xmpuspus/cloudwright

*Design a cloud architecture or plan a migration. Get costs, controls, code, and checked evidence.*
Cloudwright turns one line of English into a typed spec, a cost breakdown, a control-mapped compliance report,
and infrastructure code. A source estate and target become ordered migration waves, explicit costs,
and evidence gates. It covers AWS, GCP, Azure and Databricks across 114 service keys. Only design, modify,
chat and adr call a model. Every other command runs offline and needs no API key.
Quickstart · Migrations · Compliance · Agents · Docs · Changelog
A prompt produces a spec, a cost, a control-mapped report, and Terraform
- **Spec.** Typed YAML you commit, diff and review. Everything below reads from it.
- **Cost.** Per component and region-aware, with a confidence flag on every line.
- **Compliance.** HIPAA, SOC 2, PCI-DSS, FedRAMP, GDPR, ISO 27001 and NIST 800-53 control IDs.
- **Infrastructure code.** Terraform, OpenTofu, Pulumi (TypeScript or Python) and CloudFormation.
- **Diagrams.** ASCII, Mermaid, D2, and a web canvas you can edit by hand.
- **An MCP server**, so any coding agent runs the same checks inside its own loop.
Exports carry safe defaults. S3 gets a public-access block, SSE and versioning. RDS gets encryption, multi-AZ
and deletion protection. EC2 gets IMDSv2. A compliance framework overrides the workload profile, and always
forces encryption and high availability.
Quickstart
Add --json before any subcommand for machine-readable output, or --stream to watch tokens arrive. Set ANTHROPIC_API_KEY or OPENAI_API_KEY for the four commands that need a model.
Migration plans stop when evidence is missing
The migration model covers infrastructure, applications, data, platforms, networks, facilities, and business
services in one dependency graph. It works for on-premises, cloud, cross-cloud, hybrid, data-center, and
application moves. It plans and checks work. It never copies data, applies infrastructure, switches traffic,
or runs a cutover.
The core has no telco fields. The first proof project selects an external ph_telco pack for subscriber,
billing, usage-record, number-porting, privacy, recovery, and source-shutdown gates. A manufacturing ERP
fixture proves the same planner works without that pack. Missing blocking evidence changes the result to
closed: false and makes migrate verify exit with code 2. Each evidence file carries the deterministic
assessment ID, so observations from an older target or cutover plan cannot close a revised assessment.
MCP clients use the same engine through plan_migration and verify_migration in the migration tool group.
See Migration planning and evidence for the file contract, Python API, HTTP routes,
domain-pack format, limits, and recording commands.
Every finding carries the control ID it violates
Other tools scan infrastructure after you deploy it. Cloudwright maps each finding to its control before any
resource exists. The fix then costs a spec edit instead of a change ticket. HIPAA 164.312(a)(2)(iv), SOC 2 CC6.1
and FedRAMP SC-28 come from the built-in scanner, with no extra tooling. Checkov folds into the same report
when it sits on your PATH.
- --oscal writes an OSCAL 1.1.2 component-definition with deterministic UUIDs.
- --traceability prints the chain from component to resource to control to status.