MCP Server

cloudrift can run as a local MCP (Model Context Protocol) server, so an AI coding agent — Claude Code, Kiro, VS Code Copilot Chat (Agent mode), or any other compatible client — can call cloudrift’s scanners directly as tools, without running the CLI by hand.

Exposed tools

Tool	Makes AWS calls?	What it returns
`analyze_cloudrift`	Yes — real, credentialed calls	Aggregated JSON report across all four domains (cloud-cost waste, dead resources, resource security, cost trend). Accepts `regions`, `livePricing`, `minAgeDays`, `ignoreTag`, `configPath`.
`analyze_cloud_waste`	Yes — real, credentialed calls	Cloud-cost waste only — a narrower, cheaper alternative to `analyze_cloudrift` when you don’t need the other domains.
`analyze_dead_resources`	Yes — real, credentialed calls	Dead/unused resources only. Accepts `regions`, `minAgeDays`, `ignoreTag`, `configPath`.
`analyze_resource_security`	Yes — real, credentialed calls	Insecurely configured resources only. Accepts `regions`, `ignoreTag`, `configPath` (no `minAgeDays` — resource-security checks have no grace period).
`get_cost_trend`	Yes — real, credentialed calls (Cost Explorer, a billed API)	Monthly AWS spend over the last N calendar months, optionally filtered by service. Accepts `months`, `services`, `accountId`, `refreshCache`.
`get_resource_types`	No — static	Full catalog of detectable resource kinds, with labels.
`get_required_iam_permissions`	No — static	The read-only IAM policy shared by every tool above that makes AWS calls.

analyze_cloudrift, the three per-domain analyze_* tools, and get_cost_trend all inherit the same AWS credentials as every other cloudrift command — an agent with access to this server can see everything those credentials can see. Keep that in mind when deciding whether to auto-approve any of them.

Connecting a client

Kiro, VS Code, and Claude Code each use a different config format — a file copied 1:1 from one to another will not work.

Kiro IDE

.kiro/settings/mcp.json (workspace) or ~/.kiro/settings/mcp.json (global):

{
  "mcpServers": {
    "cloudrift": {
      "command": "npx",
      "args": ["@cloudrift/cli@latest", "mcp"],
      "disabled": false,
      "autoApprove": ["get_resource_types", "get_required_iam_permissions"]
    }
  }
}

analyze_cloudrift, analyze_cloud_waste, analyze_dead_resources, analyze_resource_security, and get_cost_trend are deliberately left out of autoApprove because they are the five tools that make real AWS calls — the other two are static. Add them yourself once you are comfortable with that.

VS Code (GitHub Copilot Chat, Agent mode)

.vscode/mcp.json (workspace) or via MCP: Open User Configuration, root key servers:

{
  "servers": {
    "cloudrift": {
      "command": "npx",
      "args": ["@cloudrift/cli@latest", "mcp"]
    }
  }
}

MCP tools are only usable in Copilot Chat’s Agent mode — not Ask/Edit mode.

Claude Code

Quickest way — let the CLI write the config for you:

claude mcp add cloudrift -- npx @cloudrift/cli@latest mcp

Add --scope project if you want .mcp.json committed to the repo and shared with the team. Hand-written .mcp.json:

{
  "mcpServers": {
    "cloudrift": {
      "type": "stdio",
      "command": "npx",
      "args": ["@cloudrift/cli@latest", "mcp"]
    }
  }
}

Claude Code has three config scopes (local, project, user), chosen with --scope on claude mcp add. Useful commands: claude mcp list, claude mcp get cloudrift, /mcp inside a session.

Using a non-default AWS environment

An MCP client spawns cloudrift mcp with a minimal environment — not a copy of your shell. If you rely on AWS_PROFILE or a region override, add it explicitly under env:

{
  "mcpServers": {
    "cloudrift": {
      "command": "npx",
      "args": ["@cloudrift/cli@latest", "mcp"],
      "env": { "AWS_PROFILE": "my-profile", "AWS_REGION": "eu-west-1" }
    }
  }
}

A silent symptom of missing this: every tool call succeeds, but analyze_cloudrift returns an empty report — no error, because a per-region scan failure is surfaced as scanErrors/domainErrors, not a crash. If findings look emptier than expected, check env before anything else.