Workflows - CostGraph Documentation

Workflows run automated tasks on your cost data from the Workflows page in the CostGraph dashboard. In a self-hosted deployment, they run as Claude agents in your own Anthropic account, and they read your costs through your CostGraph MCP server.

Before you begin

An Anthropic API key. See Get an Anthropic API key.
Graph AI turned on, with graphAi.mcp.host set to a public https hostname that Anthropic can reach. See Connect MCP clients.

Workflows need Anthropic to reach your MCP hostname over the internet. An installation without internet access can’t run workflows.

Get an Anthropic API key

Workflows use Claude Managed Agents, which is available to every Anthropic API account.

Sign in to the Claude Console, or create an account.
Open the API keys page and click Create key.
Set Linked account to a service account, so the key keeps working when the person who created it leaves your organization. Scope it to a workspace if you use more than one.
Choose an expiration. A key that expires stops workflows until you store a new one, so pick Never if you rotate keys yourself.
Copy the key, which starts with sk-ant-. The Console shows it a single time, when you create it.

Usage is billed to that Anthropic account. Managed Agents keeps session history on Anthropic’s side, so it isn’t covered by Zero Data Retention or a HIPAA Business Associate Agreement. See Anthropic’s documentation.

Turn on workflows

Store the API key in a Secret

kubectl -n <namespace> create secret generic costgraph-automation \
  --from-literal=ANTHROPIC_API_KEY=<your key>

Add the Secret to your values file

backend:
  automation:
    existingSecret: costgraph-automation

Workflows are on by default. To turn them off, set backend.automation.enabled: false.

Upgrade the release

Run helm upgrade with your values file. The Workflows page is ready after the backend restarts.

What happens on startup

The first time the backend starts with a key, it creates the workflow agents in your Anthropic account. Later restarts reuse those agents. When an upgrade changes an agent, the backend publishes a new version of it. Anthropic bills workflow usage to the account that owns the API key.

Add other Secrets to the backend

To pass any other Secret to the backend, list it under backend.deployment.envFrom. Each entry exposes every key in the Secret as an environment variable.

backend:
  deployment:
    envFrom:
      automation-keys:
        type: secret
        name: costgraph-automation

To pass a single key, use backend.deployment.env.

backend:
  deployment:
    env:
      ANTHROPIC_API_KEY:
        valueFrom:
          secretKeyRef:
            name: costgraph-automation
            key: ANTHROPIC_API_KEY

Troubleshoot setup

When workflows are on but not set up, the Workflows page shows “Workflows are not set up yet” and links to this guide. Check the cause that matches your installation.

Cause	What to check
No API key	The Secret exists in the release namespace, contains `ANTHROPIC_API_KEY`, and is named in `backend.automation.existingSecret`.
MCP hostname missing or not `https`	Graph AI is turned on, `graphAi.mcp.host` is set, and your CostGraph URL uses `https`.
The agents could not be created	The key is valid, its account has access to Claude Managed Agents, and the backend can reach `api.anthropic.com`.

After you fix the cause, restart the backend.

kubectl -n <namespace> rollout restart deployment/costgraph-selfhosted

​Before you begin

​Get an Anthropic API key

​Turn on workflows

​What happens on startup

​Add other Secrets to the backend

​Troubleshoot setup