CloudPulse AI — The Alexa+ Cloud Architect

Fixes what's safe in your AWS Terraform, and asks you before anything that could cause downtime. Built with Alexa+ MCP and Bedrock Nova Pro.

Comment

Turning on encryption for an RDS database looks like a one-line Terraform change. It isn't: AWS can't encrypt an existing instance, so Terraform destroys the database and creates a new, empty one. Security scanners flag the problem, and auto-fix tools happily write that one line, but neither tells you what happens when you apply it.

We wanted an Alexa+ cloud architect that behaves like a careful senior engineer: it fixes what's safe, explains the blast radius of everything else, and waits for a human "yes" before anything disruptive. Voice turned out to be the right interface for exactly that: a morning briefing, a quick question, and a clear approval.

CloudPulse connects Alexa+ (or any MCP client) to your cloud infrastructure:

  1. "Give me my morning cloud briefing": Reports critical security risks, monthly savings, and splits findings into safe fixes vs. those requiring approval.
  2. "Is it safe to fix everything?": Evaluates the blast radius of each fix: how AWS applies it (in place, restart, or replacement), expected downtime, data risk, and the safety guards added.
  3. "Fix it": Synthesizes one unified patch with only the safe fixes (applied with git apply) and stages a pull request. It immediately re-scans the patched code to verify the issues are resolved (3 → 0). Disruptive fixes are held back with the explanation spoken aloud.
  4. "Approve the database change": The PR is updated to include the held-back fix plus an automated final-snapshot guard, ensuring the old database is snapshotted before Terraform deletes it (4 → 0).

Every PR includes a summary and rollout plan written by Amazon Nova Pro from structured facts, plus a risk table generated by deterministic code.

Rules decide, AI explains, humans approve.

  • Alexa+ MCP Server (src/alexa_mcp_server.ts): Implements JSON-RPC 2.0 with 7 tools under the MCP 2026-07-28 specification, including assess_change_risk and a safety-gated ship_github_remediation_pr that refuses disruptive fixes unless explicitly confirmed. Verified with the official MCP Inspector.
  • Change Safety Engine (src/change_safety.ts): Deterministic SAFE / CAUTION / DISRUPTIVE classification based on documented AWS behavior. Automatically writes guards into patches: final_snapshot_identifier for RDS replacement, apply_immediately = false for Multi-AZ, same-family rightsizing so the existing x86 AMI boots, and VPC CIDR inference.
  • Amazon Bedrock Converse (src/bedrock_converse_agent.ts): Uses Amazon Nova Pro (amazon.nova-pro-v1:0) in a tool-use loop to audit manifests and author PR rollout summaries. Includes an offline fallback simulator.
  • Remediation Synthesizer (src/remediation_synthesizer.ts): AST-based attribute editing and LCS unified diffing.

  • Verification: 67 automated test assertions across 6 suites, plus an evaluation suite with F1 = 1.000 on labeled, clean, and adversarial Terraform fixtures.

  • Initial patches were dangerous: Early prototypes duplicated attributes (producing invalid Terraform), resized x86 instances to Graviton without changing the AMI (producing unbootable instances), and treated database replacement as a trivial edit. Solving this led directly to the Change Safety Engine.

  • Strict MCP compliance: Standard MCP clients rejected top-level _meta blocks and schema mismatches. We resolved this by placing metadata inside result._meta and writing test assertions that validate every tool's output against its declared JSON Schema (2020-12).

  • Voice intent accuracy: Ensuring casual questions like "Can you confirm whether the database is encrypted?" did not trigger destructive approvals required context-aware utterance parsing and single-use approval gating.

  • The approval moment: CloudPulse says "encrypting the database will replace it" before anything ships, and automatically adds the snapshot guard.

  • The same safety gate protects any MCP agent, not just Alexa+.

  • 67 passing automated test assertions, zero mock claims, and 100% truthful reporting of benchmark numbers.

  • Voice is a poor medium for authoring raw code, but an exceptional medium for briefings, blast-radius queries, and human approval.

  • Large language models are most effective and trustworthy when explaining structured facts, while deterministic rules should govern safety and code synthesis.

  • Run terraform plan directly to validate blast radius against AWS plan output.

  • Integrate Checkov and Trivy for broader rule coverage while preserving CloudPulse's safety and approval workflow.

  • Connect the MCP server to a live production Alexa+ Agent Skill endpoint.

Built With

  • amazon-bedrock
  • model-context-protocol-(mcp)
  • node.js
  • nova-pro
  • tailwind-css
  • terraform
  • typescript
Share this project:

Updates