MCP Server

cloudrift can run as a local MCP (Model Context Protocol) server, so an AI coding agent — Claude Code, Kiro, VS Code Copilot Chat (Agent mode), or any other compatible client — can call cloudrift’s scanners directly as tools, without running the CLI by hand.

Exposed tools

Tool	Makes AWS calls?	What it returns
`analyze_cloudrift`	Yes — real, credentialed calls	Aggregated JSON report across all four domains (cloud-cost waste, dead resources, resource security, cost trend). Accepts `regions`, `livePricing`, `minAgeDays`, `ignoreTag`, `configPath`.
`get_resource_types`	No — static	Full catalog of detectable resource kinds, with labels.
`get_required_iam_permissions`	No — static	The read-only IAM policy needed for `analyze_cloudrift`.

analyze_cloudrift inherits the same AWS credentials as every other cloudrift command — an agent with access to this server can see everything those credentials can see. Keep that in mind when deciding whether to auto-approve it.

Connecting a client

Kiro, VS Code, and Claude Code each use a different config format — a file copied 1:1 from one to another will not work.

Kiro IDE

.kiro/settings/mcp.json (workspace) or ~/.kiro/settings/mcp.json (global):

{
  "mcpServers": {
    "cloudrift": {
      "command": "npx",
      "args": ["@cloudrift/cli@latest", "mcp"],
      "disabled": false,
      "autoApprove": ["get_resource_types", "get_required_iam_permissions"]
    }
  }
}

analyze_cloudrift is deliberately left out of autoApprove because it is the only tool that makes real AWS calls — the other two are static. Add it yourself once you are comfortable with that.

VS Code (GitHub Copilot Chat, Agent mode)

.vscode/mcp.json (workspace) or via MCP: Open User Configuration, root key servers:

{
  "servers": {
    "cloudrift": {
      "command": "npx",
      "args": ["@cloudrift/cli@latest", "mcp"]
    }
  }
}

MCP tools are only usable in Copilot Chat’s Agent mode — not Ask/Edit mode.

Claude Code

Quickest way — let the CLI write the config for you:

claude mcp add cloudrift -- npx @cloudrift/cli@latest mcp

Add --scope project if you want .mcp.json committed to the repo and shared with the team. Hand-written .mcp.json:

{
  "mcpServers": {
    "cloudrift": {
      "type": "stdio",
      "command": "npx",
      "args": ["@cloudrift/cli@latest", "mcp"]
    }
  }
}

Claude Code has three config scopes (local, project, user), chosen with --scope on claude mcp add. Useful commands: claude mcp list, claude mcp get cloudrift, /mcp inside a session.

Using a non-default AWS environment

An MCP client spawns cloudrift mcp with a minimal environment — not a copy of your shell. If you rely on AWS_PROFILE or a region override, add it explicitly under env:

{
  "mcpServers": {
    "cloudrift": {
      "command": "npx",
      "args": ["@cloudrift/cli@latest", "mcp"],
      "env": { "AWS_PROFILE": "my-profile", "AWS_REGION": "eu-west-1" }
    }
  }
}

A silent symptom of missing this: every tool call succeeds, but analyze_cloudrift returns an empty report — no error, because a per-region scan failure is surfaced as scanErrors/domainErrors, not a crash. If findings look emptier than expected, check env before anything else.