Neckbeard writes OpenTofu for coding agents and shows the monthly bill

A coding agent will happily write three hundred lines of Terraform and never once ask what any of it costs. Neckbeard, which reached the Hacker News front page at 61 points, is an Apache-2.0 plugin for Claude Code, Codex, Cursor and anything that reads a SKILL.md, built around a human-maintained catalog of OpenTofu modules that the agent fills from a repository. The project reached 182 stars, and v0.2.1 is the current release.

The catalog covers one workload shape: a container image, up to ten HTTP, worker and cron processes, Postgres, object storage and secrets. It supports AWS, GCP and Azure, GitHub Actions or GitLab CI, and either serverless containers (Cloud Run, ECS Fargate, Container Apps) or Kubernetes (EKS, GKE, AKS). The author, who also wrote the ponytail agent-restraint plugin, calls the model "mostly one good prompt" plus a deterministic Go core.

What the agent does, and what it refuses to do

/neckbeard:analyze reads the repository the way a careful new hire would: Dockerfiles, exposed ports, environment variables, health endpoints, the Procfile, the line in settings.py where Django reads DATABASE_URL. Every fact carries a file and line number, every inference carries a confidence, and every assumption is loud. The agent then asks the questions code cannot answer: expected traffic, tolerable downtime, whether Postgres is one you already run.

Planning refuses to start while any question is open. The planner writes a hash-verified blueprint.yaml, the renderer is a pure function of it, and regeneration refuses to overwrite a file a human has edited. If the application needs Redis, the agent returns a named finding that says the catalog does not do Redis yet, rather than a module that looks like it might.

The bill, before anything exists

/neckbeard:estimate plans against the catalog and prints the monthly cost as a table. The author quotes the smallest-tier numbers from Infracost for the same reference app across all six platforms: Cloud Run $77 a month, ECS Fargate $250, EKS $396, GKE $754. Container Apps and AKS appear with asterisks, because Infracost cannot price Container Apps compute yet and the generator refuses to let a low number lie. Every resource it could not price appears next to the total.

The table also makes the tool's own argument. When a solo developer asks for Kubernetes, the numbers say "not yet" so no one else has to.

Three honest validation levels

/neckbeard:sync ends with PASSED, FAILED or NOT EXERCISED for each check. V0 is syntax and policy: tofu validate, Checkov (every skip in the generated config carries a written reason, because a skip without one lies about the security posture) and kubeconform. V1 is an authenticated plan and V2 is a verified deployment, and both stay NOT EXERCISED until a human runs them with real credentials. There are no static cloud keys anywhere in the output: OIDC federation end to end, and a test fails the build if a rendered pipeline so much as mentions AWS_SECRET_ACCESS_KEY.

The project is pre-alpha, and the README says exactly where. The static matrix runs in CI on every pull request, three unrelated fixture apps onboard end to end, and live deploy, update and rollback have passed on AWS/GitHub and Azure/GitHub only. GCP lanes, GitLab lanes, Kubernetes, promotion and recovery drills are implemented and not exercised. First real deployments produced ten failures that went into a public findings ledger; five became module fixes the same afternoon.

Source

• Primary: bealesh/neckbeard on GitHub, Apache-2.0
• Hacker News discussion, 61 points