FinOps Agent — Getting Started
The FinOps Agent scans your cloud with read-only access, prices every finding from your real bill, and opens a dashboard with an AI analyst that knows your numbers. It runs on your own Windows machine. Your cloud credentials never leave it, and nothing is deployed into your cloud.
Included with CloudFinOpsKit Pro and Agency. You need two things from your members page: CloudFinOpsKit-Setup.exe and your licence (the members link itself works as the licence). Both are also in the "Your CloudFinOpsKit Pro/Agency plan" email we sent when you subscribed.
What you get
| Part | What it is |
|---|---|
| The FinOps Agent | One installer, one desktop shortcut. It runs the assessment for your cloud, then opens the dashboard and the AI analyst in your browser. This guide covers it. |
| The toolkits ZIP (optional) | The standalone one-click tools, guides, Excel dashboard packs, governance packs and prompt libraries for Azure, AWS and Google Cloud. Use them alongside the agent, or on machines where you don't install it. |
The agent and the standalone tools use the same assessment engines, so the numbers match. The agent adds the dashboard, the AI analyst and a one-launch workflow.
Before you start
- Windows 10 or 11. You don't need admin rights for the agent itself. Setup may ask once to install PowerShell 7 or a cloud CLI if they're missing.
- Read-only access to the cloud you want to scan:
| Cloud | Minimum access | For the full picture |
|---|---|---|
| Azure | Reader on the subscriptions (or management group) to scan |
Cost Management Reader (needed for saving figures from your real bill) and Monitoring Reader (utilisation) |
| AWS | ReadOnlyAccess |
Cost Explorer (ce:Get*), Cost Optimization Hub, Compute Optimizer, Budgets (budgets:Describe*) and CloudWatch read. Turn on Cost Explorer in the Billing console first; it's free and takes ~24h to show data |
| Google Cloud | roles/viewer + roles/recommender.viewer on the project |
roles/billing.viewer for budgets, and read access to your billing export in BigQuery for spend trends |
Every scan is read-only: nothing in your cloud is changed.
Step 1 — Install
- Download CloudFinOpsKit-Setup.exe from your members page (Step 1).
- Run it. Windows SmartScreen may show "Windows protected your PC". Click More info → Run anyway. (The installer isn't code-signed yet; this is expected.)
- Tick the clouds you use. Clouds whose command-line tool is already installed are pre-ticked.
- Paste your licence when asked: either the token from your members page or the whole members link. Leaving it blank still works, on the free analyst allowance, and you can add it later.
- A console window installs anything missing: PowerShell 7, and the Azure CLI, AWS CLI or Python + Google Cloud CLI for the clouds you ticked. Let it finish.
- Click Finish. Setup adds a CloudFinOpsKit FinOps Agent shortcut to your desktop and Start menu, and can launch it straight away.
Setup installs to %LOCALAPPDATA%\Programs\CloudFinOpsKit. To add a cloud or a licence later, just run Setup again: it remembers your previous answers.
Step 2 — Sign in to your cloud (read-only)
Sign-in happens on your machine, with the cloud provider's own tools. CloudFinOpsKit never sees your credentials.
| Cloud | How you sign in |
|---|---|
| Azure | Nothing to do in advance. On the first scan the agent opens the Microsoft sign-in, then asks you to pick the tenant and the scope to scan (whole tenant, management group, subscriptions or a resource group). |
| AWS | Sign in before you launch the agent. Open PowerShell and run aws configure (access keys) or aws sso login (IAM Identity Center). The agent uses your default profile; to use another, set AWS_PROFILE first. It scans all enabled regions. |
| Google Cloud | On the first scan the agent opens Google's sign-in in your browser (gcloud auth application-default login). It scans your default project. Choose it beforehand with gcloud config set project <your-project-id>. To scan several projects in one report, use the standalone GCP tool from the toolkits ZIP with --projects. |
Step 3 — Run your first scan
- Double-click CloudFinOpsKit FinOps Agent on your desktop.
- If you ticked more than one cloud, choose which one to scan this time.
- Answer the sign-in and scope prompts from Step 2. The scan then runs on its own. It typically takes a few minutes; very large estates take longer.
- When it finishes, your browser opens the dashboard at http://localhost:8787/dashboard.html.
Keep the console window open while you use the dashboard; it serves the page locally. Close it (or press Ctrl+C) when you're done.
To look at your results again later without re-scanning, use Start menu → CloudFinOpsKit → Re-open latest results.
Step 4 — Use the dashboard and the analyst
| Panel | What it shows |
|---|---|
| KPIs | Monthly spend, addressable savings and the number of findings. |
| FinOps Insights | A 0–100 maturity score (Crawl / Walk / Run) across visibility, allocation, rate, waste and governance, plus commitments and cost allocation. |
| Remediation plan | Your findings grouped into a payback-ordered plan: quick wins first, then the bigger levers, with the saving per step. |
| Findings table | Every finding with its priced saving. Filter, sort and search. Click one and choose Explain / fix this: why it's flagged, how to fix it, risk and effort. |
| FinOps Analyst (chat) | Ask anything about your results. It answers only from your findings and cites them. If something isn't in your data, it says so and doesn't guess. |
Good first questions to ask the analyst
- "What should I fix first this week, and why?"
- "Which savings are near-zero risk?"
- "Explain the biggest reservation or savings-plan opportunity."
- "Summarise this for my CFO in five bullet points."
- "Which findings would a change board need to approve?"
- "What's driving our maturity score down?"
- "Group the savings by owner or resource group."
The deterministic engine measures and prices everything; the AI only interprets those results. That's why every number in an answer traces back to a finding.
More than one cloud
Each launch scans one cloud. To see clouds side by side:
- Run the agent once for each cloud.
- In the dashboard, click Load data and add the
findings.v1.jsonandinsights.jsonfiles from the other cloud's output folder: - Azure:%LOCALAPPDATA%\Programs\CloudFinOpsKit\tools\AzureCostAssessment\output- AWS:%LOCALAPPDATA%\Programs\CloudFinOpsKit\tools\AwsCostAssessment\output- Google Cloud:%LOCALAPPDATA%\Programs\CloudFinOpsKit\tools\GcpCostAssessment\output
Cloud filters appear as soon as more than one cloud is loaded. A single unified multi-cloud scan is on the roadmap and will arrive as an update to your plan.
Your licence and the analyst allowance
Your plan includes the analyst's usage. It's metered in tokens and resets on the 1st of each month (UTC):
| Plan | Analyst allowance per month |
|---|---|
| No licence (free) | 100,000 tokens: enough to try it a handful of times |
| Pro | 2,000,000 tokens: plenty for a busy team's monthly review |
| Agency | 20,000,000 tokens |
The dashboard shows how much you've used. If you installed without a licence, either run Setup again and paste it, or open the dashboard's ⚙ Settings → License token and paste it there. Your licence is tied to your subscription and stops unlocking the allowance if the plan ends. Keep it private.
Your data
- Stays on your machine: your cloud credentials, and your raw cloud and billing data. The scan reads your cloud directly from your machine.
- Sent when you ask the analyst a question: your question plus the findings the analyst needs to answer it. That can be up to 400 finding rows, including resource names, subscription or account, location, saving and recommendation text. It goes through the CloudFinOpsKit gateway to the AI model (Anthropic Claude).
- What we keep: only a monthly token counter per licence. We don't store or log your findings, cost data or messages.
- Want nothing to leave at all? Open ⚙ Settings, paste your own Anthropic API key, and the dashboard calls Anthropic directly. Your findings then never reach CloudFinOpsKit. That usage is billed to your Anthropic account, not your plan.
Troubleshooting
| Problem | Fix |
|---|---|
| "Windows protected your PC" when running Setup | Click More info → Run anyway. Expected until the installer is code-signed. |
| "…not found" / a CLI or PowerShell 7 is missing | Start menu → CloudFinOpsKit → Repair CloudFinOpsKit setup re-installs the prerequisites. |
| AWS: "Not authenticated" | Run aws configure or aws sso login in PowerShell, then launch the agent again. |
| Azure: the scan finds 0 resources or $0 spend | Your sign-in has expired or lacks access. Run az login again and check you have Reader + Cost Management Reader on the scope. |
| Google Cloud: "no project specified" | Run gcloud config set project <your-project-id>, then launch again. |
| Savings show as list-price estimates | The billing source isn't available yet (Azure: Cost Management Reader; AWS: Cost Explorer turned on; GCP: billing export). The findings are still valid; the figures are marked as estimates. |
| The analyst says your allowance is used up | Add your licence (see above), or wait for the reset on the 1st. Agency has a higher allowance. |
| "Could not bind a local port" | The agent is already running in another window. Use that one, or close it and launch again. |
| The dashboard didn't open | Open http://localhost:8787/dashboard.html yourself while the console window is open. |
| Lost your members link or licence | It's in the "Your CloudFinOpsKit Pro/Agency plan" email we sent when you subscribed (from jeff-support@cloudfinopskit.com; check spam). Still stuck? Ask Jeff on cloudfinopskit.com. |
Getting help
- Ask Jeff, the assistant on cloudfinopskit.com, for set-up and product questions.
- Billing, receipts, refunds and cancelling: handled by Paddle, our Merchant of Record. Use the links in Paddle's receipt email.
Not subscribed yet? See what the FinOps Agent does · Plans