Two things here are unusual. Cost questions span clouds, Kubernetes and LLM providers in one place, which no single cloud console does. And the policy tools are advisory by design — they price a change, judge it against your budget and hand back a verdict, but never apply anything themselves, so a coding agent can be required to ask first.
Nable, a local-first cloud and AI cost tool that also runs as an MCP server, published as `finops-mcp`. It reads spend across AWS, Azure, GCP, Kubernetes and 15+ AI and SaaS providers, finds idle and oversized resources and puts a monthly figure on each, and exposes a pre-action gate an agent calls before making a cost-affecting change. Everything runs on your machine, read-only by default, and the billing data is not uploaded. Its terminal scan reads only free cloud APIs, so scanning does not add to the bill.
- Total spend summarized by service, account and region, answering questions like why last month jumped — `get_cost_summary`
- A cost preflight on a proposed change: what it costs, whether it fits the budget, and a cheaper path when there is one — `estimate_change_cost`
- An advisory verdict on a remediation before it runs — allow, warn, block or escalate — with one-way doors always escalating to a human — `check_action_policy`
- A budget check for the agent itself, reading local Claude Code usage against a flat plan or a metered cap — `check_ai_budget`
- AWS, Azure and Google Cloud connected from inside the client rather than the terminal, proposing then confirming, and keeping the Azure service-principal secret away from the model — `connect_aws`, `connect_azure`, `connect_gcp`
- Every cloud, SaaS and LLM provider it knows, each marked connected or not configured — `list_connected_providers`
- Onboarding state: what is connected, which credentials are already on the machine, and what to do next — `nable_setup_status`
- A capability list tailored to what you have actually connected — `what_can_nable_do`
Python 3.11 or newer and `uv`. `uvx nable` runs the setup wizard, which finds AWS or GCP credentials already on the machine — an SSO login, a CLI profile, default credentials — and configures the editor, so usually no key is typed. For a manual client config the published package is `finops-mcp` on PyPI, launched as `uvx --python 3.12 finops-mcp` over stdio. Azure needs three RBAC roles granted to the service principal on each subscription: Cost Management Reader, Reader and Monitoring Reader. `nable scan --demo` runs on sample data with no cloud account at all, and `finops-doctor` checks credentials, database, network and audit log when something is not answering. The local tool is Apache-2.0 and free; the agent team, ticket auto-creation, scheduled digests and commitment recommendations are the paid tier.
One command — uvx nable