Connector · Gemini Enterprise · Claude · Copilot Studio · any MCP assistant
Ask your assistant about cloud and AI cost. FinOpsAI answers with the bill.
The FinOpsAI connector is a Remote MCP server. Your assistant discovers it, you sign in and allow it once, and from then on every question about cloud or AI spend across Google Cloud, AWS and Azure is answered with the same figures the FinOpsAI app shows — per currency, each labelled measured, estimate or not measured. Five actions (apply or dismiss a recommendation, set an AI budget or token allocation, approve an AI service) run only after you confirm, and each is recorded in the audit log.
01What the connector does
- Cloud cost overview per billing currency; cost anomalies with the FinOpsAI agent's plain-language root cause and a remediation plan with exact commands.
- Planning and attribution: month-end spend forecast with a low–high band and budget position; what changed and why (last 7 vs prior 7, month-over-month, movers); cloud budgets; spend by cost centre with unit economics; Kubernetes cost by cluster and category; SaaS licence utilisation; and the multi-cloud explorer for any date range by provider, service, project or region.
- Savings position (identified → applied → measured on the monthly close), recommendations, efficiency opportunities (idle, orphaned, under-utilised), commitments with coverage and expiry, provider-reported carbon with the BRSR view.
- AI Cost Intelligence: direct vendor APIs (OpenAI, Anthropic, xAI, Fireworks, OpenRouter, gateways, seat products) and cloud-managed AI (Vertex AI, Bedrock, Azure OpenAI, GPUs) as two layers that are never added; usage by person with tokens, cost per million tokens and efficiency signals; a spend explorer by vendor, model, key, user, cost centre, day or project; AI budgets and token allocations with projections and alerts; Shadow AI findings.
- Actions, always confirmed by you in the assistant and subject to your FinOpsAI role: apply or dismiss a recommendation, set an AI budget, set a token allocation, approve an AI service. FinOpsAI never changes cloud resources.
Reasoning runs in your assistant, on your assistant's licence. FinOpsAI serves facts and audited actions from its own infrastructure in asia-south1 (India). No agent is hosted on any cloud's agent platform, and your data is not copied to one.
02Set-up in Gemini Enterprise (admin)
- In Gemini Enterprise, open your app → Data stores → Create → Custom MCP server (or pick FinOpsAI from the Connectors catalogue once listed).
- Server URL:
https://mcp.finopsai.app/mcp.
- Authentication: OAuth 2.0. Authorization URL
https://finopsai.app/oauth/authorize · Token URL https://api.finopsai.app/api/oauth/token · Scopes finops.read finops.ai.read finops.write · PKCE on. Client ID and secret: the ones FinOpsAI registered for Gemini Enterprise (from the catalogue listing), or request a client for your organisation at the support address below.
- Allow egress in your organisation policy (
allowedEgressFqdns) for mcp.finopsai.app, finopsai.app and api.finopsai.app.
- Import the actions. Read tools carry
readOnlyHint and run without a prompt; the seven write tools carry destructiveHint and keep the per-call confirmation.
- Each user, on first use, signs in to FinOpsAI with their usual account, picks the workspace and allows the three permissions. They can revoke this at any time under Settings → Integrations → Connected apps.
Other assistants
Claude: Settings → Connectors → Add custom connector → https://mcp.finopsai.app/mcp. Microsoft Copilot Studio and Amazon Bedrock agents: add an MCP tool server with the same URL. Discovery follows RFC 9728 and RFC 8414, so no client-specific configuration is needed.
03Permissions (scopes)
| Scope | Lets the assistant |
|---|
finops.read | See your cloud cost, savings and anomaly figures, recommendations, commitments and carbon. |
finops.ai.read | See your AI spend, usage by person, AI budgets, token allocations and Shadow AI findings. |
finops.write | Apply or dismiss recommendations, set AI budgets and token allocations, approve AI services — each one confirmed by you and recorded in the audit log; still limited by your FinOpsAI role. |
Tokens are issued only by FinOpsAI's authorization server for this connector, bound to the person who consented, the workspace they chose and their current role. Access tokens live 60 minutes; refresh tokens rotate on every use and a reused one revokes the whole connection.
04What the assistant will say — and never say
- Every figure carries its provenance in words: measured (from the bill or the vendor's report), estimate (from a recommendation or a pattern), or not measured yet. An absent figure is never shown as 0.
- Currencies are reported separately and never converted or added; direct vendor APIs (USD) and cloud-managed AI (the bill's currency) stay apart.
- Every row that an action can act on carries its id, so follow-ups never need you to look one up.
- Before any action the assistant restates what will change and asks you to confirm; the result names the audit entry.
05Privacy and data handling
- Read tools return the same JSON the FinOpsAI app shows to that person, nothing broader; a member sees a member's view.
- FinOpsAI does not pass the assistant's token to any third party and does not store conversation content; each tool call is logged (workspace, user, tool, duration) and each write is audited.
- Data residency is unchanged: asia-south1. The assistant receives answers, not datasets.
- Privacy Policy · Terms of Service · technical reference:
docs/api/mcp.md in the FinOpsAI documentation.