Finout Power for Kiro
Connects Kiro to Finout, giving the agent your cloud cost tools plus guidance for using them well — spend breakdowns, cost anomalies, waste and rightsizing, budgets and forecasts, unit economics, and tag coverage across AWS, Azure, GCP, Kubernetes, and SaaS sources.
Built to the Agent Plugins 1.0.0 spec, so it also loads in other agents that implement the format.
Install
From GitHub — Kiro → Powers → Add Custom Power → Import power from GitHub:
https://github.com/finout-io/finout-kiro-power
From a local clone — clone this repo, then Add Custom Power → Import power from a folder and select it.
Installing copies the files into ~/.kiro/powers/installed/<power>/. Updates are not
automatic — re-import to pick up changes.
The power is named after its source, not after plugin.json. Installed from this repo
it is finout-kiro-power, and its MCP server is power-finout-kiro-power-finout; installed
from a local folder named finout it is finout. Tool calls appear as
@<power>/finout/<tool>.
Sign in
There is no API key to configure. The server advertises OAuth, and Kiro registers itself via Dynamic Client Registration.
The first connection needs a deliberate reconnect. Kiro's automatic connect at startup
registers a client but does not open a browser, so it fails once with
Failed to connect: Unauthorized and no sign-in prompt. Hit reconnect on the server in
the MCP Server view, or run /mcp auth — a browser tab opens for your normal Finout login.
This happens once per machine. The token is cached against the server URL, not the power name, so reinstalling or renaming the power reconnects silently and later installs pointing at the same endpoint need no sign-in.
| Symptom | Fix |
|---|---|
Unauthorized on first use, no browser | reconnect, or /mcp auth |
| Token expired or rejected | /mcp auth |
| Flow stuck waiting on the browser | /mcp cancel-auth, then /mcp auth |
| Wrong account signed in | /mcp logout, then /mcp auth |
Tools are scoped to the account of whoever signs in.
Verify
Ask Kiro a cost question — the power activates on keywords:
- "What did we spend on AWS last month, broken down by service?"
- "Why did our cloud bill jump recently?"
- "Where are we wasting money in Kubernetes?"
list_available_filters is the cheapest connectivity check: it needs no arguments and
lists your cost centers.
Layout
plugin.json manifest + activation keywords
mcp.json remote MCP server (streamable-http, OAuth)
skills/finout/
SKILL.md always loaded — routing table and hard constraints
references/ read on demand
connecting.md sign-in and auth troubleshooting
cost-analysis.md filter discovery, cost types, honest reporting
waste-and-anomalies.md waste funnel, anomalies, budgets
SKILL.md stays small on purpose — it is loaded on activation, and depth belongs in
references/, which the agent opens only when a task needs it.
Skills are not automatically in context when the tools are used. Observed behavior: for a plain cost question the agent calls the MCP tools directly and never activates the skill, so guidance here is onboarding and reference material — it does not constrain tool calls. Anything that must always hold belongs in the MCP tool descriptions themselves, which are always in context.
This power also ships no POWER.md and no steering files — those belong to the older
legacy power format. Kiro's install-time walkthrough may try readSteering and report a
missing file; that is harmless and the agent proceeds from the skill.
Self-hosted accounts
A dedicated Finout deployment uses a different MCP host. Change the url in mcp.json to
that host's /mcp endpoint; the OAuth flow is identical.
Support
If you need help with anything, please reach out to support@finout.io
Privacy Disclosure
Finout MCP processes cloud-cost data. Please see the Finout Privacy Policy at: https://www.finout.io/privacy-policy/