A plugin for Codex desktop and CLI

Your cloud costs, in your Codex chat.

Bring saved infrastructure, cost evidence, and project context into the conversation. Explore Vercel billing with your existing CLI login, or choose a Cloud Guardian organization and review its connected infrastructure.

Install the plugin Explore the workflows

Plugin 0.1.3. MCP runtime 0.1.2. Two guided skills.

Cloud cost overview

What you can explore

Scoped to the organization you choose

Connected projects: Cloud accounts and saved resources
Monthly run-rate in USD: Billing evidence and scanner estimates
Pricing coverage: Incomplete prices and stale observations

Pick a project and bring its context into your chat.

See the saved picture

Read infrastructure, cost trends, and violations across connected providers. The overview shows loading progress promptly and reuses recent results. Refresh reads saved data again.

Put projects in context

Search project references in compatible hosts. Keep the chosen organization and project attached to the investigation.

Review a specific change

Inspect the proposal, impact, and dry run. Authorize the selected remediation when you are ready to execute it.

Install once.

On macOS or Linux, install the local server, add the Cloud Guardian repository marketplace, then add the plugin.

You need Codex with plugin support. Saved cloud data uses a Cloud Guardian account; Vercel exploration uses your CLI login. The installer verifies the binary checksum and saves it in~/.local/bin.

Terminal

curl -fsSL https://raw.githubusercontent.com/skunkworq/cloud-guardian-plugin/main/install.sh -o /tmp/install-cloud-guardian-mcp.sh
bash /tmp/install-cloud-guardian-mcp.sh --version v0.1.2
export PATH="$HOME/.local/bin:$PATH"
codex plugin marketplace add skunkworq/cloud-guardian-plugin --ref main
codex plugin add cloud-guardian@cloud-guardian

Start a new Codex session to load the skills and tools. The plugin finds the server on PATH or in~/.local/bin.

Using a private fork or only the MCP server?

Install a private marketplace from an authenticated local clone, or register the binary directly with Codex using its absolute path. The standalone connection provides tools; the plugin also bundles the skills.

See alternative installation commands

Vercel billing, ready to explore

Use the login you already have.

A current local Vercel CLI gives you period costs by project and service. Cloud Guardian sign-in and a persistent connector are not required for this path.

Follow the Vercel workflow

Install or update the Vercel CLI, then run vercel login and vercel whoami. Ask Codex:

$cloud-guardian:cloud-costs
Explore Vercel costs for team YOUR_TEAM_SLUG_OR_ID.
Show billed and effective costs, the billing period,
and project and service details.

Billed and effective costs: See both USD totals with their evidence period. Current-period charges are provisional and stay separate from resource run-rate.
Project and service detail: Find what contributes to the bill. The native overview also offers an Explore Vercel costs button when you provide a team.

For saved Vercel inventory and billing, explicitly request persistent onboarding with a Cloud Guardian organization, a team_... ID, and a dedicated API token. CLI exploration works independently and keeps OAuth credentials under Vercel's control. Follow the Vercel onboarding guide.

Connect your cloud view.

Choose cloud-guardian:setup in the skills picker, or start with this message.

$cloud-guardian:setup
Sign me in, show my organizations, and open the saved cost overview
for the organization I choose.

1
Sign in
cg_login opens Google sign-in in your browser.
2
Check your account
cg_whoami verifies your identity and organization memberships.
3
Choose an organization
Pick from cg_list_organizations and use its org_id for the chat.
4
Open the saved overview
cg_open_overview loads costs and infrastructure for that organization. Successful results are reused for up to 30 seconds; Refresh bypasses the cache.

Take the next step.

Local setup connects your account. Provider access, scans, and remediation each have their own next step.

Connect a cloud provider

Choose the provider and confirm the destination organization. Guided setup currently uses a default organization; use an organization-scoped tool for another one. A connection may create scanner credentials or roles and start an initial scan. Enable automatic remediation only when you choose to.

Follow provider setup

Investigate and review costs

Use cloud-guardian:cloud-costs to find cost drivers and review violations. Keep incomplete prices and older observations visible; an unknown price does not mean zero cost. Request a fresh scan or a specific remediation separately.

See the review workflow