Last reviewed 2026-10-19
Overview
Cloudeval helps teams review cloud cost and security together when those signals need architecture context. Instead of isolating cost, security, and topology in separate tools, Cloudeval packages supported Azure context into diagrams, reports, evidence-backed findings, and shareable outputs.
Cost and security decisions often share architecture context: resource type, region, exposure, dependencies, and operational ownership. A pull request that only prices a change, or only lists a security finding, still leaves the reviewer to reconstruct which resource the number belongs to. Cloudeval keeps the diagram, the finding, and the source revision in one review so the decision stays attached to the change.
The public example pull request https://github.com/ganakailabs/cloudeval-azure-arm-review-example/pull/2 is titled Demo: analytics capacity cost regression. The pull request describes 160 Standard_D2s_v3 workers, PremiumV3 capacity 8, WAF_v2 capacity 10, RA-GRS storage, and a monthly budget gate of 5000 USD/month. The author expected a cost failure. The published review comment on 2026-06-11 reported Merge gate FAIL, posture 23.02/100 CRITICAL, 3 unit tests failed, and Policy GOOD. The same comment reported Cost 9.49 USD/mo, which is under that 5,000 USD/month budget. The merge gate failed on the recorded checks; the cost line in that comment stayed under the budget gate.
Cloudeval can produce cost reports, architecture findings, security-oriented review context, diagrams, and evidence-backed summaries where project data supports them. Reports export as PDF, Markdown or JSON. Coverage is 1,650+ attributed checks on Azure inputs: ARM JSON, Bicep compiled to ARM JSON, and live Azure sync. AWS CloudFormation is a static beta. A zero cost line is not proof that infrastructure is free; check pricing coverage before you treat an estimate as complete.
Cloudeval is not positioned as a full CNAPP, CSPM, or enterprise FinOps replacement. It is a review layer for supported cloud evaluation workflows. It does not support Terraform, live AWS, or GCP. Findings are evaluations, not a compliance certification. Use the GitHub review path when the same evidence should appear on the pull request, and keep dedicated FinOps or CSPM tools when those are the system of record.
No. It can review security and architecture findings, but should not be marketed as a full CSPM replacement.
No. It includes cost reports and signals, but mature FinOps workflows may still need dedicated tooling.
Pull request 2 in cloudeval-azure-arm-review-example described a capacity regression and a 5000 USD/month budget gate. The 2026-06-11 review comment reported Merge gate FAIL and Cost 9.49 USD/mo, under that budget.
