Neckbeard – A DevOps/platform/SRE plugin for your agent | AI Paper Digest

TL;DR Highlight

An agent plugin that maps apps onto tested OpenTofu modules and attaches a monthly cost table.

Who Should Read

A backend developer who hesitates to let a coding agent write cloud infrastructure because of open security groups and surprise bills.

Core Mechanics

The agent doesn't write infra itself
- Humans maintain a versioned catalog of OpenTofu modules that is tested in CI on every change.
- The agent only reads the app, asks questions, and maps answers onto catalog inputs.
- If you need something like Redis, it reports a named finding instead of inventing a module.
LLM judgment up front, deterministic Go behind it
- Analyze produces app-profile.yaml where facts carry file and line numbers, inferences carry confidence, and assumptions are explicit.
- The planner writes a hash-verified blueprint.yaml, and the renderer is a pure function of it.
- Regeneration never overwrites files you have edited.
You see the monthly bill before anything exists
- Infracost priced the same reference app (HTTP service, worker, cron, Postgres) at the smallest tier across three environments with live prices.
- Monthly costs: Cloud Run $77, Container Apps ~$98*, ECS Fargate $250, EKS $396, GKE (regional) $754, AKS ~$801*.
- The asterisk is because Infracost can't price Container Apps compute yet, and the report lists every unpriced resource next to the total.

Community Reactions

Experience that just asking an agent works fine
- One commenter said asking agents directly to do this works fine in their experience.
Objection about an extra abstraction layer
- A commenter asked why put another interface between yourself, the plan file, and the running environment when you already maintain tf/HCL.
- Another suggested OpenTofu plus Ansible, versioned and run, is enough.
Concern about runaway cloud spend
- One commenter warned you could wake up to skyrocketing cloud spend because an LLM assumed wrong.
Dismissal as 'just Terraform modules' plus alternatives
- One short take called it a bunch of Terraform modules.
- Others suggested a Hetzner server at $25/month for the reference app and pointed to disco.cloud, a self-hosted PaaS.

How to Apply

Run /neckbeard:analyze on your current repo
- Install the plugin with the two Claude Code commands and run /neckbeard:analyze in your service repo.
- Check the file and line evidence and the assumption list in app-profile.yaml against your real app.
Compare costs with /neckbeard:estimate before deploying
- Run the serverless vs kubernetes comparison and read the monthly table and the list of unpriced resources.
- Use the result alongside your own cost estimates to justify the architecture choice.
Adopt the three-level reporting rule for agent-made IaC
- Instruct your agent to report V0/V1/V2 checks as PASSED, FAILED, or NOT EXERCISED.
- Run credentialed steps yourself and never hand keys to the agent.
Narrow the agent to a tested module catalog
- Define the workload shapes your team supports and let the agent compose only tested modules.
- Have it report unsupported needs as 'unsupported' instead of writing new infra.

Try It

copy & run

# Paste into Claude Code (a simplified version of the original approach, without installing neckbeard)

You are an infrastructure scaffolding agent. Follow these rules.
1. Read this repo and find Dockerfiles, ports, env vars, health endpoints, and DB settings, then write them to app-profile.yaml. Attach file:line to every fact, a confidence (high/medium/low) to every inference, and "ASSUMPTION" to every assumption.
2. Do not guess what code can't tell you (expected traffic, tolerable downtime, whether to build a new DB, what the worker is for). Ask me, and do not proceed until I answer.
3. Allowed workload shapes are only: a container image, HTTP/worker/cron processes, Postgres, object storage, and secrets. For anything else (e.g. Redis), do not invent infrastructure; list it as an "unsupported finding".
4. Use OIDC only, no static keys. Never put secret values in code.

First summarize the infrastructure plan for {{target: one of AWS / GCP / Azure}}. Do not write code yet.

Next to try: ask it to "report each check as PASSED / FAILED / NOT EXERCISED".

Terminology

OpenTofuAn open-source IaC tool forked from Terraform. You still declare infrastructure as code in HCL.

InfracostA tool that reads IaC and estimates the monthly cloud bill before deployment. Think of it as a quote before you build.

CheckovA static scanner for security and policy violations in IaC. Basically a linter for infrastructure code.

OIDC federationCI logs into the cloud with short-lived tokens instead of long-lived secret keys. Like issuing a visitor badge instead of copying a key.

Deterministic coreOrdinary code that gives the same output for the same input. No LLM improvisation gets in.

Neckbeard – A DevOps/platform/SRE plugin for your agent