Skip to main content
Short answers to the questions new customers ask most, each with a link to the page that covers it in full. If your question isn’t here, contact us.

​
Getting started

CloudThinker builds Frontier Investigation Agents. These AI agents connect to your cloud, code, and tools, work out the root cause of incidents, code risks, cost waste, and security gaps, and propose a fix for your engineers to approve.CloudThinker has four products, one per kind of problem. You can adopt them one at a time:Three supporting areas work across all four products rather than investigate anything themselves:
About 10 minutes. The Quickstart walks you through signing in at app.cloudthinker.io, connecting one system read-only, and asking your first question.Success state: the answer names services, regions, and resources you recognize from your environment.
Yes. Connect a staging or sandbox account with a read-only role, and turn off Allow writes on the connection so CloudThinker refuses any change. Agents can look but can’t change anything. See Quickstart.
The organization is your account: plan, billing, seats, the member list, SSO, BYOK, and audit logs. Its roles are Owner, Admin, Developer, and Viewer. A workspace sits inside it and holds the actual work: connections, agents, skills, conversations, and approvals. Its roles are Admin, Developer, and Viewer.See Organizations and Workspaces.
An organization Owner or Admin goes to Admin Settings → Organization and clicks Invite Members. Each person gets an organization role, and you can give them a different role in a single workspace from More → Workspace settings → Members. See invite members and Workspace members.
Clouds such as AWS, Google Cloud, and Azure, plus Kubernetes, databases, observability tools, Git providers, CI/CD, and ticketing tools such as Jira, ServiceNow, and PagerDuty. Each one is a connection: a credential for one service, added in More → Workspace settings → Connections.The full list is in the connection catalog. If a tool isn’t listed but you run an MCP server in front of it, add that server as an MCP connection and agents can call its tools.
No. CloudThinker runs as a managed service and reaches your systems through the connections you add, using the credentials and permissions you grant.If you want commands to run on a machine you control, such as a laptop or CI runner, you can add a Worker (beta). It’s optional. Use one when the agent needs a private repository or an internal host: the Worker connects outward over HTTPS, so you open no inbound port.These docs don’t publish CloudThinker’s egress IP addresses. If your firewall needs an allowlist, ask through contact us.
An organization Owner or Admin goes to Admin Settings → Integrations, opens the Slack card, and clicks Connect with Slack. Then invite the bot to a channel. Chat apps need the Team plan or above. In Slack and Microsoft Teams, a write that needs approval links back to the web app, where you approve it. Google Chat shows Approve and Reject buttons on the card itself. See Slack, Microsoft Teams, and Google Chat.
A workspace Admin can delete a connection from More → Workspace settings → Connections. To remove a whole workspace, including its connections, conversations, and settings, an organization Owner or Admin uses Admin Settings → Workspaces. There’s no restore. See Delete a workspace.

​
Agents and safety

Every workspace has one built-in agent, CloudThinker. It’s always on, and it can split a big task across temporary subagents. Your team can also create custom agents with their own instructions and skills. See Agents and Customize.
No. Plain language works, and with no mention, CloudThinker answers. Three optional symbols make a request more precise:
Ask for output shapes such as a dashboard or report in words. Full syntax: Commands.
Only within limits you set. Reads always run. Every write (an agent call that changes a connected system, such as restarting a service) passes these checks in order:
  1. Always blocked: a built-in list of calls that never run, such as stopping CloudTrail logging or deleting the kube-system namespace. Nothing overrides it.
  2. Your Rules, which allow, ask first, or deny a named kind of write. Under Manual, an Allow Rule doesn’t let a write run; the write still goes to a person. Rules decide only once CloudThinker turns on Rule enforcement for your workspace. It’s off by default; until then Rules record the verdict they would give and the Approval mode alone decides (details).
  3. The Approval mode: Manual asks a person for every write. Auto can let AI judgment allow a safe write, then asks a person or refuses the rest.
  4. An approver, who approves or declines.
One exception: in Review, Apply fix and Fix all findings commit to the pull request’s source branch when a person clicks them, without going through these checks.The Approval mode itself is live, and new workspaces start on Auto · Rules + AI · Ask me. Read it in three parts: the mode is Auto, writes are decided by your Rules + AI judgment, and anything still not allowed waits for a person (Ask me). For example, restarting a staging pod you just asked about can run. Deleting an RDS snapshot is destructive, so it asks.When a write waits, the chat shows an approval card with Approve and Decline. By default any workspace Developer or Admin can answer it. Narrow that in Approvers. A request from Slack or Microsoft Teams links back to the web app, where you approve it. In Google Chat you can approve or reject it on the card.To require a person for every write, switch the workspace to Manual. Then, under Run types, override Automations (and any other run type you’ve changed) to Manual too: the Automations row defaults to Auto · Rules + AI · Refuse and doesn’t follow the workspace. An Automation or a chat can also pick its own mode. See Approvals and Approval mode.
Read-only is enough to start. Two controls set what agents can do:Recommended read-only starting roles:Allow writes is on by default for AWS, Google Cloud, and Azure, so the read-only credential is what blocks changes. To block them in CloudThinker too, turn the switch off on the connection’s detail panel. Add write permissions only for specific changes you want agents to make. See Connections.

​
Security and compliance

The app and API are served over HTTPS. Model calls go to CloudThinker’s LLM provider unless your organization uses BYOK (bring your own LLM credentials), which routes them through your own AWS Bedrock, Anthropic, FPT Cloud, Claude Code, or Codex account.These docs don’t cover the hosting region, the model provider’s name and data terms, training use, or conversation retention. Ask for them through contact us when you start a vendor review. Details: Security and trust.
The message doesn’t send. CloudThinker scans it for credential-shaped values such as API keys, tokens, passwords, and connection strings, and opens the Review detected secrets dialog. Pick one:Mark a false positive with Mark as not a secret. The raw value never enters the conversation. See Data protection.
See Single sign-on, Roles, and Audit logs.
Certifications and attestations aren’t published in these docs. For current reports, a security questionnaire, or a data processing agreement, contact us and the team will send what’s available. To answer the rest of a vendor review now, use Security and trust.
By default it runs as a managed service at app.cloudthinker.io. Workers are self-serve and in beta, and run file and shell work on a machine you control. Dedicated, self-hosted, and air-gapped deployments are in early access through a design-partner program. See Deployment.

​
Pricing and plans

Per seat (one seat per member). Each paid plan adds a monthly pool of credits, the unit agent work consumes, shared by the whole organization. Plans are Free, Team, Scale, Scale Plus, and Enterprise. Yearly billing saves 20% on the seat price.Every plan also gets 100 daily free credits for chat on the Light model. They reset at midnight UTC.Each run uses one of three model tiers, which multiply its credit charge: Light (0.3x) for quick questions, Pro (1.0x, the default) for everyday work, and Ultra (1.7x) for the hardest problems.When your credits run out, runs that need more credits are blocked. On Team and above, the Owner can turn on Pay-As-You-Go: a metered top-up at $0.10 per credit, up to a monthly cap you set. Current prices and limits: Pricing. How runs spend credits: Usage.
Direct chat on the Light model: web chat, Rooms (chats shared with other people), and headless chat from the CLI. The interactive CLI agent needs Team or above. Any other run, such as Review, Resolve, Optimize, Cyber, or an Automation, is refused with “The Free plan only supports direct chat.” Upgrade to Team or above to unlock them and the Pro and Ultra models.
Eligible Free organizations see Start 14-Day Free Trial on the Team card in Admin Settings → Billing → Upgrade Plan. You get Team features for 14 days. Pay-As-You-Go (paid top-up credits once your pool runs out) stays off during the trial.To keep Team, the Owner opens Admin Settings → Billing → Upgrade Plan and clicks Add payment method on the Team card.
If you don’t add a payment method before the trial ends, the organization returns to Free. Runs other than direct chat stop, and Pro and Ultra models lock.
Only the organization Owner can change the plan. See Pricing.

​
Getting help

These docs don’t publish support response times. Ask about them when you contact us. See Pricing.

Quickstart

Connect one system read-only and get your first answer in about 10 minutes

Security and trust

Answer a vendor security review before you connect production