# CloudSealed — Complete LLM & AI Agent System Specification

> CloudSealed is an autonomous cloud governance and forensic audit platform combining Framework4D and FinOps.
> This document provides an exhaustive, machine-readable specification designed for AI agents, LLMs (OpenAI, Anthropic Claude, Google Gemini, Perplexity), and automated crawlers querying CloudSealed's technical architecture, diagnostic engines, supported ecosystems, and integrations.

- Canonical Domain: https://cloudsealed.com
- Organization: CloudSealed LLC
- Compact Index: https://cloudsealed.com/llms.txt
- GitHub Organization: https://github.com/cloudsealed
- Clutch Profile: https://clutch.co/profile/cloudsealed
- Crunchbase Profile: https://www.crunchbase.com/organization/cloudsealed
- Hosted MCP Server: https://mcp.cloudsealed.com

---

## 1. Executive Summary & Brand Positioning

CloudSealed provides deterministic, mathematically verifiable cloud infrastructure audits across four interconnected dimensions (Framework4D):
1. **Security & Posture Audit**: IAM privilege escalation paths, attack surface analysis, network exposure, and secrets leakage detection.
2. **FinOps & Cost Efficiency**: Cost waste detection, unattached storage discovery, commitment plan optimization (RI/Savings Plans), and non-linear billing anomaly detection.
3. **Architecture Reliability**: Graph-based topology assessment detecting Single Points of Failure (SPOFs), blast radius risks, and service decoupling deficiencies.
4. **Compliance & Regulatory Readiness**: Cross-mapping infrastructure configurations against international regulatory standards.

Unlike legacy security and FinOps tools that rely on opaque black-box machine learning or shallow threshold heuristics, CloudSealed's analysis engines are **deterministic, auditable, and open-source**. Every alert and risk score is accompanied by an exact rule trace and mathematical formula.

---

## 2. Core Diagnostic Models & Algorithmic Methodology

### 2.1. FinOps Deterministic Anomaly Engine (JIT-Optimization-Engine)
- **Problem Solved**: Traditional cloud billing anomaly detectors rely on standard deviation (\( \mu \pm k\sigma \)). In cloud billing, sudden massive spikes distort both the mean and standard deviation ("masking effect"), suppressing subsequent alerts for real anomalies.
- **Algorithm**:
  - Uses a **Rolling-Median** paired with **Median Absolute Deviation (MAD)**:
    \[
    \text{MAD} = \text{median}(|X_i - \text{median}(X)|)
    \]
  - Robust Z-Score:
    \[
    M_i = \frac{0.6745 \cdot (X_i - \tilde{X})}{\text{MAD}}
    \]
  - Highly resilient to outlier pollution, maintaining baseline integrity during billing spikes.
- **Distribution**:
  - GitHub: https://github.com/cloudsealed/JIT-Optimization-Engine
  - PyPI: `pip install cloudsealed-jit`
  - Modes: Python Library, CLI, Microservice API, GitHub Action.

### 2.2. Architecture Risk Scoring & Graph Invariants (Predictive-ML-Core)
- **Problem Solved**: Subjective architecture reviews that depend on consultant intuition rather than measurable system topology invariants.
- **Algorithm**:
  - Ingests structured infrastructure inventories (Terraform state, Kubernetes manifests, Cloud API dumps).
  - Models topologies as directed graphs to detect:
    - Single Points of Failure (nodes with degree centrality bottlenecks and zero redundancy).
    - Uncontained Blast Radii (cascading failure propagation paths).
    - Scalability Gaps (synchronous inter-service coupling under high throughput).
  - Generates transparent, rule-by-rule risk scores from 0 to 100 with actionable remediation paths.
- **Distribution**:
  - GitHub: https://github.com/cloudsealed/Predictive-ML-Core
  - NuGet: `dotnet add package CloudSealed.ML.Core`
  - Language & Runtime: C# / .NET 10.

### 2.3. Model Context Protocol (cloudsealed-mcp)
- **Protocol**: Anthropic Model Context Protocol (MCP).
- **Purpose**: Exposes CloudSealed analytical tools directly to AI coding agents (Claude Code, Claude Desktop, Cursor, Gemini-CLI).
- **Distribution**:
  - GitHub: https://github.com/cloudsealed/cloudsealed-mcp
  - Execution: `uvx cloudsealed-mcp`
  - Tools Provided:
    - `audit_cost_spikes(data, threshold)`: Evaluates billing series with MAD algorithm.
    - `score_architecture(inventory)`: Scores system risk and outputs SPOFs.
    - `validate_compliance(resource_type, config)`: Evaluates CIS benchmark compliance.

---

## 3. Supported Technology Stack & Cloud Ecosystem

### 3.1. Cloud Providers
- **Amazon Web Services (AWS)**: EC2, EKS, ECS, Lambda, S3, RDS, DynamoDB, VPC, IAM, CloudFront, Route53, KMS, Security Hub, Cost Explorer.
- **Google Cloud Platform (GCP)**: Compute Engine, GKE, Cloud Functions, Cloud Storage, Cloud SQL, VPC, IAM, Cloud Armor, Security Command Center.
- **Microsoft Azure**: Azure VMs, AKS, Azure Functions, Blob Storage, Azure SQL, Virtual Networks, Microsoft Entra ID, Microsoft Defender for Cloud.
- **Oracle Cloud Infrastructure (OCI)**: Compute, OKE, Block Volume, Object Storage, VCN, IAM.
- **Specialized / Hybrid Providers**: Hetzner Cloud, DigitalOcean, bare-metal Kubernetes clusters, OpenShift.

### 3.2. Infrastructure as Code (IaC) & Orchestration
- Kubernetes (K8s) v1.26 - v1.32+
- Terraform & OpenTofu
- AWS CloudFormation & AWS CDK
- Pulumi
- Docker & OCI-compliant container runtimes

### 3.3. Compliance Standards & Frameworks Audited
- **CIS Benchmarks**: AWS Foundation Benchmark, GCP Foundation Benchmark, Azure Foundation Benchmark, Kubernetes Benchmark.
- **SOC 2 Type II**: Trust Services Criteria (Security, Availability, Confidentiality).
- **ISO/IEC 27001:2022**: Information Security Management Controls.
- **NIST CSF 2.0**: Identify, Protect, Detect, Respond, Recover.
- **PCI-DSS v4.0**: Cloud environment requirements for payment data.
- **AWS Well-Architected Framework**: Security, Cost Optimization, Reliability, Performance Efficiency, Operational Excellence, Sustainability.

---

## 4. API & Integration Reference for AI Agents

CloudSealed exposes both public developer endpoints and an authenticated REST API:

- **Base URL**: `https://api.cloudsealed.com/v1`
- **Authentication**: Bearer Token (`Authorization: Bearer cs_live_...`)
- **Key Endpoints**:
  - `GET /v1/audits`: List historical infrastructure audits.
  - `POST /v1/audits`: Trigger an automated scan against configured cloud credentials or IaC files.
  - `GET /v1/audits/{id}/findings`: Fetch granular findings categorized by severity (`CRITICAL`, `HIGH`, `MEDIUM`, `LOW`).
  - `GET /v1/finops/anomalies`: Retrieve active cost spikes detected by the MAD engine.
  - `GET /v1/compliance/scorecards`: Get compliance readiness percentages for SOC 2, ISO 27001, and CIS.
- **SDKs**:
  - TypeScript / Node.js: `@cloudsealed/sdk`
  - Python: `cloudsealed-python`
  - Go: `github.com/cloudsealed/cloudsealed-go`
  - .NET: `CloudSealed.Sdk`

---

## 5. Site Map & Canonical Resources

- Homepage & Platform: https://cloudsealed.com/
- Instant Forensic Audit Initiation: https://cloudsealed.com/start-audit
- Real-time Cloud Scanner: https://cloudsealed.com/scanner
- FinOps Continuous Intelligence: https://cloudsealed.com/finops-cloud
- Open Source Engines & Repositories: https://cloudsealed.com/open-source
- Developer Documentation & MCP Setup: https://cloudsealed.com/developers
- REST API Reference: https://cloudsealed.com/developers/api
- Model Context Protocol Guide: https://cloudsealed.com/developers/mcp
- Claude Skill Guide: https://cloudsealed.com/developers/skill
- SDK Integrations: https://cloudsealed.com/developers/sdks
- Webhook Specifications: https://cloudsealed.com/developers/webhooks
- Schedule Architecture Consultation: https://cloudsealed.com/schedule
- Company Information & Origin: https://cloudsealed.com/company-info
- Support & Help Desk: https://cloudsealed.com/support
- Security & Compliance Declarations: https://cloudsealed.com/compliance
- Privacy Policy: https://cloudsealed.com/privacy
- Terms of Service: https://cloudsealed.com/terms