Installation

Ghost-hunter is a Python 3.12+ CLI distributed via PyPI. The core install is paranoid-mode only — no cloud SDKs, no credentials, nothing to misconfigure. Active mode pulls provider SDKs as optional extras.

Core (paranoid mode)

pip install ghosthunter

This is the default install. It can read billing CSVs and reason over them — it cannot reach any cloud.

Active-mode extras

# GCP
pip install 'ghosthunter[gcp]'

# AWS
pip install 'ghosthunter[aws]'

# Both
pip install 'ghosthunter[all]'

GCP extras pull google-cloud-bigquery and shell out to gcloud. AWS extras pull boto3 for Cost Explorer.

Verify

ghosthunter --version
ghosthunter doctor

doctor checks Python version, Anthropic key presence, and (if installed) cloud SDK reachability.

Upgrade

pip install --upgrade ghosthunter

Ghost-hunter follows semver. Breaking changes ship in major versions only and are flagged in the CHANGELOG.

Uninstall

pip uninstall ghosthunter
rm -rf ~/.ghosthunter

The second command removes local audit logs and any saved active-mode config.