Skip to content

finout-io/finout

v0.1.0Apache-2.0

Query and analyze cloud costs with Finout — spend breakdowns, cost anomalies, waste and rightsizing recommendations, budgets and forecasts, unit economics, and tag coverage across AWS, Azure, GCP, Kubernetes, and SaaS.

Finout Power for Kiro

Connects Kiro to Finout, giving the agent your cloud cost tools plus guidance for using them well — spend breakdowns, cost anomalies, waste and rightsizing, budgets and forecasts, unit economics, and tag coverage across AWS, Azure, GCP, Kubernetes, and SaaS sources.

Built to the Agent Plugins 1.0.0 spec, so it also loads in other agents that implement the format.

Install

From GitHub — Kiro → PowersAdd Custom PowerImport power from GitHub:

https://github.com/finout-io/finout-kiro-power

From a local clone — clone this repo, then Add Custom PowerImport power from a folder and select it.

Installing copies the files into ~/.kiro/powers/installed/<power>/. Updates are not automatic — re-import to pick up changes.

The power is named after its source, not after plugin.json. Installed from this repo it is finout-kiro-power, and its MCP server is power-finout-kiro-power-finout; installed from a local folder named finout it is finout. Tool calls appear as @<power>/finout/<tool>.

Sign in

There is no API key to configure. The server advertises OAuth, and Kiro registers itself via Dynamic Client Registration.

The first connection needs a deliberate reconnect. Kiro's automatic connect at startup registers a client but does not open a browser, so it fails once with Failed to connect: Unauthorized and no sign-in prompt. Hit reconnect on the server in the MCP Server view, or run /mcp auth — a browser tab opens for your normal Finout login.

This happens once per machine. The token is cached against the server URL, not the power name, so reinstalling or renaming the power reconnects silently and later installs pointing at the same endpoint need no sign-in.

SymptomFix
Unauthorized on first use, no browserreconnect, or /mcp auth
Token expired or rejected/mcp auth
Flow stuck waiting on the browser/mcp cancel-auth, then /mcp auth
Wrong account signed in/mcp logout, then /mcp auth

Tools are scoped to the account of whoever signs in.

Verify

Ask Kiro a cost question — the power activates on keywords:

  • "What did we spend on AWS last month, broken down by service?"
  • "Why did our cloud bill jump recently?"
  • "Where are we wasting money in Kubernetes?"

list_available_filters is the cheapest connectivity check: it needs no arguments and lists your cost centers.

Layout

plugin.json           manifest + activation keywords
mcp.json              remote MCP server (streamable-http, OAuth)
skills/finout/
  SKILL.md            always loaded — routing table and hard constraints
  references/         read on demand
    connecting.md         sign-in and auth troubleshooting
    cost-analysis.md      filter discovery, cost types, honest reporting
    waste-and-anomalies.md  waste funnel, anomalies, budgets

SKILL.md stays small on purpose — it is loaded on activation, and depth belongs in references/, which the agent opens only when a task needs it.

Skills are not automatically in context when the tools are used. Observed behavior: for a plain cost question the agent calls the MCP tools directly and never activates the skill, so guidance here is onboarding and reference material — it does not constrain tool calls. Anything that must always hold belongs in the MCP tool descriptions themselves, which are always in context.

This power also ships no POWER.md and no steering files — those belong to the older legacy power format. Kiro's install-time walkthrough may try readSteering and report a missing file; that is harmless and the agent proceeds from the skill.

Self-hosted accounts

A dedicated Finout deployment uses a different MCP host. Change the url in mcp.json to that host's /mcp endpoint; the OAuth flow is identical.

Support

If you need help with anything, please reach out to support@finout.io

Privacy Disclosure

Finout MCP processes cloud-cost data. Please see the Finout Privacy Policy at: https://www.finout.io/privacy-policy/

License

Apache-2.0.