CostGuard
CostGuard audits your repos and cloud providers for CI and infrastructure cost
leaks. It is built for developers who run several projects across GitHub Actions,
Vercel, Supabase, Railway, Netlify, Neon, Cloudflare, and more, and want a single
command that surfaces what is being wasted and exactly how to fix it. On repositories that have never been
optimized, the static audit alone typically reduces CI spend by 60–80%.
Install
CostGuard installs three ways. The plugin paths are zero-build and zero-npm
(they ship a prebuilt, self-contained bundle); the npm package gives you the CLI
and the MCP server anywhere.
Claude Code
/plugin marketplace add mbanderas/costguard
/plugin install costguard@costguard
Adds /costguard-audit, /costguard-fix, /costguard-live, and the full
costguard skill (scan, providers, registry, report, digest). No build step, no
npm install.
Codex
codex plugin marketplace add mbanderas/costguard
codex plugin add costguard@costguard
Adds the bundled costguard skill to Codex CLI and Desktop.
npm / any MCP host
Run the MCP server directly — no install:
npx -y @costguard/costguard-mcp
Install the MCP server and the costguard CLI globally (both bins):
npm i -g @costguard/costguard-mcp
Run the CLI ad-hoc without installing:
npx -y -p @costguard/costguard-mcp costguard
npx -y @costguard/costguard-mcp launches the MCP server directly because the
package name matches its bin entry point — drop it straight into any MCP host's
server config.
Other CLIs / Desktop apps — one command drops a thin /costguard adapter
into Cursor, Gemini CLI, Cline, Windsurf, or a Codex project:
npx -y -p @costguard/costguard-mcp costguard install --target <host|auto>
--target auto detects the host; the adapter is no-clobber and idempotent. Run
costguard install --help for the full target list.
What it finds
Static half (zero credentials). Reads .github/workflows/*.yml and
application code to detect redundant CI triggers (push + pull_request on the
same branch), missing timeout-minutes, missing concurrency cancellation,
paths-ignore gaps that run CI on doc-only commits, and over-scheduled crons. No
API call, no token needed — always safe to run.
Billing half (read-only, opt-in). When a provider token is present,
reconciles live billed resources against a declared allowlist and flags
orphaned resources (billed but not listed) and over-provisioned resources
(larger or more capable than declared), each with a best-effort estimated monthly
cost. Covers thirteen providers: GitHub, Vercel, Supabase,
Railway, Netlify, Neon, Cloudflare, Fly, Render,
Sentry, Upstash, MongoDB Atlas, and Datadog.
Proof
Tested on production repositories. Patterns found and fixed across repositories
like my-app, web-app, and api-service:
- Redundant CI triggers. A workflow wired to both
push and pull_request
on the same branch runs CI twice per commit. Dropping the redundant trigger
halves runner-minute consumption for every push.
- Missing timeouts. Jobs without
timeout-minutes burn minutes up to
GitHub's 6-hour cap on hung runs. Adding a sane timeout is a one-line fix with
no functional impact.
- Missing concurrency cancellation. Without a
concurrency block, rapid
pushes queue up and run sequentially instead of cancelling superseded runs.
Adding cancel-in-progress: true eliminates the queue.
paths-ignore gaps. Workflows without paths-ignore for documentation
paths run full CI on commit-message and README edits. Excluding **.md and
docs/** removes a class of runs entirely.- Orphaned preview branches. A Supabase preview branch left running after a
feature ships keeps accruing compute cost each billing cycle.
