most FinOps tools are dashboards. finfocus is a CLI.

The cloud bill is the only part of your infrastructure you find out about last.

You write the Pulumi program, you run pulumi up, the resources come alive. The cost shows up weeks later on an invoice, in a dashboard, in a meeting you're not in. By the time someone asks "why did this go up," the change that moved it is buried twenty deploys back.

There are good tools for that bill: Vantage, Finout, Cloudability. But they're built around a web UI and an API. The data lives where finance works, not where engineers do.

fin, not ops

That's the gap. Most companies already pay for a FinOps tool, and most of those tools have no CLI, because they're built for the fin half: reporting, allocation and the monthly review, not the ops half, the person typing pulumi preview who could change the number before it's ever spent.

finfocus is the ops half. It doesn't replace your FinOps tool; it gives the people running the infrastructure the view, and the power to act on it before the money is spent.

what it does

finfocus is a CLI that reads a Pulumi stack and tells you what it will cost before you deploy:

• projected cost from pulumi preview — point it at the plan JSON, get a monthly estimate per resource, priced as a diff: before and after, with the delta. Directional, not a promise: a static estimate can't see your traffic or your spot discounts. It's the number you argue about in review, not the invoice.
• budget gates in CI — fail the build with a non-zero exit code when a change blows the budget, so the expensive line never merges.
• actual spend and drift — pull what you're really spending and compare it to what you projected.

No code changes. It works off the stack and preview your project already produces.

cost on the pull request

The place this matters most is the review, so there's a GitHub Action: finfocus-action prices the plan and comments the monthly cost, budget status, and savings on the pull request, updated on every push. There's a live demo pull request if you want to see one.

plugins, not a platform

finfocus doesn't ship a pricing database it expects you to trust. It talks to sources through plugins:

• public cloud pricing (AWS, Azure), which needs no billing access
• cloud cost APIs (AWS Cost Explorer)
• and the FinOps tools you already pay for: there are plugins for Vantage, Flexera, and OpenCost

BASF used to run an ad that said it doesn't make a lot of the products you buy, it makes a lot of the products you buy better. finfocus is that for FinOps tools. It works with the one you already pay for through plugins, so the thing you bought to see last month's spend shows you next month's, in your pull request. It's a FinOps tool too, and a better one for the person writing the change.

what's landed since june

finfocus is at v0.5.5 as I write this. What changed:

• The whole stack, not just the plan. Commands read the deployed stack as well as the preview, so recommendations and savings totals cover what's running, not only what's changing. A replaced resource is counted once.
• Kubernetes cost. finfocus cost cluster splits a cluster's cost by namespace, controller, pod, node, or label, shares idle and system cost across workloads, and links workloads back to Pulumi resources. It can price historical windows from Prometheus usage data.
• History and anomalies. cost history stores projected cost per Pulumi checkpoint so you can diff it later, and cost forecast projects forward, with an ARIMA model if you feed it your billed spend. cost actual can import your Pulumi Cloud update history. cost anomalies lists only the resources whose run rate has drifted more than 10%, with a robust-median method if the mean is too jumpy.
• A dashboard, still local. finfocus --web opens a browser dashboard on localhost with the same data, including forecasts and anomalies, plus pages to install and configure plugins and edit your config.
• Carbon. The carbon plugin adds offline monthly CO2e estimates for common AWS EC2 instance types next to the price, and reports provider-published historical emissions.
• Spot. When a plugin marks a resource as spot, every cost surface labels it. If the plugin supplies them, you also get the interruption risk and the savings against on-demand. Cluster cost splits by capacity type too.
• Credentials from Pulumi ESC. Plugins get credentials from the Pulumi ESC environments your stack already imports, and only the variables they ask for. Secrets are redacted from the resource attributes sent to plugins.
• An MCP server an agent can use. finfocus mcp-server, or finfocus --mcp, serves the commands as tools and returns JSON on every call. It's built on ax-go, and my bug report there became mcp.Exclude in v0.7.0, which keeps TUI launchers, bare command groups, and the server that never returns out of the tool list. There are also agent skills for checking a plan's cost, checking drift, and managing plugins.
• A scoring plugin, off by default. scorer rates the recommendations other plugins produce: how risky acting is, whether the resource is probably in that state on purpose, whether the change is worth an engineer's time. It's a ranking signal, not approval. It's off until you install it and pick a hosted backend: Jev, from TypeSafe AI, or Clef, which runs on Cloudflare Workers AI. Both receive the recommendation details, so read what yours sends before you turn it on.
• Easier to write plugins. plugin init generates the health endpoint, Docker files, docs, and CI workflows.

The bill is still the last thing you find out about. finfocus just moves the moment you could have known from after the invoice to before the merge.

Repo and docs · latest release