An AI that right-sizes your cluster — and a platform that won't let it break prod

The problem: "let an AI touch our infrastructure" is a great way to get a confident model to scale prod to one replica at 3am. The interesting engineering in agentic ops isn't the model — it's the guardrails. The fix: give the AI a typed, bounded interface to your cluster over MCP, and put the safety logic server-side, where the model can't route around it. The AI decides what to change; the platform decides what it's allowed to do — and refuses the rest, even when asked directly.

A Model Context Protocol (MCP) server exposes five FinOps tools over a live Kubernetes cluster. Claude (or any MCP client — Claude Desktop, etc.) uses them to find over-provisioned workloads and propose right-sizing. Every mutating call is checked against a policy before anything happens and defaults to a dry-run; unsafe changes — a protected prod namespace, a resource floor, an over-aggressive cut — are refused by the server and written to an audit log.

Runs entirely on a laptop: a kind cluster seeded with deliberately wasteful workloads, a ~120-line MCP server, and a copilot driver that runs offline by default (a deterministic mock, so it works with no API key and in CI) or with real Claude when ANTHROPIC_API_KEY is set.

What it does

   Claude / MCP client
          │  calls typed tools
          ▼
   ┌─────────────── MCP server (finops-copilot) ───────────────┐
   │  list_namespaces  list_workloads  estimate_cost           │
   │  recommend_rightsizing        get_audit_log               │
   │                                                           │
   │  apply_rightsizing(…, dry_run=True)                       │
   │        │                                                  │
   │        ▼   ┌─────────── policy.py (guardrails) ────────┐  │
   │     every  │ protected namespaces? resource floors?    │  │
   │     apply ─┤ max single-step cut?  → REFUSE + audit    │  │
   │            └───────────────────────────────────────────┘  │
   └────────────────────────┬──────────────────────────────────┘
                            │ kubectl (read specs / patch)
                            ▼
                  kind cluster: staging (waste) · prod (protected)

Run it

make up            # kind cluster seeded with waste + Python env (MCP deps)
make demo          # the copilot finds & cuts waste — OFFLINE, no API key needed
make demo-claude   # real Claude drives the same MCP tools (needs ANTHROPIC_API_KEY)
make test          # unit-test the guardrail policy (no cluster needed)
make down          # delete the cluster

make demo runs a deterministic mock copilot over the real MCP server — same tools, same guardrails as the Claude path — so it works with no key and in CI. make demo-claude swaps the mock for Claude driving the tools agentically (official Anthropic SDK + its MCP tool-runner).

What the demo proves (real output)

Against a staging namespace seeded with four workloads (three grossly over-provisioned, one healthy) and a protected prod:

1. Finds the waste. staging costs ~$138/mo at current requests; the tool flags the three workloads sitting at 1–4% CPU utilisation and proposes CPU + replica cuts — ~$102/mo (73%) in projected savings.

2. Dry-runs first. Every change is a dry-run showing the exact diff and its monthly saving. Nothing is applied without an explicit non-dry-run call.

3. The platform refuses prod. Asked to trim prod too, the server refuses — namespace 'prod' is protected. The AI asked; the guardrail said no. No change, not even a dry-run.

4. The platform refuses an over-aggressive cut. Asked to slash a CPU request to 10m, the server refuses — below the floor, and a >90% single-step cut.

5. Every action is logged. The audit trail shows all five attempts — three dry-runs, two refusals — with reasons.

The AI found the waste and proposed the cuts. The platform decided what it was allowed to do. That division of labour is the whole point.

Use it from Claude Desktop (real MCP)

This is a real MCP server — point any MCP client at it. For Claude Desktop, add to claude_desktop_config.json:

{
  "mcpServers": {
    "finops": {
      "command": "/path/to/mcp-finops-copilot/.venv/bin/python",
      "args": ["-m", "finops.server"],
      "env": { "FINOPS_CTX": "kind-mcp-finops" }
    }
  }
}

Then ask Claude: "What's my staging namespace costing, and what can I safely right-size?"

How it maps to production

Layout

finops/policy.py     the guardrail layer — pure, unit-tested (make test)
finops/cost.py       cost model + right-sizing heuristic
finops/kube.py       kubectl read/patch helpers
finops/server.py     the MCP server: 5 tools, dry-run-by-default, audited
copilot/mock_agent.py   deterministic offline copilot (CI-safe)
copilot/llm_agent.py    real Claude via the Anthropic SDK's MCP tool-runner
copilot/driver.py       picks mock vs Claude by ANTHROPIC_API_KEY
k8s/                 staging (seeded waste) + prod (protected)

MIT-licensed. A small, laptop-runnable, NDA-safe demo that proves one sharp idea: agentic ops is a guardrails problem. Give the AI real actions, but make the platform the thing that says no.