Best AI Agent Skills for Cloud Cost Optimization (2026)

Point Claude Code at an AWS account with the right plugin loaded and it will run roughly 180 configuration checks, hand back a ranked list of idle NAT gateways and oversized RDS instances, and attach an estimated monthly dollar figure to each one. Then it stops. You open the console and click terminate yourself.

That gap is the honest shape of this category in 2026. There are about seven agent skills worth naming for cloud cost work, most of them AWS-first, and nearly all of them read-only by design. They find the waste. A human still cuts it.

I'd rather say that up front than pad the list to twenty entries. What follows is the short real list, ordered as the sequence you'd run: find the waste, confirm it's safe to cut, cut it, then stop it coming back. One entry belongs to a cost problem the FinOps vendors mostly ignore, which is your own AI token bill.

The list at a glance

Step 1: find the waste

Two entries do this, and they work differently enough that running both is worth the time.

AWS Cost Saver is a Claude Code plugin from Mehul Prajapati. The repo describes 180 checks across EC2, RDS, S3, Lambda, ECS, EKS, Aurora and SageMaker, grouped into eleven domains covering compute, storage, databases, networking and serverless. It returns confidence-scored findings in Markdown with an estimated monthly saving attached to each. Its security model is the part I like: it denies every non-read AWS CLI operation, and the docs point you at the ReadOnlyAccess policy rather than asking for anything wider.

The check count is the project's own number, not something I benchmarked, and the savings estimates deserve the same caution. They come from reading resource configuration rather than your bill, so a right-sizing recommendation on an instance already covered by a Savings Plan can be well off. Cross-check anything you plan to show a finance team.

AWS FinOps MCP Server by ravikiranvm approaches the same account from the billing side. It exposes two tools: get_cost, which queries spend by profile, region, time range and service with tag and dimension filters, and run_finops_audit, which sweeps regions for stopped instances, unattached EBS volumes and unused elastic IPs. It runs locally against your existing AWS CLI profiles, so credentials stay on your machine. Python 3.10 or later, plus any MCP client.

One detail the README is upfront about and most write-ups skip: each get_cost call hits the AWS Cost Explorer API, and AWS charges $0.01 per request. Nothing for a weekly report, not nothing for an agent that explores your bill from nine angles in one conversation. Watch it the first few sessions.

The split is worth internalising. Cost Saver reasons about how your infrastructure is configured; the FinOps MCP server reads what you were charged. Configuration analysis finds the thing nobody is using. Billing analysis finds the thing whose price quietly tripled.

Step 2: confirm it's safe to cut

Finding an idle resource takes a script. Working out whether anyone needs it is the part that eats an afternoon, and it's where the adjacent tools earn a place on this list.

Prowler is not a cost tool and I won't pretend otherwise. It's an Apache 2.0 security and compliance scanner with 1,263+ checks across 24+ providers, weighted toward AWS at 621 checks, then Azure at 191, GCP at 109, Kubernetes at 92 and GitHub at 24. What earns it a place here is Attack Paths, which combines Cartography's cloud inventory with Prowler's findings in a Neo4j or Amazon Neptune graph. The inventory that answers "is this exposed" also answers "does anyone still use this."

K8sGPT scans clusters and explains what's broken in plain English. Fourteen analysers run by default, covering Pod, PVC, ReplicaSet, Service, Event, Ingress, StatefulSet, Deployment, Job, CronJob, Node and the mutating and validating webhook configs, with another twenty-plus optional ones including HPA, PDB, NetworkPolicy, Gateway resources, logs and storage. Its docs list no cost analyser, and I'd read that as an accurate statement of scope rather than an oversight.

It still belongs in a cost workflow. A Deployment stuck in CrashLoopBackOff has billed you for compute all week without serving a request. A HorizontalPodAutoscaler that never scales because its metrics server is misconfigured is why your node group is sized for a peak that never arrives. K8sGPT names both. Run k8sgpt serve --mcp and it exposes twelve tools over the Model Context Protocol, so any MCP client can call it mid-investigation. If Kubernetes is where your spend lives, our Kubernetes skills guide goes deeper on the cluster side.

Kubetools is a curated index of 500+ Kubernetes tools from the Collabnix community, with a Cost Optimisation category. Use it as a map of what exists, not a recommendation. Entries carry GitHub star counts, and stars measure who bookmarked something once, not whether it works on your cluster.

Step 3: cut it

Here the list gets short, because exactly one entry will change your infrastructure.

OpenOps is a no-code FinOps automation platform under Apache 2.0. It consolidates optimisation opportunities, proposes actions, and runs them through workflows you can edit, covering allocation, unit economics, anomaly management and workload optimisation. The self-hosted version installs via docker-compose and is free. A managed cloud service with support and SLAs is priced separately, and you'll have to ask them for a number.

The feature that matters is human-in-the-loop approval across multiple channels. An agent proposing to delete a snapshot is fine. An agent deleting it without anyone signing off is a bad Tuesday.

Calling OpenOps an agent skill is a stretch. It's a platform with an agent layer, and standing it up is a project rather than an afternoon. If you were hoping for a Claude Code skill that terminates the instance for you, it doesn't exist in a form I'd hand production credentials to, and the read-only default in AWS Cost Saver is the correct instinct rather than a missing feature. The instance you wrongly terminated is not coming back with its EBS volume attached.

Step 4: stop it coming back, including the token bill

The recurring half of this is boring and works. Set a budget alert at the provider, and put the analysis skill on a schedule so it runs monthly against a read-only role and posts to a channel someone reads. Most of the waste an agent finds this month is waste that grew back after last quarter's cleanup.

The FinOps Foundation's State of FinOps 2026 surveyed 1,192 practitioners stewarding more than $83 billion in annual cloud spend. Ninety-eight percent of them now manage AI spend, up from 31% two years earlier. "FinOps for AI" came in as the top forward-looking priority, and AI cost management was named the number one skillset teams need to build. Your Cost Explorer dashboard has nothing to say about tokens.

Lean Ctx is the one open-source entry aimed squarely at that. It's a single local Rust binary sitting between your coding agent and the model, working two paths: an MCP server that governs what the agent reads, with ten read modes from full file content down to AST signatures, and an optional proxy that compresses outbound requests. Shell hooks compress command output. It supports 30+ agents including Claude Code, Cursor, Copilot and Gemini CLI, with zero telemetry.

The repo claims 60 to 90% fewer tokens, a cached file re-read at roughly 13 tokens against 2,000+ for a raw read, and 98.1% compression in map mode on their own benchmark. Those are the project's numbers on the project's test data and I have not reproduced them. The mechanism is sound: if your agent reads the same 800-line file nine times in a session, you paid for those bytes nine times.

Distrust the headline percentage, though. Compression ratios depend on your codebase shape and how repetitively your agent works, so measure your own before and after rather than budgeting against someone else's benchmark. For the wider agent-tooling picture, see our full list for developers.

What this category still doesn't have

Four gaps, and they're the reason this list runs to seven entries rather than thirty.

Nothing closes the loop safely. No skill here will right-size an instance, watch the latency, then roll itself back if p99 degrades. That's the actual product, and it currently exists only inside paid platforms.

Coverage skews hard to AWS. Outside Prowler's multi-provider check set, Azure and GCP users get little from this list.

Nothing ties a cost spike to the deploy that caused it. Every tool here will tell you spend jumped 40% on the 14th. None will tell you which merge did it.

And token cost optimisation is one project, not a category. Given that AI is the fastest-growing line on most cloud bills, I expect that to be the busiest corner of this space by next year.

My honest recommendation

An opinion, flagged as one: below roughly $10,000 a month in cloud spend, a scheduled read-only analysis skill plus a provider budget alert beats a FinOps platform on value. The platforms charge a percentage of managed spend or a seat fee, and under that threshold the waste you can recover is often smaller than the cost of running the programme to recover it. Above it, dedicated tooling starts paying for itself, and OpenOps is where I'd look first because you can self-host it and read the source.

The setup I'd run on a small AWS estate: AWS Cost Saver monthly against a ReadOnlyAccess role, the FinOps MCP server for ad hoc "why did this month jump" questions, AWS Budgets for the alert, and Lean Ctx if your team spends real money on coding agents. Free stack, an hour of setup, twenty minutes a month.

Before installing any of them, read the SKILL.md and the tool definitions. A cost skill asks for credentials to your billing data and resource inventory, which together map everything you run. Our guide to auditing an agent skill before installing it covers what to look for, and the DevOps skills roundup covers the neighbouring tooling.

How to install these safely

There's no universal install command here, and be suspicious of any directory that prints one for you. The three real patterns:

An agent skill is a SKILL.md file in ~/.claude/skills/<name>/ for personal use, or .claude/skills/<name>/ inside a project repo.

A plugin marketplace is added with /plugin marketplace add <owner>/<repo> inside Claude Code, then installed with /plugin install <name>. AWS Cost Saver ships this way.

An MCP server is registered with claude mcp add or by editing your client's config, following whatever the server's own README specifies. The FinOps MCP server and Lean Ctx both go this route.

Follow the repo's README for the exact command, then create a dedicated read-only IAM role rather than handing over your admin profile.

FAQ

Can an AI agent delete my unused cloud resources for me?

Not the ones on this list, with one exception. AWS Cost Saver blocks every non-read AWS CLI operation by design, and the AWS FinOps MCP Server is read-only. Only OpenOps executes changes, and it routes them through approval workflows first. A skill offering to terminate resources unsupervised is a reason to look harder at it, not a selling point.

What's the difference between an agent skill and a FinOps platform like OpenOps?

A skill is a text file plus tool definitions that teaches your existing agent how to do something, costing nothing beyond model tokens. A platform is software you deploy and operate, with its own database, scheduler and UI. Skills win on setup time; platforms win when you need approval workflows, history and multi-team access.

Does running these skills cost money by itself?

The skills are free to install, but the API calls underneath sometimes aren't. AWS charges $0.01 per Cost Explorer API request, so an agent querying your bill repeatedly in one session builds a small charge. Model tokens are the other cost, and a full account scan is not a cheap prompt.

Is there anything here for Azure or GCP?

Not much. Prowler covers Azure with 191 checks and GCP with 109, and OpenOps is multi-cloud. Everything else here is AWS or Kubernetes. If your spend sits mainly in Azure, this category has not caught up to you yet.

Why is AI token spend part of a cloud cost article?

It lands on the same budget and grows faster than anything else on it. The FinOps Foundation found 98% of practitioners now manage AI spend, up from 31% two years ago. Cost Explorer and its equivalents were built for instances and storage, and they see nothing of what your team spent on inference last week.