The problem

The infrastructure bottleneck

Every new service starts the same way — a console session, a Slack thread, and an engineer who'd rather be shipping product.

01

Manual provisioning

Every new service starts with a console session and tribal knowledge of what "good" looks like.

02

Security as an afterthought

Hardening happens after the finding, not before the resource ships.

03

IAM sprawl

Roles and policies pile up. Nobody remembers which ones are still needed.

04

Cost blindspots

Idle instances and over-provisioned databases bill you quietly, every month.

Use cases

Five ways teams use Architect

One agent, worked through chat, CLI, or MCP — see it plan, draft, and open the PR.

build infrastructure

typing…

312 lines IaC change impact analyzed PR #412 opened

change	before	after
ECS service exposure	public task ENI	internal VPC only
Load balancer	none	internal ALB + WAF
IAM task role	s3:* on *	scoped to app bucket
Multi-AZ	single AZ	2 AZ + auto-failover

— architect · CloudFormation drafted · merge triggers gated deploy

0 console logins scoped to 1 cluster PR #415 opened

field	value
role	analytics-readonly
policy	redshift:GetClusterCredentials
scope	analytics-prod cluster only
principal	priya@acme.com · SSO group
console access	NOT REQUIRED

— architect · IAM change reviewed like code, not clicked in a console

$260/mo estimated savings 3 findings PR #421 opened

resource	issue	savings
db.r5.xlarge (analytics-staging)	idle · 2% avg CPU	$190/mo
2x EBS volumes	unattached · 400GB	$40/mo
reserved capacity	3-instance mismatch	$30/mo

— architect · reads Trusted Advisor · nothing terminates without your merge

Next.js static export detected 4 resources planned PR #430 opened

resource	type	status
marketing-site bucket	S3 static hosting	PLANNED
CDN	CloudFront + ACM cert	PLANNED
WAF	AWS WAF	ENABLED
DNS	Route 53	PENDING MERGE

— architect · repo-aware · matches infra to what you actually built

3 issues found 0 merged blind comment posted on PR #438

issue	resource	fix
publicly_accessible = true	RDS billing-prod	set to false
0.0.0.0/0:5432	sg-billing	restrict to app tier
no encryption at rest	RDS billing-prod	enable storage encryption

— architect · reviews infra changes before they ship, not after they're exploited

How it works

Ask. Review. Merge.

No ticket. No meeting. No console.

01 · ASK

Describe what you need

Plain language, in chat, CLI, or MCP — no ticket, no meeting.

→

02 · REVIEW

Architect opens a PR

Full IaC diff and a change-impact summary. Nothing applied yet.

→

03 · MERGE

Ship through your pipeline

Your CI/CD deploys it. Engineers never touch the AWS console.

Interfaces

Work the way your team already works

Architect meets your engineers where they already are.

CLI

Terminal-native

Script it, alias it, run it from CI. No new tool to open.

$ architect plan "spin up a staging redis cluster, internal only" → drafting CloudFormation… → opening PR #503 in acme/infra

MCP

Inside your coding agent

Call Architect as a tool from Claude, Cursor, or any MCP client.

agent › architect.plan({ prompt: "add a read replica for analytics-prod" }) ← pullUrl: github.com/acme/infra/pull/504

GUI

Tudovu dashboard

Same plan → PR flow, no terminal required.

> "Add a read replica for analytics-prod" Architect is planning… PR #504 opened

Two agents, two jobs

Architect vs. Remediator

Different jobs. Same PR-first workflow.

01

PROACTIVE

Architect

Builds it right the first time. New infrastructure, IAM, deployments — scoped and hardened by design. Nothing ships that needs a finding to fix it later.

02

REACTIVE

Remediator

Fixes what's already broken. Findings from Security Hub, GuardDuty, and your GRC tool — with blast-radius analysis and IaC fixes for what's already in production.

The infrastructure engineer who never touches the AWS console.

Join the Architect Waitlist