[![Archimedes Trust Report — VERIFIED 92/100](https://img.shields.io/badge/Archimedes_Trust-VERIFIED_92%2F100-10B981?style=flat-square)](https://archimedes.market/assets/d63f367d-79e5-488c-9e60-b7ba89fd3f91)

> Verified asset on [**Archimedes Market**](https://archimedes.market). View the full 4-dimension Trust Report (security · quality · license · complexity) and the curated catalog on the [asset page](https://archimedes.market/assets/d63f367d-79e5-488c-9e60-b7ba89fd3f91).

---

# MCP AWS Cost Anomaly

AWS Cost Explorer plus Anomaly Detection exposed as MCP tools. Lets an agent surface unexpected spend, pull cost breakdowns by service, account, or tag, and fetch forecasts and savings recommendations without any write capability against the AWS account.

## Tools

- `list_anomalies` — recent cost anomalies from `ce:GetAnomalies` with severity and root-cause hints
- `get_cost_explorer` — cost-and-usage breakdown by dimension (service, account, region, tag) over a time window
- `forecast_cost` — 30/60/90-day cost forecast with upper and lower bounds
- `monthly_breakdown` — month-over-month spend with delta highlights
- `savings_recommendations` — Compute Optimizer and Trusted Advisor recommendations
- `credit_utilization` — remaining AWS credits, expiration dates, recent draw

## Read-only enforcement

At startup, the server resolves the calling identity (STS GetCallerIdentity) and lists attached policies. If any policy contains an `Action` matching write verbs (`Create*`, `Delete*`, `Modify*`, `Put*`, `Update*`, `Run*`) on any AWS service, the server refuses to boot. The recommended IAM role attaches only:

- `arn:aws:iam::aws:policy/AWSBillingReadOnlyAccess`
- `ce:GetAnomalies`, `ce:GetCostForecast`, `ce:GetSavingsPlansUtilization` if missing from the managed policy

## Quick start

```bash
pip install mcp-aws-cost-anomaly
export AWS_ACCESS_KEY_ID="..."
export AWS_SECRET_ACCESS_KEY="..."
export AWS_REGION="us-east-1"
mcp-aws-cost-anomaly serve
```

## Typical agent workflow

```
Agent: "Why was last month's AWS bill 22% higher than the month before?"
↓
1. monthly_breakdown → confirms the delta
2. get_cost_explorer(group_by="SERVICE") → shows DynamoDB jumped 4x
3. list_anomalies → root cause flagged on a specific table
4. forecast_cost → projected impact if pattern continues
```

## License

MIT.