Preview — now available

Your cloud,
on command

ClowdOps is a chat-oriented AI platform for running intelligent agents against your cloud infrastructure. Describe a task in plain language — the agent plans and executes it.

See how it works
ClowdOps — AWS Prod / Production
AWS Prod
S3 audit
CloudWatch errors
Cost comparison
Yesterday
IAM policy review
Lambda timeouts
RDS snapshot check
List all S3 buckets and flag any that have public access enabled.
Classified request as discovery + audit
Listing buckets in us-east-1 region
s3:ListBuckets (us-east-1)
s3:GetBucketPublicAccessBlock × 14
Synthesising results
Found 14 buckets in us-east-1. 2 have public access enabled:

prod-assets-cdn — ACL allows public-read
legacy-exports-2021 — bucket policy allows s3:GetObject for *
Type what you want to try with the agent…

Works with your stack

Operate AWS, Google Cloud, Azure, and OCI — plus SSH-managed Linux hosts on-prem or anywhere else. Bring your own cloud, model-provider, and notification keys, and choose which model (Claude, GPT, Gemini, Bedrock) powers each project.

Platform capabilities

Everything you need to operate your cloud at the speed of thought

From one-off queries to recurring automated audits — ClowdOps handles the full lifecycle of cloud operations through a single conversational interface.

Chat-first interface

Describe any cloud operation in plain language. No scripts to write, no API docs to read. The agent understands intent and acts accordingly.

Projects & Sandboxes

Organise work by team or application domain. Each sandbox holds its own credentials and run history — fully isolated and reusable.

Scheduled runs

Automate task execution with cron expressions. Hourly, daily, weekly, or any custom schedule. Overlapping runs are skipped automatically.

Resource inventory

A live, searchable inventory of every resource the agent has discovered. Dependency graphs reveal blast radius before you make changes.

Bring your own keys

Add your own cloud, AI model-provider, and notification credentials — each encrypted at rest and never shown in plaintext after creation. Choose which provider powers each project, or hand the agent a preferred order to fall through.

Notification channels

Connect Slack, Microsoft Teams, PagerDuty, or SMTP. The agent can push alerts mid-run via the notify tool, or deliver a post-run digest when a scheduled task finishes.

Team & access control

Invite team members with Admin or Member roles. Members see only the projects and sandboxes they are explicitly invited to.

Cloud cost analysis

Just ask what you spent and where. The agent pulls cost and usage data straight from AWS, Google Cloud, and Azure and breaks it down by service, account, or period — no dashboards to wire up.

Live cost meter

Watch spend tick up as the agent works. Every model call's cost streams to the budget badge in real time — and daily, monthly, and per-session caps stop a run cleanly before it ever goes over.

Execution model

One conversation. Infinite context.

ClowdOps keeps the full picture in view — every instruction, every action taken, every result returned. The agent that starts your task is the same one that finishes it: nothing is handed off, no context is lost, no detail forgotten along the way.

Watch it work — live demos See real agent sessions replay step by step.
01
Full context, every turn

The agent reads your message alongside the entire conversation — previous actions, real tool outputs, and earlier replies. Context never degrades as the session grows.

02
Clarify before acting

For ambiguous requests the agent pauses and asks a single targeted question, then proceeds without further interruption once it has what it needs.

03
Execute directly

Actions run in an isolated environment with your credentials pre-loaded. The agent communicates directly with your cloud providers and reads the real output each time — no intermediary layers, no synthetic responses. Every action streams to you as it happens.

04
Adapt from real feedback

Every result — expected or not — becomes part of the agent's reasoning. When something unexpected happens, the agent reads it and adapts immediately, keeping the task on track without human intervention.

05
Answer with a full trace

Once the task is done, you get a clear structured response. The full audit trail — every command run, every output received — is saved so you always know exactly what happened.

Coding agents · MCP

Drive your cloud from any coding agent

Every sandbox speaks the Model Context Protocol. Connect your coding agent with a single command and prompt your cloud from inside your editor — it plans and executes against your infrastructure exactly as it does in the web chat.

Connect Claude Code, Cursor, Codex, or VS Code — paste one config block or run a single command
Per-sandbox access tokens (fba_…) — shown once, scoped to a single sandbox, revocable in one click
Same credentials, guardrails, confirmations, and budgets — MCP changes how you reach the agent, never what it's allowed to do
Sessions stream live and land in the sandbox's Chats tab with an MCP badge — fully auditable
MCP docs
claude ~/infra — clowdops
# ~/.claude.json · register the sandbox as an MCP server
$ claude mcp add --transport http clowdops \
    https://platform.clowdops.ai/mcp --header "Authorization: Bearer fba_3kQ…"
✓ connected  ·  clowdops  ·  6 tools  ·  sandbox "AWS Prod"

any S3 buckets in prod with public access?

⏺ clowdops · create_session
  ⎿ conversation_id  cnv_8f2a4c
⏺ clowdops · send_message
  ⎿ scanned 14 buckets · 2 public ⚠
     prod-assets-cdn · legacy-exports-2021
  ⎿ done · 1,842 tokens · $0.02 · audited in ClowdOps ↗

Notify & drive · Telegram

Telegram, both ways

From a single bot: the agent posts findings and run digests to your chat — and you can drive a sandbox by messaging it, with anything risky paused for an Allow / Deny tap.

Link, drive & get notified · all from one chat
ClowdOps Agent
bot · sandbox “GCP Prod”
Link a chat with a one-time /link code — no token pasted into Telegram; one bot per project, one chat per sandbox
Guarded actions pause for an Allow/Deny tap — same credentials, guardrails, confirmations, and budgets as the web app
Telegram sessions land in the sandbox's Chats tab with a Telegram badge — fully auditable
Telegram docs

Resource inventory

Your full infrastructure, organised and searchable

ClowdOps automatically discovers and catalogues every resource it encounters. Drill into any resource to see raw metadata, inbound and outbound dependencies, and blast-radius graphs.

Hierarchical tree: provider → account → region → type → resource
Instant search by name, ID, or resource type
Dependency graph for understanding connectivity and risk
Populate via chat: "discover all resources in us-east-1"
View docs
▾ AWS
▾ 123456789012 (prod)
▾ us-east-1
▾ EC2
i-0abc123 web-server-1
i-0def456 web-server-2
i-0ghi789 bastion (public)
▾ S3
prod-assets-cdn
legacy-exports-2021
terraform-state
▾ RDS
db-prod-postgres14
▾ Lambda
payments-handler
notifications-worker
▾ Azure
▾ sub-analytics (staging)
▾ eastus
▾ VMs
analytics-vm-01

Schedules

Automate your cloud ops on a schedule

Write a prompt, set a cron expression, and let ClowdOps run it automatically — no extra tooling, no YAML pipelines.

Hourly, daily, weekly, or any custom cron expression
Overlap protection — concurrent runs are automatically skipped
Post-run digest via Slack, Teams, PagerDuty, or email — on success, failure, or block
Schedules docs
Daily S3 Audit — Prod
// Schedule: 0 8 * * *  (every day at 08:00 UTC)
prompt:    "S3 Public Access Audit"
sandbox:  "AWS Prod"
status:   active

// Last run: today at 08:00 UTC
result:   2 buckets flagged
tokens:   1,842 used
duration: 14.3s
notify:   slack-ops-channel
send-on:  failure | blocked
Weekly Cost Report
// Schedule: 0 9 * * 1  (every Monday at 09:00 UTC)
prompt:    "Cross-Account Cost Summary"
sandbox:  "GCP Analytics"
status:   active
notify:   teams-finance
send-on:  always

Security

Built for teams that need to trust their tooling

ClowdOps is designed around the principle that credentials and access should be explicit, encrypted, and auditable at every layer.

Encrypted at rest

All credentials encrypted in storage. Never exposed in plaintext after creation — not in logs, not in UI.

Multi-factor auth

Time-based one-time passwords (TOTP) and one-time magic-link email add a strong, phishing-resistant second factor to every account.

Role-based access

Admin and Member roles. Members only see the projects and sandboxes they are explicitly invited to.

Activity audit log

Full event history: logins, config changes, credential updates, member invites, and agent runs.

Sandbox isolation

Each sandbox is a fully isolated execution context — credentials and runs don't bleed across boundaries.

Single sign-on

Sign in with Google, Microsoft, or GitHub — no extra passwords to manage, with access tied to your identity provider.

Guardrails

The agent is powerful.
You decide how far it goes.

Two independent controls govern every run: action grants determine what kind of change the agent can make, and cost caps determine how much it can spend. Neither can be exceeded — even by the agent itself.

Eight action categories — read, write, create, delete, destroy, modify IAM, change network, run on host. Grant only what each sandbox actually needs
Hierarchical inheritance: limits cascade from org → project → sandbox. A child scope can never be more permissive than its parent
In-chat confirmation: even for granted actions, the agent shows exactly what it's about to run — you approve, allow for the session, or deny with a note
Scheduled runs are unattended — confirmation becomes an automatic deny; each schedule carries its own minimal allowlist
Daily, monthly, and per-session cost caps: a budget-exceeded turn stops cleanly and reports what it completed before halting
Guardrails docs
Allowed actions — AWS Prod sandbox
Read (always on)
Write data
Create resource
Delete data
Destroy resource
Scale capacity
Modify IAM
Modify network
Confirm action
aws ec2 terminate-instances --instance-ids i-0abc123def456
Destroy resource · requires confirmation
Approve once
Allow session
Deny

Get started today

Talk to your cloud.
Finally.

Connect a cloud provider, describe a task, and watch the agent work. Request a demo and we'll get you set up.

Read the docs