Spendsaw Spendsaw

Finds the waste. Opens the PR.

Spendsaw for AWS finds the idle resources in your accounts, prices each one from your own bill, and makes the cut the way your team already ships: an approval in Slack or a Terraform pull request. Then it checks the next bill to see what was saved.

Request early access Run the free MCP server

Pre-launch. The code is built and tested against mocked AWS, and live validation in our own organization comes next. The trust page says what is proven and what is not.

Remove unused Elastic IP aws_eip.nat_spare

Open#212 opened by Spendsawinto main from cost-agent/f-3a9c51d07be248a6

infra/network.tf7 lines removed
terraform plan, run by your CI0 to add, 0 to change, 1 to destroy
Plan check: only aws_eip.nat_spare changes$3.65/mo us-east-2
Illustrative example. The edit is a deterministic text change made by code; the model writes none of it.

One cut, from found to verified

A dashboard shows you the idle NAT gateway and leaves the ticket to you. Spendsaw is for dev agencies and small MSPs that run AWS without a FinOps person, so it carries each cut through to a merged change and a line on the bill.

  1. 1 of 4

    Found

    A read-only role scans more than 25 resource types across every enabled region and account. Each result is a typed finding: the resource, what it costs, the evidence, and who owns it.

    Cost Optimization Hub and Compute Optimizer recommendations are merged in and de-duplicated, so you see a superset of what AWS already tells you.

    Elastic IP not associated

    Low risk

    Managed in Terraform, so the fix is a pull request that removes the resource block.

    $3.65/mo eipalloc-0f3e91a2c4 · us-east-2 · infra/network.tf
    Open PR Snooze 7 days
    A finding card. Illustrative example.
  2. 2 of 4

    Priced

    Every amount says where it came from. When your Cost and Usage Report is connected, the billed cost of that specific resource replaces the list price, discounts included.

    Estimates read "about $47/mo". "Verified savings" is kept for amounts confirmed against the bill.

    Cost sourceWhat the number is
    curBilled cost of the resource from your Cost and Usage Report
    list_pricePrice List API rate for the resource's own region
    aws_recommendationEstimate supplied by an AWS recommendation service
    fallback_list_priceBuilt-in rate table, used when the Price List API cannot be reached
  3. 3 of 4

    Approved in Slack, or merged as a PR

    Ownership decides the route. A Terraform-managed resource gets a pull request, because a CLI delete would come back on the next apply. A click-ops resource gets a reviewed command that a named person approves. If ownership is unknown, it stays a recommendation.

    The Slack message shows the exact commands that approving will run. Nothing else runs.

    SpendsawAppMon 9:00

    3 new cuts in prod-agency, worth about $47/mo.

    Unattached 100 GB gp2 volume, idle 41 days: $10/mo. Snapshot first, then delete? vol-0a1b2c3d4e5f · us-east-1 
    aws ec2 create-snapshot --volume-id vol-0a1b2c3d4e5f --region us-east-1
aws ec2 delete-volume --volume-id vol-0a1b2c3d4e5f --region us-east-1
    ApproveSnooze 7 days

    Verified savings since August: $1,318 · 2 more in the console

    The weekly digest. Illustrative example; commands shortened. The real app uses Slack's own components.
  4. 4 of 4

    Verified against the bill

    Each cut records what the resource cost before. A monthly job compares that with the Cost and Usage Report, counting only full months after the change, so a partial month never inflates the number.

    That verified figure is what the digest and the monthly report lead with.

    Savings ledgerprod-agency · Oct 2026
    $1,318 Verified savings since Aug 2026
    $47/mo About this much in 3 open cuts
    ResourceCut madeExpectedOn the bill
    eipalloc-0f3e91a2c4PR merged, Sep 3$3.65/mo$3.65 verified
    vol-0a1b2c3d4e5fApproved in Slack, Oct 12$10.00/moWaiting for a full month
    Illustrative example of the ledger behind the monthly report.

The safety model

The risk in this product is a deleted resource somebody needed. These are the rules the code enforces to prevent that.

  • Commands come from templates, never from the model

    One reviewed template per waste type, rendered from validated identifiers only. The model explains findings in plain English; code decides their order. Anything command-like in its output is removed before you see it.

  • Keep tags are checked twice

    A resource tagged Keep=true, or listed in your allow-list, is left out of findings and remediation. The tag is read again from live AWS immediately before an approved action runs, and the write role denies actions on keep-tagged resources in IAM.

  • Backups first

    Deleting an unattached volume takes a snapshot and waits for it to complete before the delete. A medium-risk action with no possible backup needs an explicit acknowledgement that it cannot be undone.

  • High-risk cuts are never executable

    Low risk and Medium risk actions run after approval. High risk findings (RDS, NAT gateways, load balancers, stopped instances) are recommendations only. The command is shown for reference and there is no button.

  • A named person approves the exact commands

    The approval records who approved, when, and the command text. At run time the plan is rendered again and must match what was approved. An approval expires after 72 hours.

  • Reading and writing use separate roles

    Scanning uses a role that can read metadata and metrics only. Changes use a second role that you deploy only in the accounts where you want remediation, and never in the management account.

Read the exact IAM permissions on the trust page

See what is spending on Amazon Bedrock

The bill shows Bedrock by model, not by the service that called it. Spendsaw reads tokens per model from CloudWatch and billed cost from Cost Explorer, then works out which Lambda functions and ECS services hold Bedrock permissions.

The report shows tokens and cost by model and by caller, and labels every number as billed, estimated or allocated. AWS does not record which function made a call, so a caller's share is allocated from its own activity, and the report says so.

Bedrock spend, last 30 daysprod-agency · us-east-1
ModelInput tokensOutput tokensCostBasis
anthropic.claude-3-5-haiku12.6M3.1M$22.48Billed
amazon.nova-lite-v1:041.2M6.8M$4.10Billed
CallerTypeCostBasis
ticket-summarizerLambda$16.21Allocated
intake-apiECS service$10.37Allocated
A section of the monthly report. Illustrative example.

Start free, on your own laptop

spendsaw-mcp is a local, read-only MCP server for Claude Desktop, Claude Code and Cursor. It scans with your own AWS profile, prices what it finds, and answers inside the assistant you already use.

There is no hosted backend, no account to create, and the server makes no model call of its own. It never changes anything in AWS: it prints the commands for you to review and run.

Read the quickstart

Terminal
# add the server to Claude Code
claude mcp add spendsaw \
  --env AWS_PROFILE=default \
  --env AWS_REGIONS=us-east-1 \
  -- uvx spendsaw-mcp

# then ask
What are my top 5 savings?
ToolReturns
list_findingsFindings, largest monthly saving first
explain_findingEvidence, cost and its source, risk tier, and the commands to fix it
get_costsBilled cost by service, account, region or usage type
bedrock_usageBedrock tokens by model, billed cost, and which services can call it

Pricing

Draft early-access pricing. These numbers come from our build plan and may change before launch. Billing is not live yet, and design partners use Spendsaw free during the pilot.

Free

$0

For solo developers.

  • Local MCP server, spendsaw-mcp
  • Read-only findings with real prices
  • CLI commands to review and run yourself

Read the quickstart

Team

$49 per month, draft

For agencies with 5–20 developers.

  • Hosted scans
  • Slack digest and approvals
  • Terraform pull requests
  • Up to 3 AWS accounts

MSP

$15 per managed account per month, draft

For IT consultants and small MSPs.

  • Everything in Team
  • White-label monthly reports
  • A separate tenant per client

Become a design partner

We are onboarding 3 to 5 design partners before any public launch: dev agencies and small MSPs running AWS without a FinOps person.

Request early access Read the trust page
  • Free for 60 days, in exchange for weekly feedback and, if it goes well, a case study.
  • You deploy one CloudFormation stack per account for the read-only role. The write role is optional and separate.
  • Nothing is changed in your account without an approval from a person you name.
  • Write to hello@spendsaw.com with how many AWS accounts you run and whether they are in Terraform.