Prerequisites
- A CostGraph account with an active billing plan. For non-OAuth capable clients, an API key from your account settings.
Connect your agent through OAuth or API key
Running headless or in CI, where a browser sign-in is not an option? Create an API key from your account settings and send it in the
X-API-Key header instead, as shown in the following tabs.- Codex
- Claude
- Amp
- OpenCode
- Generic
Add CostGraph to Or, with an API key:
~/.codex/config.toml to sign in by using OAuth:FAQ
Can the MCP change my infrastructure?
Can the MCP change my infrastructure?
No. CostGraph is read-only over MCP. It hands back recommendations, pricing, and your inventory. Your agent, using its own git or kubectl access, is what actually applies a change or opens a PR.
Which credential does it use?
Which credential does it use?
Interactive clients sign in with your CostGraph account and use a short-lived token that refreshes itself. Headless and CI setups send a
bl_ API key in the X-API-Key header. Either way, every read is scoped to your own tenant, so an agent only ever sees your data.How do I revoke an agent's access?
How do I revoke an agent's access?
Every connected client is listed under Settings > Connected apps. Revoking one cuts off that client immediately. API keys can be deactivated or rotated at any time from Settings.
What can my agent see?
What can my agent see?
Cost recommendations, live pricing, and your tenant’s inventory and metrics. See Usage for the kinds of questions that maps to.