neckbeard handles your infra so you don't have to.

A plugin for your coding agent. It reads your app, writes OpenTofu from a versioned, tested module catalog, and puts a monthly price on it before anything is deployed: low, expected, and high, per environment, with every unpriced resource named instead of hidden. Then it tells you exactly which checks it ran. AWS, GCP, Azure. GitHub Actions or GitLab CI. Serverless containers or Kubernetes.

It never invents infrastructure. If your app needs something the catalog doesn't do yet, you get a named finding, not a module that looks like it might work.

$ /plugin marketplace add bealesh/neckbeard
$ /plugin install neckbeard@neckbeard
$ /neckbeard:analyze

Claude Code, as separate prompts. Codex, Cursor, or anything that reads a SKILL.md: see INSTALL.md. No agent at all: go install github.com/bealesh/neckbeard/cmd/neckbeard@latest.

Five commands.

/analyze

Reads the repo the way a careful new hire would and writes an evidence-backed app-profile.yaml. Every fact carries a file and line number. Then it asks you the things it can't know, and planning refuses to run while any question is still open.

/estimate

Plans against the catalog and shows the bill before a single resource exists. Low, expected, and high per environment, from Infracost against the plan, idle baseline separated from usage. Unpriced resources are listed next to the total, not rounded away. Run it on every change and the diff is your cost review.

/sync

Plan, estimate, scaffold, validate. Three environments with independent state. Pipelines that test, build, scan, and push under OIDC, with no static cloud keys anywhere. Your edits are never silently overwritten. Ends with PASSED, FAILED, or NOT EXERCISED for each check.

/doctor

Installs the CLI if it's missing and reports which tools are present and what each one buys you.

/help

The short version of this page.

What it costs, before you build it.

Nobody tells you what infrastructure costs until the invoice arrives, which is a strange way to make an engineering decision. So neckbeard asks Infracost first. The same reference app (an HTTP service, a worker, a cron job, Postgres), smallest tier, all three environments, live prices:

The third column is the point. When something can't be priced, the report says so next to the total rather than letting a low number lie. The table is also how the tool argues: when a solo developer asks for Kubernetes, the numbers say "not yet" so nobody else has to. Two controls that are never confused with each other: monthly_budget_alert renders a real cloud budget that notifies people, and monthly_ceiling refuses, before the resources exist.

What it will and won't claim.

Infrastructure tooling has a long tradition of implying more than it has proven. A passing tofu validate has never once meant a thing deploys. neckbeard reports in three levels and insists on showing you the third:

V0  PASSED         tofu validate [prd]
V0  PASSED         checkov policy [prd]     every skip carries a reason
V0  PASSED         kubeconform (clusters/)
V1  NOT EXERCISED  authenticated plan       needs cloud credentials
V2  NOT EXERCISED  deployment verification  needs cloud credentials

Where it actually stands.

Pre-alpha, and specific about which parts.

When live runs break, the failures go into the public findings ledger and from there into the catalog. The first real deployment produced ten of them; five became module fixes the same afternoon.

If you've run anything in production for long enough, you know the expensive mistakes rarely live in the application code. They live in the account bill and the 3am page. This is a tool for catching them while they're still a diff.