Ask your agent what you spent on AWS last month. Ask which savings opportunities are worth the engineering time, and which are Fool's Gold. Ask whether your reservations still cover your fleet.

This is a Claude Code plugin over the glassity CLI, the command-line interface to Glassity. It ships the skills that teach an agent your cost surface, the subagents that dig into one opportunity at a time, and slash commands for the full FinOps loop from discovery to closure.

The reason to hand this to an agent rather than read a dashboard: the questions that matter are follow-ups. Which service drove that spike? Is it one account or all of them? What would rightsizing it actually save, net of the week it takes? Each one is a different query, and answering them in a conversation is faster than clicking through six screens.

Reads run straight through. Writes stop and show you the exact HTTP request first — see Safety model.

Installation

Two equivalent paths. Both install the same skills, agents, and commands.

Claude Code plugin marketplace:

claude plugin marketplace add glassity/agent-skills
/plugin install glassity

npm, if you would rather not use the marketplace:

npx @glassity/agent-skills install          # → ~/.claude
npx @glassity/agent-skills install --here   # → ./.claude, project-local

Then install the CLI and sign in:

brew install glassity/tap/glassity
glassity auth login

npx @glassity/agent-skills doctor checks the binary, the optional tools, and what is installed where.

Requirements

• The glassity binary, which every skill calls: brew install glassity/tap/glassity, or a release tarball from glassity/cli. This plugin never downloads it for you — that is deliberate, and Safety model explains why. No account yet? Sign up at app.glassity.cloud.
• macOS or Linux. Windows works through WSL.
• Optional: git and gh for the workflow commands that register a pull request; jq if you want to pipe --output json around yourself. Nothing in the read-only surface needs any of them.

Skills

Read-only. Nothing here can change anything in your account.

| Skill | What it answers | | --- | --- | | cost-summary | What did we spend over this window | | cost-by-service | Which services cost the most | | cost-by-subaccount | Which accounts are driving spend | | cost-mom-trends | Is cost trending up, and which month moved | | cost-ec2-usage | What EC2 is running, by type and region | | cost-rds-usage | What databases are running, by class and engine | | opp-list | Which savings opportunities are open, by stage and size | | opp-show | Why this opportunity was flagged, and what it covers | | rec-ec2-list | Which EC2 reservations are recommended | | rec-rds-coverage | Are we undercovered on RDS | | rec-rds-recommendations | Which RDS reservations to buy | | glassity-auth | Sign in, check the active tenant, sign out | | glassity-five-steps | Shared definitions the workflow commands read |

Mutating. Each one shows you the request and waits for a yes.

| Skill | What it does | | --- | --- | | opp-triage | Advance, approve, reassign, or archive an opportunity | | lifecycle-approve-plan | Approve the org plan and seed per-service assignments | | lifecycle-accept-plan | Accept a refined plan and move an assignment to execution | | lifecycle-reject-plan | Decline a brief, with the reason recorded | | lifecycle-mark-pr-merged | Close an assignment once its pull request is merged | | lifecycle-mark-closure-done | Register the closure report and complete the opportunity | | questionnaire-run | Walk a service-onboarding questionnaire and submit the answers |

Workflow commands

Six slash commands walk an opportunity through the five-step FinOps loop. Each one ends in a report that the next one depends on, so you can stop between any two and pick up later.

| Command | Step | Gate | Mutates | | --- | --- | --- | --- | | /finops-discover | Discovery | every idea typed and dated | no | | /finops-assess | Opportunity Assessment | net value above zero | no | | /finops-align | Stakeholder & Planning Alignment | an owner and a ready plan | yes | | /finops-execute | Execution | deployed, verified, rollback proven | yes | | /finops-feedback | Feedback Loop & Celebration | at least one new idea or policy | yes | | /finops-status | — | orientation only | no |

/finops-execute asks which automation level to run at, per opportunity, because risk differs idea to idea: print the commands for you, write the script, or open the pull request.

Safety model

An agent that can run shell commands can, in principle, send any HTTP request. Three things narrow that here.

Scoped tools. Every skill and command declares allowed-tools covering only what its body invokes. A cost skill can reach glassity and nothing else. The workflow command that opens a pull request is the only one that can reach git and gh.

Two-phase confirmation in the binary. Nothing mutates without a second round-trip. The first call makes no network request at all: it renders the exact method, path, and canonical JSON body it would send, and issues an HMAC-bound token. The second call replays the identical command with that token. Change anything in between and it refuses to send. Tokens are single-use, live 60 seconds, and cannot be redeemed in the first 1.5. Details in the CLI README.

Your own permission prompt. The binary is not bundled with this plugin, so every glassity invocation passes through Claude Code's bash permission prompt, where you see the command before it runs. If you want a hard allowlist rather than a per-call decision, allow the reads and leave the writes to prompt:

{
  "permissions": {
    "allow": [
      "Bash(glassity auth:*)",
      "Bash(glassity cost:*)",
      "Bash(glassity rec:*)",
      "Bash(glassity opp list:*)",
      "Bash(glassity opp show:*)",
      "Bash(glassity opp show-assignment:*)"
    ]
  }
}

Never add glassity opp transition, opp approve, opp assign, opp pipeline-move, pr register, or questionnaire submit to an allow rule. Reading the plan before it is sent is the whole defence against a prompt injection buried in an opportunity description.

Managed workspaces and your own machine

Glassity can provision a workspace with the repositories for an opportunity already checked out and a manifest describing which record you are in. When that manifest is present, /finops-align, /finops-status, and lifecycle-accept-plan use it to resolve ids for you.

On your own machine there is no manifest, and that is fine: the same skills route on the id you give them, or ask. Nothing requires a managed workspace, and no skill stops because a manifest file is absent.

Contributing

See CONTRIBUTING.md for the layout, how to test a change locally, and the frontmatter conventions. Security reports go to the address in SECURITY.md, not the issue tracker.

Apache-2.0. Copyright 2026 Glassity. See LICENSE and NOTICE.