Agentic AI FinOps
Investigator
Finds what others miss. Reads a CSV. Never touches your cloud.
MostFinOpstoolswantadminkeys,genericrecommendations,and5%savings.
Ghost-hunter does the opposite. Reads a CSV, investigates root cause, you stay in control.
Two models. Different jobs.
One reasons. One verifies. The split makes the tool harder to jailbreak and faster to run than a single-prompt agent.
Claude Opus, reasons
Reads the billing slice, forms hypotheses, and proposes the next investigative move. Nothing it produces touches your cloud directly, every command flows through the validator.
- Generates falsifiable hypotheses, not vague advice
- Cites the row + column it's reasoning from
- Stops when budget or confidence floor is reached
Claude Sonnet, validates & executes
Every proposed command passes a 7-layer code validator before a smaller, faster model gets a final semantic say. Only then does anything run, in a sandbox you control.
- Code-first checks; prompts can't override them
- Sub-second validation per step
- Refuses, doesn't soften, on policy hits
The split makes the tool harder to jailbreak and faster to run than a single-prompt agent.
Security in code, not in prompts.
Seven independent layers. A model that disagrees with the rules can argue all it wants, the rules don't read prompts.
Fast reject
No shell injection, characters and operators are screened before the LLM ever sees the line.
Allowlist
Only read-only patterns are eligible. Mutating verbs are out, full stop.
Pipe validation
If a pipe is used, every target must independently pass, no Trojan tail commands.
Safety checks
Length cap, no encoding tricks, no smuggled escapes.
Budget limits
Hard caps: 15 commands, $1, 10 minutes per investigation.
Sonnet semantic check
A smaller model gets the final pass, does this command match the stated intent?
Sandboxed execution
Provider-scoped env. No long-lived creds, no network beyond the documented allowlist.
Paranoid mode
is the default.
Reads your billing CSV. Prints commands you run yourself. Zero blast radius. Active mode runs commands directly using your read-only credentials, but only on a sandboxed account, never production. Demo mode replays bundled scenarios end-to-end with no API calls, try it without any setup.
› ghosthunter investigate billing-2025-10.csv --paranoid› reading 184,221 line items · 0 cloud calls[1/6] anomaly detected · +312% vs 30d baseline[2/6] scope · Route53 / example.com · 92% confidence[3/6] correlate · high QPS, random subdomains, low TTL[4/6] propose: dig @203.0.113.53 chaos txt version.bind · awaiting your run$ dig @203.0.113.53 chaos txt version.bind› BIND 9.16.23 (Ubuntu)[5/6] hypothesis validated · 93%✓ [6/6] root cause: external DNS amplification via open resolverrecommend · block 203.0.113.53 at firewall or WAF
Try it in 30 seconds
Replays a real-shape investigation, no API calls, no cloud access required.
$ $
Looking for the first 10 adopters.
Run paranoid mode on a real billing export. I'll run the tool with my own API key, walk through the investigation alongside you, hand you concrete actions to fix what we find, no charge, NDA available.