Cut the cloud bill. Keep your sleep.

A $1,000 monthly cloud bill often runs on about $100 of bare metal or VPS. Cloudfall moves your apps and data there. Your AI agent runs it. Cloudfall checks every step and writes it down.

Move off Render Free pilot
uv tool install cloudfallOpen source, AGPL-3.0.

Import your render.yaml: apps, data and a DNS cutover that pauses until you flip it.

Run servers for clients? See how the agent works within your rules →

$1,000/mo your apps + data ≈ $100/mo your bare metal

Two ways in, one record

Where are your servers today?

In a cloud or on a PaaS

Render import is built in; from anywhere else, describe your apps in config. Migrate apps and data, cut DNS, keep the difference as runway.

Read the migration guide →

Already on servers, yours or your clients'

Managed by hand, with scripts or with Ansible. Start from Cloudfall's baseline operations, or point it at the Ansible repo you already run.

See how it fits →

For agencies and MSPs

Hand the routine to an agent. Keep the rules and the record.

Disks filling up, certificates expiring, backups nobody has tested. Your agent takes the routine across client servers, but only through operations you allow. Each one has a risk level, a verify step and a record. An operation you haven't declared doesn't exist to the agent.

No baseline yet? Start from Cloudfall's operations for hardening, PostgreSQL, backups and deploys. Already on Ansible? Declare the playbooks you run, as on the right. No import, no second copy of anyone's fleet.

operations/deploy.ymlon Ansible
id: deploy
playbook: playbooks/deploy.yml   # your existing playbook
risk: mutating                   # read | mutating | destructive
targets: host                    # fleet | group | host
inputs:
  version: string
preconditions:
  - health: ok
verify:
  playbook: playbooks/health.yml
readRuns freelyFacts, health, inventory. Nothing to gate.
mutatingCheck mode, then approvalThe diff is recorded first and a person approves it. Once your policy licenses the class, the next identical failure gets fixed alone.
destructiveAlways a humanData deletion, DNS cutover, promotion. No policy and no prompt can unlock it.
dental-group · 3 shop-eu · 2 saas-crm · 3 waiting for your approval

After an incident

The record is the page you send your client

Your client doesn't want an Ansible log. They want to know what happened, who allowed it and whether it worked. Every sentence below comes from a field of the record.

$ cloudfall why --operation converge● verified
  1. Converge of site.yml proposed against the whole fleet, based on 6 host snapshots.
  2. Check mode: no host would change. Diff saved as converge-20260922193845.diff.
  3. Waited for approval. roman approved the recorded diff.
  4. Run exited 0 and changed no host.
  5. Verify exited 0. Ended verified.
Bring your Ansible repo Read the getting-started guide

Under the hood

The gate lives in Cloudfall, not in the prompt

An agent can be talked out of a rule in its instructions. It can't be talked out of a process that refuses to run a destructive operation without a person.

Your agent any MCP client Cloudfall CLI + MCP server gate by risk Ansible your playbooks hosts The record OperationDecision a person approves the diff declared tools only verify → snapshots diff · approval · outcome
  1. Observe snapshots
  2. Decide operation, targets, why
  3. Preview check mode, diff
  4. Approve gate by risk
  5. Run through Ansible
  6. Verify update snapshots
  • Tool listGenerated from your declared operations. Risk levels go out as MCP tool annotations, so any client can gate on them too.
  • StatusDerived from validated observations, never from the agent saying so. cloudfall audit reports drift with distinct exit codes.
  • Your agentClaude Code, Codex or any MCP client. cloudfall init writes an AGENTS.md: every command sorted by effect and the gate it needs. Your agent reads it first.
  • Same surfaceOne CLI and one MCP server, the same commands for people and agents, JSON everywhere.
  • Exit planPlain systemd, nginx and PostgreSQL on Debian. Remove Cloudfall and any Linux admin can carry on.
  • LicenseAGPL-3.0. Read the gate before you trust it.
$ cloudfall why --operation converge --jsontrimmed
{
  "apiVersion": "cloudfall/v1",
  "kind": "OperationDecision",
  "metadata": { "id": "converge-20260922193845" },
  "spec": {
    "proposedAt": "2026-09-22T19:38:45Z",
    "operation": { "id": "converge",
               "risk": "mutating" },
    "targets": { "scope": "fleet" },
    "gate": {
  "requirement": "check-then-approve" },
    "check": { "exitCode": 0, "changed": [],
           "diff": { "bytes": 48061 } },
    "approval": { "approver": "roman" },
    "status": "verified"
  }
}

Want us to set it up with you? The pilot is free.

We're taking three outside teams this quarter. We move one app or one client fleet onto Cloudfall together with you, and you keep running it. Write to pilot@cloudfall.dev

Email about a pilotTry it yourself first