Connect Claude, Cursor, or any AI agent to your AWS cost data over MCP

Every FinOps dashboard has the same failure mode: the answer you want is three clicks and a CSV export away from the question you actually have. You want to know why last week cost more than the week before, which account drove it, and whether it is a one-off or a trend. The dashboard makes you assemble that yourself.

The Model Context Protocol (MCP) is the emerging standard for connecting AI assistants to external data and tools. An MCP server publishes a set of typed tools; an MCP client — Claude, Cursor, and a growing list of others — calls them on your behalf while you talk to it in plain language. CloudQuell now runs one for your cost data.

What we shipped

CloudQuell's hosted MCP server is live at mcp.cloudquell.com. You authenticate once with OAuth — no API keys to generate, rotate, or leak — and your assistant gains 43 read tools spanning costs, budgets, anomalies, savings, commitments, allocation, and saved reports. Every call honors the same plan entitlements as the web portal: the server cannot surface data your plan does not include.

What you can ask

The tools are composable, so the assistant chains them to answer questions that would each be several dashboard views:

• ◦"Why did my AWS bill jump last week?" — the agent pulls daily cost slices, finds the anomaly, and attributes it to the service and account that moved.
• ◦"Which of my commitments are underutilized, and what should I do?" — it reads the commitment portfolio, ranks by wasted dollars, and returns the right-sizing guidance.
• ◦"Show me untagged spend by cost center this month." — it queries allocation and tag coverage and returns the gap, ranked.
• ◦"What are my top five savings recommendations by projected impact?" — it reads the Savings Engine output, already merged with AWS Cost Optimization Hub.

Because the agent holds the raw tools rather than a canned report, it answers the follow-up too — the "and what about just production?" that a static dashboard cannot.

The security model

The server is read-only and scoped. OAuth ties access to your CloudQuell identity and makes it revocable from the portal — not a long-lived secret sitting in a config file. Entitlements are enforced server-side, so connecting an agent never widens what an account can see. The underlying cost data still comes from the read-only cross-account IAM role you granted at setup; the MCP server never touches your AWS account directly.

Clients it works with

Any MCP client that speaks Streamable HTTP with OAuth: Claude and Claude Desktop, Claude Code, Cursor, Goose, Codex, and others. Setup is a single server URL, and the full tool reference lives in the MCP section of the docs. It is included on every paid plan.