Maestro: Costguard

Maestro: CostGuard

Maestro: CostGuard audits your repos and cloud providers for CI and infrastructure cost leaks. It is built for developers who run several projects across GitHub Actions, Vercel, Supabase, Railway, Netlify, Neon, Cloudflare, and more, and want a single command that surfaces what is being wasted and exactly how to fix it. On repositories that have never been optimized, the static audit alone typically reduces CI spend by 60–80%.

One suite: fuse the answer, make the case, guard the spend.

• Maestro Frontier — Fuses the model CLIs you already run into one judged, grounded answer.
• Maestro Agora — Turns verified product truth into concise, argument-first copy without inventing the proof.
• Maestro CostGuard — Audits CI and cloud infrastructure for cost leaks and shows what to fix.

---

Install

CostGuard installs three ways. The plugin paths are zero-build and zero-npm (they ship a prebuilt, self-contained bundle); the npm package gives you the CLI and the MCP server anywhere.

Claude Code

/plugin marketplace add mbanderas/costguard
/plugin install costguard@costguard

Adds /costguard-audit, /costguard-fix, /costguard-live, and the full costguard skill (scan, providers, registry, report, digest). No build step, no npm install.

Codex

codex plugin marketplace add mbanderas/costguard
codex plugin add costguard@costguard

Adds the bundled costguard skill to Codex CLI and Desktop.

npm / any MCP host

Run the MCP server directly — no install:

npx -y @costguard/costguard-mcp

Install the MCP server and the costguard CLI globally (both bins):

npm i -g @costguard/costguard-mcp

Run the CLI ad-hoc without installing:

npx -y -p @costguard/costguard-mcp costguard

npx -y @costguard/costguard-mcp launches the MCP server directly because the package name matches its bin entry point — drop it straight into any MCP host's server config.

Other CLIs / Desktop apps — one command drops a thin /costguard adapter into Cursor, Gemini CLI, Cline, Windsurf, or a Codex project:

npx -y -p @costguard/costguard-mcp costguard install --target <host|auto>

--target auto detects the host; the adapter is no-clobber and idempotent. Run costguard install --help for the full target list.

---

What it finds

Static half (zero credentials). Reads .github/workflows/*.yml and application code to detect redundant CI triggers (push + pull_request on the same branch), missing timeout-minutes, missing concurrency cancellation, paths-ignore gaps that run CI on doc-only commits, and over-scheduled crons. No API call, no token needed — always safe to run.

Billing half (read-only, opt-in). When a provider token is present, reconciles live billed resources against a declared allowlist and flags orphaned resources (billed but not listed) and over-provisioned resources (larger or more capable than declared), each with a best-effort estimated monthly cost. Covers thirteen providers: GitHub, Vercel, Supabase, Railway, Netlify, Neon, Cloudflare, Fly, Render, Sentry, Upstash, MongoDB Atlas, and Datadog.

---

Proof

Tested on production repositories. Patterns found and fixed across repositories like my-app, web-app, and api-service: