Connect AWS and Azure read-only and Cloud Sleuth draws a live map of everything you run, works out who owns each resource even when it isn't tagged, and shows what's safe to remove. Ask it in SQL, plain English or from your AI agent.
One read-only command Unlimited resources Free CLI, flat-priced Cloud
01 / question
An owner on every resource: from tags where they exist, inferred from who created it, the IaC that manages it and how it's named where they don't, with a confidence score.
02 / question
A live map of everything you run, scoped to a team, service or VPC, so you see what a resource supports before anyone touches it.
03 / question
Last activity, dependencies and owner sign-off in one place, then a cleanup plan that snapshots first and can be undone.
The product
Diagrams, inventory, ownership, cleanup, allocation and guardrails usually live in four or five tools. Cloud Sleuth puts them on one live inventory, so every view knows whose resource it is and what depends on it.
01 / live cloud map
Generated from your real AWS and Azure accounts and kept up to date. Filter to one team, service, account or VPC instead of a hairball of every resource, see what changed since last week, and export to draw.io, Mermaid, SVG or PNG.
02 / owners on autopilot
Uses tags where they exist and infers the rest from who created the resource, the IaC that manages it, its name and its neighbors, with a confidence score the owner confirms in one click.
03 / safe cleanup
Evidence, owner sign-off, a snapshot and an undo window before anything is removed.
04 / search
# illustrative select name, cloud, monthly_cost from resources where owner is null and monthly_cost > 100;
One schema across AWS and Azure. Ask in SQL or plain English, save the view, export it anywhere.
05 / allocation
# illustrative virtual_tag: team rules: - match: { name: "etl-*" } value: data default: owner
Put every dollar on a team, even where tags are missing or can't exist, and watch the unallocated number shrink.
06 / guardrails
# illustrative policy: require-owner when: owner is missing route_to: account owner notify: weekly digest exceptions: expire in 30d
Built-in checks plus your own policies, including Cloud Custodian ones. Quiet by default, sent to whoever can act.
Built against the complaints
These are the themes that keep coming up in G2 reviews of cloud diagram, inventory, FinOps and governance tools. Each one shaped a decision in Cloud Sleuth.
What reviewers say
What Cloud Sleuth does
Reviewers say: Expensive, and priced per resource
Cloud Sleuth: One flat price with unlimited resources and users. The CLI is free with no resource cap.
Reviewers say: A steep learning curve and slow setup across many accounts
Cloud Sleuth: One read-only command and no YAML to start. Built to show a map and owners in minutes, not after a rollout project.
Reviewers say: Diagrams get cluttered and laggy with thousands of resources
Cloud Sleuth: Maps scoped to a team, service, account or VPC, so you see the 40 boxes that matter instead of all 4,000.
Reviewers say: "Only visualisation does not help"
Cloud Sleuth: Every box has an owner, a cost and a next step, and the next step goes to that owner in Slack or Jira.
Reviewers say: AWS first, everything else later
Cloud Sleuth: AWS and Azure at parity from day one, in one schema. GCP and Kubernetes are next.
Reviewers say: Noisy alerts that nobody owns
Cloud Sleuth: Findings go to the resource's owner in a weekly digest by default. Exceptions expire instead of piling up.
Reviewers say: Hard to get a simple inventory report out
Cloud Sleuth: Ask in SQL or plain English, save the view, and export to CSV, an API, draw.io or Mermaid.
Reviewers say: Automation that changes things without telling you
Cloud Sleuth: Read-only by default. Every change is previewed, explained, approved by the owner and reversible.
Themes from G2 reviews, October 2026. Cloud Sleuth is pre-launch, so the right-hand column describes what we're building.
Safe cleanup
Cost tools say a resource looks idle. Cloud Sleuth shows the evidence, asks the owner in Slack and runs a plan that snapshots first and can be undone, so cleanup never turns into an outage, or another ignored alert.
team-data · 92% confidence
created by the terraform role from repo data-pipelines · name etl-*
Nothing, for 61 days
no inbound connections · 1 attached volume · not in any IaC state
Yes, once the owner confirms
idle · $412/mo · no exceptions on file
→ sent to #team-data for one-click approval
For AI agents · MCP
Agents can already call cloud APIs. What they can't see is who owns a resource and what breaks if it changes. The Cloud Sleuth MCP server gives Claude, Cursor and your own agents read-only answers before they act.
who_owns Owner, evidence and confidence for any resource blast_radius What depends on a resource, and who those owners are find_unowned Resources with no owner, filtered by cost, age or account query_inventory SQL over AWS and Azure in one schema Clean up the staging network. Can I delete vpc shared-egress?
tool blast_radius("vpc shared-egress")
owner platform (tag) · used by 3 teams · 2 NAT gateways · 14 ENIs · managed by terraform infra-core
agent
No. It belongs to the platform team, and payments, data and CI
all route egress through it. I've left it alone and drafted a
message to #platform instead.
How it works
The Cloud Sleuth CLI is a single binary or Docker image. Point it at your AWS accounts and Azure subscriptions with read-only credentials. No agents, no YAML, and nothing leaves your machine.
A live map of everything you run, an owner on every resource (from tags, or inferred with a confidence score) and a short list of what's safe to remove, with the evidence.
Connect Slack or Jira and each team gets its own findings, a one-click confirm and a cleanup plan it can undo. Unlimited users at one flat price.
Pricing
Tools that charge per resource or per dollar of spend get more expensive exactly when your estate gets messier. Cloud Sleuth doesn't.
Free forever
For an engineer and their own accounts. Runs on your machine, and nothing leaves it.
Get early access$399 per month, flat
For the whole team and every account, with nothing to install.
Get early accessCustom annual
For regulated estates and large organizations.
Talk to usPlanned launch pricing. Both editions are in development, and prices may change before launch.
Who it's for
Companies spending roughly $50k to $2M+ a month on cloud, where one person or a small platform team owns cost, native tools and spreadsheets have run out of road, and enterprise FinOps platforms feel too heavy.
Needs
Understand the estate, enforce standards, reduce ownership ambiguity
Gets
A live map, SQL over the whole estate and guardrails that route to owners
Needs
Allocate 100% of spend and drive accountability
Gets
Inferred owners, virtual tags, shared-cost allocation and a shrinking unallocated number
Needs
See what their team owns and what is safe to clean up
Gets
A map of just their team's resources and a cleanup plan they can approve and undo
Needs
Trustworthy showback and chargeback
Gets
Showback and chargeback tied to owners people have confirmed, at a flat price
Case studies
Idle VMs, abandoned databases and storage nobody was accountable for, and how each one was found and resolved.
$9k/month cut from a $30k/month Azure subscription.
An anonymized case study: 89 Azure VMs left over from an acquisition ran at near-zero CPU for six months, costing a technology startup $18,400 a month. How they were found, verified and removed.
An anonymized case study: seven Azure SQL databases left behind after a migration cost a financial services company $12,600 a month. How they were verified as unused and removed without risk to production.
An anonymized case study: 23.2 TB of S3 data had gone untouched for more than two years, and much of it had no clear owner. How access analysis and owner interviews moved it to Glacier Deep Archive without deleting a file.