directory (~)
  • ~/.cloudwright/sessions
  • ~/.codeium/windsurf/mcp_config.json
  • ~/.codex/config.toml
  • ~/.gemini/config/mcp_config.json

Tools (24)

Read from the source code; the running server may differ. Descriptions are the server’s own words; hidden characters are shown as [U+…].

  • analyze_blast_radius

    Analyze blast radius and dependency structure of an architecture. For each component (or just one, if `component_id` is set): returns direct dependents, transitive dependents, blast-radius size, SPOF status, and tier position. Use this to reason about failure modes — 'if component X dies, what else breaks?' When to use: You have a spec and want to understand coupling and failure domains before production. Complementary to `score_architecture` (which gives a summary grade) and `lint_architecture` (which flags specific anti-patterns). Behavior: Pure graph computation — no LLM, no network. Rea…

  • catalog_search

    Search the cloud instance catalog by provider, specs, or text query. Returns matching instance types with instance family, vCPU / memory / storage, hourly on-demand price, region availability, and architecture (x86 / arm). All filters combine with AND semantics. When to use: Right-sizing workloads, finding the cheapest instance that meets a hardware bar, or discovering equivalents across families. Behavior: Pure lookup from the bundled SQLite catalog — no LLM, no network. Prices reflect catalog snapshot date (see `refresh` CLI command to update).

  • chat_create_session

    Create a new stateful architecture-design conversation session. Returns `{'session_id': <12-char hex>}`. The session_id is the handle for subsequent `chat_send` / `chat_delete_session` calls. When to use: Multi-turn architecture design where each turn depends on the prior one (e.g. 'design it', 'now add a cache', 'now move to GCP'). For single-shot design use `design_architecture`; for one-shot edits of an existing spec use `modify_architecture`. Behavior: Writes a new session file to the session store (persisted on disk). Does not call the LLM — the first LLM call happens on the first `cha…

  • chat_delete_session

    Delete a conversation session. Returns `{'deleted': True}` on success or `{'error': ...}` if the session did not exist. Destructive: the session's conversation history and any uncommitted spec are lost. There is no undo. When to use: Clean-up after a completed design, or abandoning a dead-end conversation. Does not affect any deployed infrastructure — cloudwright never deploys anything. Behavior: Removes the session file from the session store. No LLM, no network.

  • chat_list_sessions

    List all saved conversation sessions. Returns a list of session metadata: session_id, creation timestamp, last-activity timestamp, cumulative token usage, and whether the session currently owns a spec. When to use: Resuming prior work, cleaning up abandoned sessions, or auditing session token spend. Behavior: Pure disk read, no LLM, no network. Read-only, except for an age-based expiry sweep run first: sessions whose last save is older than `CLOUDWRIGHT_MCP_SESSION_TTL_DAYS` (default 7 days) are deleted before the remaining sessions are listed. Set the TTL to 0 or below to disable the sweep…

  • chat_send

    Send a message to an existing conversation session and get a response. Returns `{'response': str, 'spec': dict|None, 'usage': dict, 'cumulative_usage': dict}`. `spec` is populated when the turn produced or modified an ArchSpec. `usage` reports LLM token counts for this turn; `cumulative_usage` totals across the whole session. When to use: Every turn after `chat_create_session`. For zero-state single-shot calls use `design_architecture` / `modify_architecture` instead. Behavior: Calls an LLM — incurs API costs proportional to the conversation history length (history grows each turn). Persist…

  • compare_provider_costs

    Compare the monthly **cost totals** of an architecture across cloud providers. Returns one numeric cost summary per provider (monthly total, per-component breakdown, currency). Use this for cost-focused provider selection. When to use vs `compare_providers`: This tool returns only **cost numbers**. `compare_providers` returns full alternative **architectures** (components, connections, tiers). If you want both the re-drawn architecture and its bill, call `compare_providers` first, then `estimate_cost` on each returned spec — or call both in parallel. Behavior: Pure computation — no LLM, no …

  • compare_providers

    Compare an architecture's **service mapping** across cloud providers. Returns one translated ArchSpec per target provider, showing which services the original would become on each. Use this to understand architectural portability and equivalent services. When to use vs `compare_provider_costs`: This tool returns full alternative **architectures** (with components, connections, tiers). `compare_provider_costs` returns only numeric **cost totals** per provider — use that when you only care about the bill, not the shape. Behavior: Calls an LLM to resolve ambiguous service mappings where the st…

  • design_architecture

    Design a cloud architecture from a natural-language description. Primary entry point for greenfield architecture design. Returns a complete ArchSpec (YAML-serializable dict) with components, connections, tier assignments, and a cost estimate. When to use: You have a requirement (prose) and need a concrete architecture with services, wiring, and cost. Use `modify_architecture` to iterate on an existing spec, or `chat_create_session` + `chat_send` for multi-turn refinement. Behavior: Calls an LLM provider (Anthropic or OpenAI depending on configured keys) — incurs API costs per invocation. De…

  • diff_architectures

    Diff two architecture specs and return a structured change report. Returns a structured delta: components added / removed / modified, connections added / removed / modified, cost delta (USD/month), compliance-impact flags (e.g. WAF removal, encryption-at-rest turned off), and a human-readable summary. When to use: You have two versions of a spec (before / after a proposed change) and need a reviewable diff for approval or ADR writing. Behavior: Pure computation — no LLM, no network. Read-only. Does not modify either spec.

  • estimate_cost

    Estimate the monthly cloud bill for an architecture spec. Returns a structured estimate with per-component breakdown, total monthly cost, data-transfer costs, and currency. Deterministic: same spec + tier yields same result. When to use: You need the numeric bill for one architecture on one provider+tier combination. For multi-provider comparison of just the costs, use `compare_provider_costs`. For side-by-side architecture + cost comparison across providers, use `compare_providers` + this tool. Behavior: Pure computation — no LLM, no network, no API costs. Works offline. Does not deploy or…

  • export_architecture

    Export an architecture spec to Terraform, CloudFormation, Mermaid, D2, or other formats. Returns `{'format': str, 'content': str}` where `content` is the ready-to-write payload. Terraform/CFN outputs use variables for sensitive values (no hardcoded credentials), include provider blocks with region configuration, and generate data sources for VPC/subnet discovery. When to use: You have a finalized ArchSpec and need IaC code, a diagram, or an audit artifact. For multi-format export, call once per `format`. Behavior: Pure computation — no LLM, no network. Does not write files or deploy; the ca…

  • lint_architecture

    Lint an architecture for anti-patterns and best-practice violations. Returns a list of warnings with rule name, severity (error / warning), component IDs involved, and a human-readable message. Errors (production-blocking): unencrypted data stores, single-AZ databases, missing load balancer on public compute, public databases, single point of failure. Warnings (review-worthy): oversized instances (16xlarge+), missing WAF, missing monitoring, missing backups, missing auth. When to use vs `security_scan`: lint is about **architectural hygiene** (is this a sane shape?). security_scan is about …

  • list_services

    List all cloud services supported for a given provider. Returns one entry per service with its slug, human-readable name, category (compute / database / storage / networking / etc.), and supported tiers. Use this to discover valid `service:` keys when hand-authoring ArchSpecs or mapping requirements to services. Behavior: Pure lookup from the bundled service registry — no LLM, no network, no cloud access.

  • modify_architecture

    Modify an existing architecture with a natural-language instruction. When to use: You already have an ArchSpec and want to evolve it (add a cache, swap a service, change a region). Returns the updated ArchSpec. For from-scratch design, use `design_architecture`. For iterative multi-turn editing with conversation memory, use `chat_create_session`. Behavior: Calls an LLM provider — incurs API costs. Pure function: returns a new spec without mutating the input. Does not deploy.

Show 9 more tools
  • plan_infrastructure

    Prove an architecture's exported infrastructure is deployable. Read-only. Exports the spec to a throwaway temp directory and runs `terraform init -backend=false` + `validate` (no cloud credentials required) as the offline proof of deployability, or the Pulumi equivalent. This is the same read-only planner behind `cloudwright plan`. Returns `{'tool': str, 'available': bool, 'validated': bool, 'plan_ran': bool, 'ok': bool, 'summary': {'add','change','destroy'}|None, 'messages': [str], 'output_tail': str}`. `available=False` means the terraform/tofu/pulumi binary isn't installed: a structured s…

  • plan_migration

    Build read-only migration waves, economics, and acceptance gates. Returns a MigrationAssessment dictionary. The tool does not copy data, change infrastructure, switch traffic, or run a cutover.

  • review_architecture

    Run the deterministic offline critic (scorer + linter + validator) on an architecture. This is the same generate -> critique -> repair engine `Architect.design()` uses internally to self-correct a spec before returning it, exposed standalone so an agent can review any spec (hand-authored, imported, or previously designed) for free, with no LLM call. Returns `{'score': float, 'grade': str, 'findings': [...], 'blocking_count': int, 'summary': str}`. Findings are severity-ranked (critical/high first) and each carries `source` ('scorer' | 'linter' | 'validator'), `code`, `message`, `recommendati…

  • scan_compliance_controls

    Scan an architecture and map every finding to compliance framework control IDs. Unlike `validate_compliance` (5-7 static pass/fail checks per framework), this maps EVERY finding, from the built-in scanner, a Terraform HCL scan, and an optional Checkov deep scan, to the specific control IDs it violates (e.g. HIPAA 164.312(a)(2)(iv), SOC2 CC6.1, FedRAMP SC-28), before any infrastructure exists. Returns `{'passed': bool, 'scanner': str, 'checkov_used': bool, 'findings': [...], 'frameworks': [...]}`. Each finding carries `severity`, `rule`, `component_id`, `message`, `remediation`, `source` ('bu…

  • scan_terraform

    Scan Terraform HCL source for security misconfigurations. Returns findings (severity-graded) tied to specific resource blocks — e.g. aws_s3_bucket with `acl = public-read`, aws_security_group with `cidr_blocks = 0.0.0.0/0` on sensitive ports, aws_rds_instance with `storage_encrypted = false`. When to use: You have existing Terraform code (not an ArchSpec) and want an immediate security audit. For ArchSpec-level audit, use `security_scan`. Behavior: Pure computation — no LLM, no network. Does not run Terraform or touch cloud. Safe for scanning untrusted HCL.

  • score_architecture

    Score an architecture across reliability, security, cost, compliance, and complexity. Returns the dimension scores, overall weighted score (0-100), letter grade, and per-dimension notes. Weights: Reliability 30% (load balancing, multi-AZ, auto-scaling, CDN, caching), Security 25% (WAF, auth, encryption, HTTPS, DNS), Cost Efficiency 20% (budget compliance, free- tier usage), Compliance 15% (framework validation), Complexity 10% (component count, connection density, tier separation). When to use: You want a quick quality summary before a design review. For specific findings, use `lint_architec…

  • security_scan

    Scan an architecture for security anti-patterns and misconfigurations. Returns a structured report with severity-graded findings (critical / high / medium / low / info), each tied to specific component IDs. Framework- agnostic — use `validate_compliance` for specific regulatory frameworks. Checks include: unencrypted data stores, public-facing databases, missing WAF on public HTTP endpoints, weak auth on APIs, SPOFs, overly permissive connection protocols. Behavior: Pure computation — no LLM, no network. Does not touch cloud.

  • validate_compliance

    Validate an architecture against compliance frameworks. Returns one result object per framework with pass/fail status per check, evidence (which components triggered the rule), and remediation hints. When to use: You have a proposed architecture and need to know whether it satisfies HIPAA / PCI-DSS / SOC 2 / FedRAMP / GDPR before proceeding. Use `security_scan` for anti-pattern detection (weak auth, public buckets, etc.) which is framework-agnostic. Behavior: Pure computation — no LLM, no network. Evaluates the spec statically against 30+ rules. Does not access or modify any cloud resources…

  • verify_migration

    Rebuild migration gates and check recorded evidence for closure. Returns an EvidencePack dictionary. Missing or failed blocking evidence keeps `closed` false. The caller cannot replace the planner output.

Signals

Stars
33
Forks
2
Open issues
0
Contributors
3
Weekly downloads
121
Last commit
Aug 24, 2026 (2 months ago)
Last release
Aug 24, 2026 (2 months ago)
Last package publish
Aug 24, 2026 (2 months ago)

From GitHub (fetched Oct 24, 2026) and the package registry.

Details

Registry name
io.github.xmpuspus/cloudwright
Version
1.10.0
Auth
No auth
Packages
pypi cloudwright-ai-mcp
License
MIT
First seen
Oct 24, 2026
Last checked
Oct 24, 2026

More from xmpuspus

Cite this page

Cloudwright MCP server. Agent Mart. https://agentmart.dev/connectors/xmpuspus-cloudwright (last updated 2026-10-24)