API keys & AI assistants (MCP)

Create API keys and connect Claude Desktop, Cursor or Claude Code to your cost data.

API keys & AI assistants (MCP)

Create a key so an AI assistant such as Claude Desktop, Cursor, Claude Code or Windsurf can ask CostGlass questions about your cloud costs.

Where in CostGlassSettings → API Keys

PlanAll plans

Who can do thisOwner and Admin create and revoke keys

Time needed10 minutes

In short

An API key is a secret that lets a program act as the person who created it. It starts with cg_live_.
The full key is shown once, when you create it. CostGlass stores only a fingerprint, so a lost key cannot be recovered; revoke it and make a new one.
The page offers one scope, read, but see the warning below: a key acts with its creator's role.
The MCP (Model Context Protocol) connection gives an AI assistant seven read-only tools, two resources and two ready-made prompts.

Before you begin

You are an Owner or Admin.
Some cost data is already connected, otherwise the assistant has nothing to answer from.
An AI assistant that supports MCP servers.

Create a key

Open the page

Choose Settings, then API Keys. The page is titled API Keys & MCP Access and lists existing keys with Name / Label, Key Prefix, Scopes, Created, Last Used and Expires.

Start

Click Generate New API Key.

Name it

Give it a label that says where it will be used, for example Cursor IDE, Claude Desktop or CI/CD.

Choose an expiry

Pick 30 days, 90 days (Recommended), 180 days, 1 year or No expiration.

Copy the key now

The key appears once with the warning Save this key now!. Copy it into your password manager. A ready-made configuration snippet is shown alongside it.

Important

If you lose the key you cannot see it again. Revoke it and create a new one.

Revoke a key

In the key's row use the revoke action and confirm. The key stops working immediately for everything that uses it, and it disappears from the list. Revoke a key when a laptop is lost, a person leaves, or you are unsure who has seen it. Only Owners and Admins can revoke.

What a key can do (read this)

A key is as powerful as the person who made it

The scope field is stored, but today it is not enforced by the server. A key acts with the role of the person who created it, on the whole CostGlass API, not only on the assistant tools. If an Owner creates it, it has Owner rights.
A key is not narrowed by hierarchy scope. The assistant tools read the whole organisation even if the creator is limited to one node.
If the creator is removed or disabled, the key stops working.

Good practice

Create keys for a dedicated, least-privileged person where possible (a Member who is not scoped), not an Owner.
Use short expiries and one key per tool or machine, so you can revoke one without affecting the rest.
Never paste a key into chat, tickets or source control. Keep it in the assistant's environment settings.
Check Last Used regularly and revoke keys you do not recognise.
Remember that what the assistant reads is sent to the AI provider that runs the assistant. Only connect assistants your company has approved.

Note

Creating and revoking keys is not currently written to the audit log.

Connect your assistant

Replace the key placeholder with your key. The API address below is the UK region's. If your organisation is in another region, use your region's API address instead; ask support if you are unsure.

Claude Desktop and Cursor (local server)

Add this to claude_desktop_config.json (Claude Desktop) or .cursor/mcp.json (Cursor). The path points at the CostGlass MCP server script you have installed.

MCP configuration

Claude Code

Terminal

Remote connection (no local install)

For assistants that can talk to a remote MCP server over HTTP:

Remote MCP

Restart the assistant. Ask it "What were our top five cloud spenders this month?" to test.

What the assistant can use

Tool	What it does
`costglass_query_costs`	Spend grouped by service, region or account, over a time range (for example current month, last 30 days, year to date), daily or monthly, with optional filters and cost basis (unblended or amortized). The provider filter accepts aws, azure and gcp.
`costglass_get_anomalies`	Cost anomalies, filterable by status, severity and provider.
`costglass_get_savings_recommendations`	Savings opportunities, optionally above a minimum monthly saving.
`costglass_get_kubernetes_costs`	Kubernetes cluster spend, namespace allocation, idle capacity and pod rightsizing.
`costglass_get_budgets`	Budgets, limits and current spend.
`costglass_get_connected_accounts`	Connected accounts and their sync status.
`costglass_get_cost_filters`	The services, regions, accounts and tag dimensions that exist, so the assistant uses valid names.

Two resources are available, costglass://summary/current-month and costglass://anomalies/active, and two prompts: /finops_audit (a broad review of spend, anomalies and waste) and /investigate_cost_spike (step-by-step triage of a sudden rise). All of these only read data. They do not change anything in CostGlass or in your clouds.

Frequently asked questions

I get "Invalid API key" or "API key has expired".

The key was revoked, mistyped or has passed its expiry. Create a new one.

Can a Member create a key?

No. Only Owners and Admins can create and revoke keys.

Can I limit a key to certain accounts?

Not today. Keys read the whole organisation.

Does the assistant change my cloud?

No. CostGlass tools are read-only and CostGlass does not modify your clouds through them.

All Documentation Guides

Welcome to CostGlass — What CostGlass does, who it is for, how your data gets in, the plans and regions, and a plain-English glossary.
Quickstart: your first hour — Sign up, connect a first cloud, invite your team, set a budget and turn on anomaly alerts, with a first-week checklist.
Finding your way around — A tour of the sidebar, top bar and page controls: what every page answers, plan gating, currency, language, links and caching.
Dashboards — The Overview dashboard widget by widget, plus building custom dashboards you can share with your organisation.
Cloud Resources — The multi-cloud inventory: filters, search, categories, estimated cost, terminated resources and CSV or Excel export.
Uptime, incidents & support requests — Monitor public endpoints, route alerts, see incidents and raise requests to CostGlass engineers.
How CostGlass accesses your data — Security and data ingestion architecture: how CostGlass reads multi-cloud billing and telemetry through read-only roles and least-privilege permissions.
Dashboard & Platform Screenshot Tour — Visual walkthrough of the CostGlass interface with screenshots covering multi-cloud spend, Cost Explorer, anomalies, Kubernetes allocation, and savings.
Connecting your clouds: overview — Every cloud and service you can connect, how each one connects, what access it needs, how long data takes and your plan limits.
Connect AWS (CloudFormation) — Deploy the generated CloudFormation template, choose organization or single account and optional features, then verify.
Connect AWS with Terraform instead of CloudFormation — A Terraform equivalent of the generated AWS template, with an Organization variant and a way to compare it to the wizard.
Connect Azure — Admin consent for the CostGlass application, Reader and Cost Management Reader roles, management group or subscription scope, and a Terraform version.
Connect Google Cloud — Enable the FOCUS BigQuery export, run the IAM grants CostGlass prints, verify, and a Terraform version.
Managing connected accounts — The Cloud Accounts page: statuses, syncing, errors, naming, disconnecting, and the FOCUS 1.0 and CUR Export pages.
Connect Oracle Cloud (OCI) — Give CostGlass read-only access to Oracle Cost and Usage Reports with a Resource Manager stack or your own Terraform.
Connect Alibaba Cloud — Connect Alibaba Cloud through Bill Subscription files in OSS and a read-only RAM role created by a ROS template.
Connect DigitalOcean — Connect DigitalOcean accounts with a read-only personal access token and see invoices by month.
Connect Akamai / Linode — Connect Linode (Akamai Connected Cloud) accounts with an account read-only token.
Connect Cloudflare — Connect Cloudflare usage-based charges with a Billing Read account token and see credits and unpaid debt.
Connect OpenAI, Anthropic, Datadog and Snowflake — Connect AI and software vendors with admin keys or a Snowflake key pair so their spend sits beside your cloud costs.
Cost Explorer — Slice, compare and drill into spend across every connected cloud: group by, filters, charts, overlays, details, AI, links and export.
Saved views, saved filters & scheduled emails — Keep, share and email the Cost Explorer views you use often, and reuse include/exclude filters across views and reports.
Reports — Build, compare, export, save and schedule spend reports, with presets, Excel, CSV and PDF exports.
SaaS & AI Spend — Spend and token analytics for OpenAI, Anthropic, DeepSeek, Datadog, Snowflake and cloud AI services.
Unit Economics — Cost per business unit: define metrics, send volumes, set targets and alerts.
Connect a Kubernetes cluster — Install OpenCost and the CostGlass exporter in your cluster so cost data is pushed to CostGlass every 15 minutes.
Kubernetes Costs page — Understand cluster, namespace, workload and pod costs, idle capacity, rightsizing, carbon and health.
Tagging strategy: getting the most from tags — How to tag cloud resources, enforce tagging, and when to use cloud tags or virtual tags in CostGlass.
Tag Explorer — Group billed spend by the value of a tag, see tag coverage per cloud and drill into resources.
Tag Compliance — Define required AWS tags, measure compliance, and fix missing tags with Quick Tag, batch apply or a CLI script.
Virtual tagging — Allocate spend by team, product or environment with rules, no cloud changes, with a rule builder and CostGlass AI.
Forecasting — Forecast month-end spend, the next months and a yearly run-rate, and simulate the cost of changes.
Budgets — Create spending limits for a cloud, account, service or team, and see how CostGlass budgets differ from native AWS, Azure and Google budgets.
Anomaly detection — How CostGlass finds unusual daily cost, how to tune it, explain it and be notified.
Cost alerts — Alert when spend rises versus the previous day, week, month or quarter.
All alert and notification types — A comparison of every alert and notification in CostGlass, with channel setup and testing.
Issues & annotations — Dated notes on spend, and a lightweight issue tracker for cost work with Jira push.
Savings playbook — A prioritised, step-by-step programme for reducing your cloud bill, with a 30/60/90-day plan.
Savings recommendations — How the Savings page finds, prices and tracks savings for every connected cloud and platform.
Rightsizing — Find servers and databases that are too big, or too small, using real CPU and memory measurements.
Commitments: Savings Plans & Reserved Instances — Track coverage, utilisation, expiry and purchase recommendations for Savings Plans, Reservations and committed use discounts.
Instance Scheduler — Start and stop non-production servers on a weekly schedule to stop paying for idle hours.
Giving your team access — Invite people, choose Owner, Admin or Member roles, remove users and limit what they see.
Setting up your organisation hierarchy — Build a tree of nodes, place cloud accounts by hand, rule or CSV, and scope people to a branch.
Designing your hierarchy (with enterprise examples) — Principles and worked patterns for AWS Organizations, single accounts, multi-cloud groups, MSPs and regulated regions.
Single sign-on (SAML & OIDC) — Connect Okta, Entra ID, Google Workspace or another provider, verify your domain, test and require SSO.
API keys & AI assistants (MCP) — Create API keys and connect Claude Desktop, Cursor or Claude Code to your cost data.
Audit log — See who changed what and when, with before and after values, kept for 24 months.
Data residency & retention — Your fixed region, how long cost history is kept, purge now and the data handling summary.
Notification settings, Jira & chat — Weekly spend summary, Slack and Teams webhooks, and connecting Jira Cloud.
Troubleshooting & Common Setup Fixes — Solutions for common cloud connection and ingestion issues across AWS, Azure, Google Cloud, OCI, Alibaba Cloud, Kubernetes, and SSO.

API keys & AI assistants (MCP)