{
  "markdown": "# Cloudwright\n\n*Design a cloud architecture or plan a migration. Get costs, controls, code, and checked evidence.*\n\n[![PyPI](https://img.shields.io/pypi/v/cloudwright-ai.svg)](https://pypi.org/project/cloudwright-ai/) [![CI](https://github.com/xmpuspus/cloudwright/actions/workflows/ci.yml/badge.svg)](https://github.com/xmpuspus/cloudwright/actions/workflows/ci.yml) [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE) [![Python 3.12+](https://img.shields.io/pypi/pyversions/cloudwright-ai)](https://pypi.org/project/cloudwright-ai/) [![xmpuspus/cloudwright MCP server](https://glama.ai/mcp/servers/xmpuspus/cloudwright/badges/score.svg)](https://glama.ai/mcp/servers/xmpuspus/cloudwright)\n\n<p align=\"center\"><img src=\"examples/cloudwright-hero.gif\" alt=\"A terminal runs cloudwright init, cost, compliance and plan. The compliance table maps every finding to a HIPAA and SOC 2 control ID. The plan step ends on a DEPLOYABLE verdict from terraform validate.\" width=\"820\"></p>\n\n```bash\npip install 'cloudwright-ai[cli]'\nexport ANTHROPIC_API_KEY=sk-ant-...\ncloudwright design \"HIPAA healthcare API on AWS with Postgres and Redis\"\n```\n\nCloudwright turns one line of English into a typed spec, a cost breakdown, a control-mapped compliance report,\nand infrastructure code. A source estate and target become ordered migration waves, explicit costs,\nand evidence gates. It covers AWS, GCP, Azure and Databricks across 114 service keys. Only `design`, `modify`,\n`chat` and `adr` call a model. Every other command runs offline and needs no API key.\n\n[Quickstart](#quickstart) &middot; [Migrations](#migration-plans-stop-when-evidence-is-missing) &middot; [Compliance](#every-finding-carries-the-control-id-it-violates) &middot; [Agents](#one-mcp-server-reaches-11-coding-agents) &middot; [Docs](docs/) &middot; [Changelog](CHANGELOG.md)\n\n## A prompt produces a spec, a cost, a control-mapped report, and Terraform\n\n- **Spec.** Typed YAML you commit, diff and review. Everything below reads from it.\n- **Cost.** Per component and region-aware, with a confidence flag on every line.\n- **Compliance.** HIPAA, SOC 2, PCI-DSS, FedRAMP, GDPR, ISO 27001 and NIST 800-53 control IDs.\n- **Infrastructure code.** Terraform, OpenTofu, Pulumi (TypeScript or Python) and CloudFormation.\n- **Diagrams.** ASCII, Mermaid, D2, and a web canvas you can edit by hand.\n- **An MCP server**, so any coding agent runs the same checks inside its own loop.\n\nExports carry safe defaults. S3 gets a public-access block, SSE and versioning. RDS gets encryption, multi-AZ\nand deletion protection. EC2 gets IMDSv2. A compliance framework overrides the workload profile, and always\nforces encryption and high availability.\n\n## Quickstart\n\n```bash\ncloudwright design \"HIPAA healthcare API on AWS with Postgres and Redis\"\ncloudwright cost spec.yaml --workload-profile medium\ncloudwright compliance spec.yaml --frameworks hipaa,soc2\ncloudwright export spec.yaml --format terraform -o ./infra\ncloudwright plan spec.yaml --target terraform          # proves it deploys, never applies\ncloudwright migrate demo                               # packaged migration proof, fully offline\ncloudwright chat --web                                 # canvas at http://localhost:8765\n```\n\nAdd `--json` before any subcommand for machine-readable output, or `--stream` to watch tokens arrive. Set `ANTHROPIC_API_KEY` or `OPENAI_API_KEY` for the four commands that need a model.\n\n## Migration plans stop when evidence is missing\n\n<p align=\"center\"><img src=\"examples/cloudwright-migration-web-demo.gif\" alt=\"The Migration tab runs the PH telecommunications proof project. It reports five ordered waves, migration economics, 22 passing evidence gates, and a Ready to close result. The view then scrolls through the dependency route and evidence groups.\" width=\"820\"></p>\n\nThe migration model covers infrastructure, applications, data, platforms, networks, facilities, and business\nservices in one dependency graph. It works for on-premises, cloud, cross-cloud, hybrid, data-center, and\napplication moves. It plans and checks work. It never copies data, applies infrastructure, switches traffic,\nor runs a cutover.\n\n```bash\ncloudwright migrate plan examples/migrations/ph-telco-project.yaml -o assessment.yaml\ncloudwright migrate verify examples/migrations/ph-telco-project.yaml examples/migrations/ph-telco-evidence.yaml\n```\n\n<p align=\"center\"><img src=\"examples/cloudwright-migration-cli-demo.gif\" alt=\"The offline CLI builds five PH telco migration waves and costs. It checks 22 gates and returns Ready to close.\" width=\"760\"></p>\n\nThe core has no telco fields. The first proof project selects an external `ph_telco` pack for subscriber,\nbilling, usage-record, number-porting, privacy, recovery, and source-shutdown gates. A manufacturing ERP\nfixture proves the same planner works without that pack. Missing blocking evidence changes the result to\n`closed: false` and makes `migrate verify` exit with code 2. Each evidence file carries the deterministic\nassessment ID, so observations from an older target or cutover plan cannot close a revised assessment.\n\nMCP clients use the same engine through `plan_migration` and `verify_migration` in the `migration` tool group.\n\nSee [Migration planning and evidence](docs/migrations.md) for the file contract, Python API, HTTP routes,\ndomain-pack format, limits, and recording commands.\n\n## Every finding carries the control ID it violates\n\n<p align=\"center\"><img src=\"examples/cloudwright-controls-web-demo.gif\" alt=\"The web canvas Compliance tab shows a per-framework table for HIPAA, SOC 2 and FedRAMP. Each row carries satisfied and violated control IDs. The Plan tab then returns a DEPLOYABLE verdict.\" width=\"820\"></p>\n\nOther tools scan infrastructure after you deploy it. Cloudwright maps each finding to its control before any\nresource exists. The fix then costs a spec edit instead of a change ticket. HIPAA `164.312(a)(2)(iv)`, SOC 2 `CC6.1`\nand FedRAMP `SC-28` come from the built-in scanner, with no extra tooling. Checkov folds into the same report\nwhen it sits on your PATH.\n\n- `--oscal` writes an OSCAL 1.1.2 component-definition with deterministic UUIDs.\n- `--traceability` prints the chain from component to resource to control to status.\n- `cloudwright plan` runs `terraform validate` against the export, and never applies.\n\n## The review needs no API key and no network\n\n<p align=\"center\"><img src=\"examples/cloudwright-review-demo.gif\" alt=\"cloudwright review prints a severity-ranked table for the patient-portal spec. It scores the spec 39 out of 100, with 15 findings and 8 blocking. A second command traces each component and Terraform resource to a violated HIPAA control.\" width=\"760\"></p>\n\n`cloudwright review` runs the scorer, the linter and the validator over a spec, and returns one severity-ranked\nreport. The same three critics run inside `cloudwright design`. When blocking findings survive generation, the\narchitect repairs the spec once and records the change in `spec.metadata.critique`. Pass\n`Architect(repair=False)` to turn that off.\n\n## Canvas edits never call the model, so they are instant and free\n\n<p align=\"center\"><img src=\"examples/cloudwright-smart-canvas-demo.gif\" alt=\"The web canvas with a boundary-aware diagram. A catalog drawer adds an ElastiCache node, a side panel edits its label and config, and the cost total updates.\" width=\"820\"></p>\n\nAdd, drag, connect, edit and delete are deterministic frontend mutations. The Catalog drawer serves the resource\nlist per provider and five approved multi-resource modules. Its standards check flags orphan connections,\npartial modules and missing tags. An intact module exports as a single Terraform `module` block, with the\ncatalog's pinned source and version.\n\n## One MCP server reaches 11 coding agents\n\n```bash\ncloudwright integrate --harness claude-code       # exact wiring, in that client's format\ncloudwright integrate --harness cursor --write    # merge it into the right file\ncloudwright integrate --rules --agent-file claude # a gate block for CLAUDE.md\n```\n\nDo not hand-write the config. `cloudwright integrate` emits it for Claude Code, Cursor, Cline, Windsurf, GitHub\nCopilot, Zed, Codex CLI, Junie, Kiro and Antigravity. Aider gets a CLI-pipe recipe instead, because it speaks\nno MCP. Every client wants a different shape: Zed wants `context_servers`, Copilot wants `servers`, and Codex\nwants a TOML table.\n\nThe server exposes 24 tools in 10 groups: design, cost, validate, analyze, export, session, review, compliance,\nplan and migration. Full matrix in [docs/integrations.md](docs/integrations.md).\n\n## Offline commands grade, scan, compare, and plan\n\n`lint` runs 10 anti-pattern checks. `score` grades 5 dimensions. `analyze` reports blast radius and single\npoints of failure. `policy` enforces policy-as-code with 9 built-in rules. `security` scans the spec and the\nexported HCL. `drift` compares a design against a `tfstate`, and `--remediate` turns the gap into a cost,\ncompliance and plan preview.\n\n`review`, `compliance` and `plan` are above. See [docs/cli-reference.md](docs/cli-reference.md).\n\n## Python API\n\n```python\nfrom cloudwright import ArchSpec\nfrom cloudwright.cost import CostEngine\nfrom cloudwright.validator import Validator\nfrom cloudwright.exporter import export_spec\n\nspec = ArchSpec.from_file(\"spec.yaml\")\npriced = CostEngine().estimate(spec, workload_profile=\"medium\")\nfindings = Validator().validate(spec, compliance=[\"hipaa\", \"pci-dss\"])\nhcl = export_spec(spec, \"terraform\", output_dir=\"./infra\")\n```\n\n## v1.10.0 adds migration planning with evidence-based closure\n\n- **One model covers the full estate.** Infrastructure, data, applications, platforms, networks,\n  facilities, and business services share one dependency graph.\n- **Dependencies determine the waves.** The planner schedules prerequisites first, rejects cycles,\n  checks rollback paths, and reports unresolved mappings.\n- **Closure needs evidence.** Missing or failed blocking observations prevent closure and make\n  `migrate verify` return exit code 2.\n- **Industry rules stay outside the engine.** Optional YAML packs add acceptance gates without adding\n  industry fields to the core.\n- **PH telco is the first proof.** The product remains industry-neutral. A manufacturing ERP fixture\n  runs through the same planner with no domain pack.\n\nEarlier releases added control-ID mapping and `plan` (v1.5.0), the self-correcting architect and OSCAL\n(v1.6.0), `cloudwright integrate` (v1.7.0), the responsive dark-theme canvas (v1.8.0), and measured\ncanvas interaction fixes (v1.9.0). Full history in [CHANGELOG.md](CHANGELOG.md).\n\n## Compatibility\n\n- Python 3.12+\n- Models: Anthropic (Claude Sonnet, Haiku) and OpenAI (GPT-5+ family), auto-detected from env.\n- Clouds: AWS, GCP, Azure, Databricks. 114 service keys total.\n- Install variants: `cloudwright-ai[cli]`, `cloudwright-ai[web]`, `cloudwright-ai-mcp`.\n\n## Contributing, license, changelog\n\n- Contributing guide: [CONTRIBUTING.md](CONTRIBUTING.md)\n- License: MIT, see [LICENSE](LICENSE)\n- Full release history: [CHANGELOG.md](CHANGELOG.md)\n",
  "bytes": 11105,
  "sha": "45de2e974fec9be59426d1d1976e6b95b4d14580be41d7490b80ebea1395280f",
  "repo_slug": "xmpuspus/cloudwright",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_xmpuspus_cloudwright_30a2b872/readme"
}