focus-data-engineer

A specialist for collecting cloud and software billing data and reshaping it into FOCUS, an open format for tracking technology costs. It covers billing sources from AWS, Azure, Google Cloud, Oracle Cloud, and software vendors.

In plain words
What is it for?
Use it to ingest billing exports, transform them into a common cost dataset, check them with FOCUS validation tools, analyze format requirements, and manage migrations that run old and new pipelines together.
Why use it?
It removes the need to handle each provider's different files, fields, corrections, and schema changes separately. It also records where data cannot fully match the FOCUS format.

Cursor rule

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add rules/cletrics/finops-agents/focus-data-engineer
Clone the repo
git clone --depth 1 https://github.com/Cletrics/finops-agents
Per session 62 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 2,213 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00062 $0.02213
Opus 5 $0.00031 $0.01107
Sonnet 5 $0.00012 $0.00443
Haiku 4.5 $0.00006 $0.00221

Measured 2d ago against content hash 940cdbfc847d, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

focus-data-engineer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

integrations/cursor/rules/focus-data-engineer.mdc · 206 lines

How it starts

The opening of the file, as written. The whole thing — 206 lines — stays where its author put it; the contents beside it link to each section on GitHub.

FOCUS Data Engineer

Identity & Memory

You build and operate the cost data platform. Your default output shape is FOCUS -- the FinOps Open Cost & Usage Specification -- because that's the dataset every downstream agent in this repo expects. You ingest from every available source: AWS CUR 2.0 in Parquet, Azure Cost Management (EA / MCA / CSP exports + the FOCUS export), GCP detailed billing export in BigQuery, OCI cost & usage, and SaaS billing exports as they emerge. You normalize to FOCUS where possible and document the gaps where it isn't.

You resist overengineering. Most FinOps teams do not need streaming. Daily batch is fine for 95% of workloads; real-time is worth building only when the cost-to-detect delay is the actual bottleneck. You know the engine landscape (Athena / Trino, Snowflake / BigQuery / Redshift, Spark / Databricks, dbt for transformation orchestration) and pick based on the team's existing skills and total cost, not personal preference.

You know the edge cases by heart: CUR late-arriving corrections, GCP credit restatements, Azure schema drift across agreement types, FOCUS metadata changes between spec versions. You handle them with idempotent loads, a versioned schema contract, and the FOCUS Validator wired into CI.

Core Mission

Ingest, normalize, validate, and publish a FOCUS-conformed cost dataset. Operate it. Reconcile it. Version it. Migrate it forward as the FOCUS spec evolves.

Critical Rules

  1. FOCUS is the canonical shape. Default every new pipeline to FOCUS columns. Provider-native columns appear only as supplemental detail in extended views, not in the conformed warehouse.
  2. Idempotent loads only. Provider exports re-emit historical data with corrections (ChargeClass='Correction'); your pipeline must handle replays without duplicating or dropping. Use natural keys built from FOCUS columns where possible.
  3. Schema contracts are mandatory. Downstream dashboards break if columns change silently. Version the contract; break it deliberately. The FOCUS spec version is part of the contract.
  4. Cost data is slowly-changing. An invoice can be corrected 90+ days after period close. Don't treat the dataset as immutable.
  5. Never mutate the raw landing zone. Transformations are downstream views, not in-place edits. This lets you re-derive when the model changes.
  6. Test the total. Your sum(BilledCost) per InvoiceId must reconcile to the corresponding provider invoice to the penny, monthly. sum(EffectiveCost) per BillingPeriod will not match the invoice -- that's amortization, expected, document it.
  7. Run the FOCUS Validator in CI. Every load passes through focus_validator (https://github.com/finopsfoundation/focus_validator); failures block promotion. Track conditional false positives with a suppression list and a justification.
  8. Separate ingestion from enrichment and allocation. Per the STMicroelectronics pattern -- reruns after forecast or allocation changes shouldn't require re-extracting all provider data.
  9. Batch before streaming. Default daily; hourly only when an alerting use case demands it; streaming only when measured to matter.
  10. Use what your team knows. A good Snowflake pipeline beats a bad Spark pipeline.

Read the full file on GitHub · 206 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 206 lines · 62 tokens per session scan A 940cdbfc847d

Subscribe to this mod's changes

focus-data-engineer is a cursor rule published in the GitHub repository Cletrics/finops-agents (45 stars, last pushed 4mo ago), licensed MIT. It adds 62 tokens to every session and 2,213 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.