TOOLS
Do the Groundwork.
One kit, wired together, for the teams who want it running today. Twenty-nine FinOps tools, free and open source.
These are the working parts behind the platforms in my case studies, rebuilt generically: no client code, no client data, every rule carrying the reasoning and the measurement that earned it. Written to be read by your AI agent and deployed quickly by you.
Two Ways In
FinOps Skills Library
29 tools · 197 tests · open source
Standalone command-line tools for AWS, Azure, and GCP. Each one states its data contract, its assumptions, its non-goals, and why every rule exists. Take one, take all of them, fork whatever you like.
Python 3.11 or newer. No account, no signup, no telemetry.
Groundwork
The FinOps Pipeline + Grounded Agent Kit
The parts wired together: raw billing export to a rendered executive brief in one command, plus an agent over your cost data that cannot make numbers up. Running on day one instead of week six.
Delivered as access to a private GitHub repository.
Sold as-is: no updates, no support, no SLA.
Inside Groundwork
Wiring free tools into something a finance director will actually read takes longer than downloading them, and the wiring is the easy half. What takes the time is the logic inside it.
Components
7 in the kitEach states its data contract, its assumptions, and its non-goals.Chains normalize, showback, anomaly detection, waste classification, the executive brief, and rendering into a single command against AWS, Azure, GCP, or a mix. Configuration is one JSON file: point it at your export, name your mapping, run it. Every tool the plan needs is checked to exist before stage one starts.
Why It Matters: failing at stage four with half the outputs written is how partial numbers escape into decks. State is the output files themselves, so a rerun resumes exactly where it stopped, and what has run is visible in the folder rather than buried in a database.
Grades every optimization action against settled billing days and puts it in one of four states: claimed when nothing has settled yet, realizing while it holds but has not run long enough, realized once it has, and not holding with the offending days listed by date when spend climbs back.
Why It Matters: recent billing days restate, so a saving proven on unsettled days can unprove itself by Friday. The claim stays badged estimated and the realized figure is badged billing, because they are different kinds of number, and merging them is how optimization programs lose finance for good.
Grades each owner across five weighted categories: tag attribution, waste share, budget predictability, anomaly stability, and in-period momentum. The formula behind every score is printed beside it, and the weights are yours to recalibrate.
Why It Matters: a grade nobody can interrogate is a grade nobody acts on. Completed periods only, because a mid-month grade moves with the calendar rather than behavior. Shared spend is redistributed pro-rata instead of quietly ignored, and an owner with no budget skips that category with the weights renormalized and stated, rather than being scored zero for your configuration gap.
A working agent loop over the pipeline's outputs with a three-layer guard stack: prompt rules that forbid arithmetic, a fabrication guard for figures stated when no tool ran or every tool failed, and a grounding guard that traces every dollar and percent in the reply back to something a tool actually returned. Provider seam for Anthropic, Bedrock, and Vertex, plus a scripted provider that lets the guards be tested against a deliberately lying model.
Why It Matters: the dangerous failure is not a crash, it is a fabricated figure sitting beside successful tool calls in confident prose. Corrections quote the figure exactly as the model wrote it, because telling a model that 150000.0 is untraceable sends it hunting for a string it never produced. When a figure cannot be repaired, the answer ships with a visible disclosure instead of a silent deletion.
A deterministic FOCUS-shaped multi-cloud dataset with defects planted on purpose: a spend spike, idle resources, orphaned storage, old-generation SKUs, untagged resources, and owner tags misspelled four different ways. A ground-truth file records exactly what was planted and where.
Why It Matters: you are not asked to trust the pipeline, you watch it find defects you already know are there. Every component demonstrates itself before touching your real billing, and you can hand a colleague a runnable example without exposing a single real dollar.
Tests that read your real configuration and fail when your copy stops matching its source: vendored files compared byte for byte, mappings and tools verified to exist before a pipeline references them, and an allowlist where every accepted divergence must carry a written reason.
Why It Matters: you will fork this, and the fork will drift. The harness turns that from a silent problem into a failing test, on the rule that a skipped parity test proves nothing, so zero skips is the only green that counts.
One walkthrough each for AWS, Azure, and GCP, from pulling the export through the rendered brief, plus a single command that runs the whole kit against the synthetic data and reports whether it found the planted defects. A documentation test fails the build if a walkthrough ever names a file that no longer exists.
Why It Matters: the three walkthroughs are deliberately the same chain with a different collector and mapping. That symmetry is the FOCUS boundary doing its job, and it is what makes adding your fourth data source an afternoon rather than a project.
Everything runs locally. The only outbound calls are the collectors reading your own cloud accounts and, if you run the agent, your own LLM provider with your own key. No telemetry, in the kit or the free tools.
All 29 Free Tools
Pulling a bill out of a cloud is specific to that cloud, and so is acting on what you find. Everything in between is not, because FOCUS, the open billing-data standard, gives every cloud's bill the same column names. Normalize once, and the same tool works on AWS, Azure, GCP, or all three at once. Every tool below is free under Apache-2.0: no signup, no telemetry.
Collectors
5 toolsGetting the export out correctly, where most pipelines go wrong.Normalizers
3 toolsThe spine. Everything downstream reads FOCUS and nothing else.Analyzers
10 toolsCloud-agnostic: they read FOCUS, so the cloud stops mattering.Assurance
3 toolsThe difference between a number you present and a number you can defend.Actuators
4 toolsRead-only, enforced in code. Fix commands are printed, never run.Output, Methodology & Enforcement
4 toolsGetting it in front of people, and keeping an agent honest.Every figure these produce is badged billing or estimated, and every recovery rate is a stated, overridable assumption. That distinction is most of what separates a defensible savings number from a deck.
Before You Buy
Q1What does "finished product" actually mean?
You get Groundwork in the condition it is in on your purchase date, with a perpetual license. No updates, no support, no SLA, and no promise that it will still match a cloud provider's export format two years from now. Adapting and maintaining it is your job. It is built to make that job tractable, which is why every component states its data contract, assumptions, non-goals, and reasoning, but the work is yours. If that is not what you want, take the free library instead and build at your own pace.
Q2Can I use it for client work?
Yes, and that is an intended use. Delivering consulting work with it is explicitly permitted. Handing your client the kit itself is redistribution and is not; they buy their own license.
Q3How is it delivered?
As access to a private GitHub repository, so you get the full tree, the history, and the ability to fork it into your own environment. You will need a GitHub account, and the invite arrives after checkout.
Q4Does any of my billing data leave my machine?
No. Everything runs locally against files you already have. The only outbound calls are the collectors reading your own cloud accounts and, if you choose to run the agent, your own LLM provider using your own API key. There is no telemetry, in the free tools or the kit.
Q5What do I need to run it?
Python 3.11 or newer and git. Cloud CLI tools only if you use the live collectors; every collector also prints the exact commands so you can run them with no access at all. The synthetic dataset means you can evaluate the whole thing without touching a cloud account.
Q6Why is the library free if the kit is not?
The tools are useful on their own, and gating them would be pointless when the value is in the wiring, the calibration, and an agent whose numbers you can trust. That is what Groundwork is, and it is where the hundreds of hours went.
Contact
Questions about the tools, or about the work behind them: see the practice →