Cloud cost watchdog agent

Spend Watch is an aeon skill: Autonomous cloud-cost analyst across Neon, Vercel, Railway and GitHub Actions - pulls per-object usage, attributes it to the biggest drivers, root-causes each, and emits recommendations ranked by real signal (idle %, over-allowance, failure rate) with dollar figures only where the billing API returns real ones (and, armed, applies safe cost levers). Like every aeon skill it is one SKILL.md prompt file that runs unattended on your own GitHub Actions, on a schedule or when you trigger it, and sends what it finds to Telegram, Discord, Slack or email.

This skill is a cost analyst, not a bill alarm. Each run answers, per platform:

1. Attribution - what is consuming the most? Rank drivers by dollars (or the resource unit that maps to dollars), down to the specific object: service, branch, route, RPC method, workflow. Top-N with each line's % share.
2. Root cause - why is that line expensive?
3. Recommendation - a ranked action list, each carrying: the concrete lever, an effort/risk tag, whether it's armable now, and a saving in real dollars ONLY when the platform's billing API returns real dollars (Railway currentUsage, Actions overage). Everywhere else there is no dollar figure - the line carries its real signal instead (idle-awake %, % over the included allowance, cache-miss rate, stale-preview count, failure rate). Never invent a $X/mo.

Dollars-only-when-real is the core rule. A fabricated "$5/mo" is worse than the true signal "idle-awake 71%". Rank each recommendation by: real-$ saving first (when known), then signal magnitude × how actionable it is (armable > 1-click > code-change > investigate). The recommendation is the deliverable; the signal justifies it; the dollar is a bonus only when the API hands it over.

Across platforms (all): a roll-up - the real spend where billing exposes it (Railway $, Actions $), the biggest signal-ranked driver anywhere, and the top actions fleet-wide. No synthetic grand total.

The monitoring (deltas, real budgets, signal thresholds) is the trend context and the trigger; the deliverable is the ranked recommendations.

Every aeon skill takes one optional text input, var, set in aeon.yml or typed in when you run it by hand. It picks the target or the mode for that run.

Scope selector + optional arm flag.

• empty / all → sweep every platform whose secret is present, emit one combined digest.
• neon | vercel | railway | actions → run one adapter only.
• prepend arm: (e.g. arm:neon, arm:actions) → authorize the adapter's safe write levers for this run. Without arm: the skill is read-only: it recommends, never mutates.
• dry-run appended anywhere → build the digest but do not ./notify (for testing).

Runs unattended - treat var as final, no confirmation step, except a delete/mutation always re-reads the target's current state before acting (see each adapter's arm rules).

Besides the model you connected to aeon, Spend Watch uses the following. Add secrets as GitHub Actions secrets on your aeon repo, or in Aeon Connect.

• NEON_API_KEY - optional secret, unlocks more data or features
• VERCEL_TOKEN - optional secret, unlocks more data or features
• RAILWAY_TOKEN - optional secret, unlocks more data or features
• GH_GLOBAL - optional secret, unlocks more data or features

Easiest: open Aeon Connect, sign in with GitHub and turn on Spend Watch. No clone, no terminal. To add it to an existing aeon repo from a shell, run:

Then switch it on in aeon.yml (the default schedule is filled in):

skills:
  spend-watch: { enabled: true, schedule: "workflow_dispatch", var: "" }

New to aeon? Read the docs for how skills, schedules and memory fit together, or browse all skills.