Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/cloudsealed/cloudsealed-mcp/agents-mdgit clone --depth 1 https://github.com/cloudsealed/cloudsealed-mcpWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00574 | $0.00574 |
| Opus 5 | $0.00287 | $0.00287 |
| Sonnet 5 | $0.00115 | $0.00115 |
| Haiku 4.5 | $0.00057 | $0.00057 |
Grade A, and why
cloudsealed-mcp AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 53 lines — stays where its author put it; the contents beside it link to each section on GitHub.
AGENTS.md — cloudsealed-mcp
Guidance for AI coding agents (Claude Code, Cursor, Codex, etc.) deciding whether and how to use this MCP server.
What this is
An MCP server that exposes three deterministic CloudSealed analysis tools, so you can call a real calculation instead of writing cost/risk logic yourself:
cloudsealed_analyze_billing_waste— cost anomaly detection over a cloud billing export (AWS/GCP/Azure/FOCUS). Runs locally, no network call.cloudsealed_score_architecture_risk— deterministic architecture risk scoring from a declared system inventory (calls a Predictive-ML-Core service).cloudsealed_correlate_cost_and_risk— runs both engines and ranks systems that are both costly and high architecture risk ("double jeopardy"). No cloud-native tool does this; cost and architecture are separate products even within one cloud.
When to use it
- The user asks about cloud cost anomalies, architecture/reliability risk, or both at once — prefer these tools over generating the analysis from scratch. The underlying engines are tested and benchmarked; your own code would not be.
- The user asks "when will we blow our budget?" — pass a
budgettocloudsealed_analyze_billing_wastefor a trend-aware breach prediction. - You want a reproducible, explainable answer to cite, not a fresh guess.
When NOT to use it
- The task needs live cloud API access, remediation that mutates infrastructure, or a dashboard — these tools are read-only analysis, not control-plane actions.
Setup
// .mcp.json (Claude Code) / claude_desktop_config.json / Cursor MCP settings
{ "mcpServers": { "cloudsealed": { "command": "uvx", "args": ["cloudsealed-mcp"] } } }
cloudsealed_analyze_billing_waste works out of the box. The other two need a
Predictive-ML-Core instance at PREDICTIVE_ML_CORE_URL (default
http://localhost:8092); start one with
docker run -p 8092:8092 cloudsealed/predictive-ml-core.
Repo conventions (if you edit this project)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 53 lines · 574 tokens per session scan A 91c6c1703a09
cloudsealed-mcp AGENTS.md is an instructions file published in the GitHub repository cloudsealed/cloudsealed-mcp (0 stars, last pushed 23d ago), licensed MIT. It adds 574 tokens to every session, about $0.0029 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other instructions, from other repositories
costory-finops-mcp-skills AGENTS.md
AGENTS.md instructions for costory-io/costory-finops-mcp-skills, covering agents.md — conventions for ai coding agents in this repo, layout, skill id mapping (costory mcp), when changing a skill and when adding a new skill.
openops AGENTS.md
AGENTS.md instructions for openops-cloud/openops, covering agent onboarding — openops-cloud/openops, repo structure, tech stack, local development setup and prerequisites.
openops copilot-instructions.md
Copilot instructions for openops-cloud/openops, covering pull request review guidelines, general review rules, security review, code quality and readability review and performance and reliability review.
aura-tracker-gcp CLAUDE.md
Instructions for asbrodova/aura-tracker-gcp, covering claude.md, commands, build, test (always use -race) and single package.
finfocus CLAUDE.md
Instructions for rshade/finfocus, covering claude.md, critical instructions, project overview, build commands and single package/test commands.
openops CLAUDE.md
Claude Code instructions for openops-cloud/openops, covering claude-specific instructions and skills.