towardsthecloud/cloudburn

Changelog | Documentation | Discord
CloudBurn runs deterministic cost rules against your Terraform and CloudFormation with scan, then runs those same rules against your live AWS account with discover. Wire it into CI to catch waste before deploy. Point it at a running account to find what's still burning money.
## Features
One rules engine, two modes. 82 deterministic AWS cost rules for IaC and live accounts. See the rule list.
Scan in CI. Checks Terraform and CloudFormation in pull requests, CI jobs, and release pipelines, with a
GitHub Action for pull request annotations and comments.
Discover in production. Inspects deployed resources and shows what needs fixing.
Programmable. The SDK lets you run CloudBurn inside your own tooling.
Built for AI agents. A plugin gives Claude Code, Codex, and other agents read-only
CloudBurn tools and a skill for reviewing IaC and live accounts.
Machine and human friendly output. json and table formats.
Check costs in your editor. The VS Code extension runs the CLI on save and shows
Terraform and CloudFormation findings in Problems. Available as a local VSIX preview.
## See It Run
### IaC scan
### Live discovery
## Installation
### Homebrew (macOS/Linux)
bash
brew install towardsthecloud/tap/cloudburn
This installs Node.js automatically if you don't have it.
### npm
Requires Node.js 24+.
bash
npm install --global cloudburn
Or run it without installing:
bash
npx cloudburn scan ./main.tf
### GitHub Action
Get the CloudBurn Scan action from the GitHub Marketplace. It
scans your Terraform and CloudFormation in a workflow, annotates findings on the pull request, posts a sticky comment,
and can fail the job by severity. No Node.js setup or CLI install is needed.
yaml
uses: towardsthecloud/cloudburn-action@v1
with:
path: .
fail-on: high
See the GitHub Action documentation for all inputs, outputs, and examples.
### AI agents
Install the CloudBurn plugin to let your agent scan IaC and live accounts through a local MCP server. It needs
Node.js 24 or later.
bash
# Claude Code
claude plugin marketplace add towardsthecloud/cloudburn-plugin
claude plugin install cloudburn@towardsthecloud
# Codex
codex plugin marketplace add towardsthecloud/cloudburn-plugin
codex plugin add cloudburn@towardsthecloud
# Skill only, for agents supported by skills.sh
npx skills add towardsthecloud/cloudburn-plugin
See the MCP server README for the tools and for adding the server to other MCP clients.
## Getting Started
### Config
Config is optional. By default, CloudBurn runs the AWS Core preset for the mode you use. Account-wide rules such as CLDBRN-AWS-TAGGING-1 are opt-in through enabled-rules because they require an accessible Resource Explorer aggregator.
Create a starter config:
bash
cloudburn config --init
Inspect the current discovered config file:
bash
cloudburn config --print
Inspect the starter template without writing a file:
bash
cloudburn config --print-template
CloudBurn reads .cloudburn.yml or .cloudburn.yaml. By default it searches upward from the current directory until it finds a config file or reaches the git root. In CI, implicit config discovery is skipped entirely; use --config on scan or discover to opt into an exact file instead.