cloud-doctor

One command grades your whole cloud account — misconfigurations, missing observability, and security posture, ranked by the five things to fix first.

npx cloud-doctor

That picks a provider, resolves your identity, and runs the scan interactively. Or skip straight to one:

npx cloud-doctor aws --profile prod
npx cloud-doctor cloudflare --yes
npx cloud-doctor vercel --yes

If ~/.npmrc has min-release-age set and blocks fresh releases:

npm x --min-release-age=0 cloud-doctor -- aws profiles

Prefer the bleeding edge? Alpha builds publish to their own tag: npx cloud-doctor@alpha.

Supported providers

| Provider | Command | Auth | |---|---|---| | AWS | cloud-doctor aws | AWS SDK credential chain — --profile, AWS_PROFILE, env vars, SSO, web identity | | Cloudflare | cloud-doctor cloudflare | CLOUDFLARE_API_TOKEN | | Vercel | cloud-doctor vercel | VERCEL_TOKEN (+ optional VERCEL_TEAM_ID) | | Supabase | cloud-doctor supabase | SUPABASE_ACCESS_TOKEN | | Render | cloud-doctor render | RENDER_API_KEY | | Fly.io | cloud-doctor fly | FLY_API_TOKEN (+ optional FLY_ORG) | | Railway | cloud-doctor railway | RAILWAY_API_TOKEN (workspace/account token) |

Coming soon: Google Cloud, Kubernetes, and Databases (Postgres, MySQL, Redis).

Commands

cloud-doctor                    # pick provider (default AWS) → pick identity → scan
cloud-doctor aws                # AWS fast path
cloud-doctor aws --profile prod # non-interactive when unambiguous
cloud-doctor aws --yes --json   # CI, machine-readable output
cloud-doctor aws --yes --json --fail-under 75  # CI gate on the score

cloud-doctor aws profiles       # list ~/.aws/config profiles
cloud-doctor aws whoami         # show resolved AWS identity

--yes skips prompts (CI-safe); --json prints a stable, schema-versioned report; --verbose prints every finding; --no-color disables color output.

What you get back

• A score (0–100): a severity-weighted pass ratio over every rule that actually ran.
• The top 5 fixes, ranked by score impact, each naming the affected resource with a concrete fix.
• Disclosure, never guessing: muted (disabled via config) and unavailable (missing-permission) rules are called out, not counted as passes.
• If issues are found in an interactive terminal, cloud-doctor can hand the report straight to your AI coding agent — Claude Code, Codex, or Cursor, whichever is installed.

Configuration

// doctor.config.ts
import { defineConfig } from "cloud-doctor/api";

export default defineConfig({
  defaultProvider: "aws",
  aws: {
    profile: "prod",
    regions: ["us-east-1", "eu-west-1"],
  },
  rules: {
    "aws/s3-unencrypted-bucket": "off",
    "aws/iam-user-access-key": "error",
  },
});

"off" disables a rule; "error" / "warning" overrides its severity.

License

MIT