TomorrowCentral for agents

It reads an AWS account through a cross-account role you create, inspects resource metadata and CloudWatch metrics, and reports resources that look idle, unattached, or underused. Each finding carries the evidence it was based on: what was measured and over what window (30 days by default), an advisory verdict (removable, investigate, keep), a heuristic confidence from 0 to 1, est_monthly_savings in USD, and monitoring_gaps naming what could not be observed.

Verdicts are advice for a person to act on. A verdict of removable means the evidence suggests nothing is using the resource, not that deleting it is safe, and a finding marked protected (covered by a retention tag or policy) is not actionable at all.

• It cannot create, modify, stop, terminate or delete any AWS resource. There is no such tool on this server, and the role you grant carries no write permission.
• It does not read secret values, object contents, or application data.
• It does not cover every AWS service. Anything outside the list below is not inspected, so a clean scan is not a claim that your whole bill is optimized.
• It is AWS only today. Azure and GCP are not supported. The tools are named for the capability rather than the cloud, so when another provider is added it appears on the same tools with a connection of that type, and create_cloud_connection refuses any provider it cannot actually scan rather than linking it as AWS.

Ten tools, one workflow. The read-only column refers to TomorrowCentral state: every tool here is read-only against AWS, including the three that write on our side.

claude mcp add --transport http tomorrowcentral \
  https://api.tomorrowcentral.com/mcp \
  --header "X-Api-Key: tc_sk_your_key_here"

Create the key first at /dashboard/api-keys. It is shown once. A key can be scoped to specific tools and specific linked accounts, given an expiry, and revoked at any time.

Any client that speaks Streamable HTTP and can send a header:

{
  "mcpServers": {
    "tomorrowcentral": {
      "type": "http",
      "url": "https://api.tomorrowcentral.com/mcp",
      "headers": {
        "X-Api-Key": "tc_sk_your_key_here"
      }
    }
  }
}

A local stdio alternative exists for development (python -m mcp_server with TC_API_KEY and TC_API_BASE_URL set), but the hosted endpoint above is the supported path.

You run a CloudFormation template we generate. It creates one role, tomorrow-central-cost-readonly, that our platform account can assume, gated by an ExternalId unique to your connection. No access key is created, and nothing is copied by hand. Revoking access means deleting that stack.

Every action is a List, Describe or Get. There is no Create, Modify, Delete or Terminate anywhere in the policy, which is what makes the read-only guarantee checkable rather than a promise.

• Analyze my AWS account for infrastructure that appears unused or underutilized. Rank findings by confidence and estimated monthly cost. Do not make any changes.
• Review my AWS infrastructure for probable cost waste. For every recommendation, show the usage evidence and the observation period behind it.
• Which resources have high-confidence evidence of inactivity, and which ones merely have low utilization? Keep those two lists separate.
• Run a cost scan, then summarize only the findings the scanner could not fully observe, and say what monitoring is missing.

Scans are asynchronous. Start one, then poll get_job roughly every 10 seconds; the response carries poll_after_seconds as the minimum wait. A scan usually finishes in 1 to 3 minutes.

Free plan

10 scans per month, per account.

Per API key

5 scan jobs per day. 20 reads and 5 writes per minute.

Duplicate scans

Starting a scan for a connection that already has one in flight returns the running job with coalesced: true, and consumes nothing.

Repeat scans

A key re-scanning the same account inside 6 hours gets the existing result rather than a new run.

Retries

Errors carry a stable error_code. Rate limits carry Retry-After and retry_after_seconds. Send an Idempotency-Key on writes if you may retry: replaying returns the original job rather than starting a second one.

• Read-only against your cloud. Enforced twice: no tool on this server mutates anything, and the role you grant has no write permission.
• No stored cloud credentials. We assume your role for short-lived access per scan. Nothing long-lived is kept.
• Tenant isolation. An API key sees only its own tenant's connections, jobs and results, and can be narrowed further to named tools and named accounts.
• Scan output is treated as untrusted. Resource names and tags are written by whoever owns the account, so results come back inside a labelled envelope telling the model to treat them as data, never as instructions.
• MCP calls are recorded. Calls to the hosted endpoint are logged for product analytics, including the JSON-RPC request body (tool name and arguments, capped at 16 KB), the outcome and the latency, kept for 90 days. Scan results and API keys are never written to that log. Use the local stdio server if you would rather not send request bodies to us.
• Revoking. Revoke a key at /dashboard/api-keys (immediate), and remove our AWS access by deleting the CloudFormation stack in your account.

Details in the privacy policy and terms.

Reporting a vulnerability: use itmtb.com/contact-us and mark it as a security report. Include what you did, what you observed, and what is needed to reproduce it. Please do not test against other tenants' data or run denial-of-service traffic at the API.

Cloud Cost Sentinel is free to use today, capped at the limits above. Agent traffic is metered the same way human traffic is, against the same account. There is no paid tier for machine access yet; when there is, it will be published here before it applies.

Questions, a broken scan, or a resource type you want covered: contact us or reach itmtb Technologies at itmtb.com/contact-us.