Foundry.
The AWS control plane (pre-launch)

Forge infrastructure. Govern everything.

Foundry provisions AWS resources with the SDK, plans every change against what is actually live, and keeps an inventory, a compliance score, advisor findings, cost, and IP space for every account in the organization. Renkara runs its own AWS accounts on it. It is in a closed preview: ask for early access by email.

See what it doesHow it works
Foundry's Stacks page: ten StrataForge Robotics stacks as cards, each marked deployed with its account, region, and resource count.Foundry's Stacks page: ten StrataForge Robotics stacks as cards, each marked deployed with its account, region, and resource count.
Stacks: every stack, its account, region, and resource count.
Pre-launch

Foundry is in a closed preview.

Renkara runs its own AWS accounts on Foundry today. If you want it for yours, join the waitlist by email and we will write to you when it opens. There is no price yet and no launch date.

Request early access
Features

One tool for provisioning, inventory, and governance.

Everything below is in the code today, counted from it on 10/29/2026.

Provisioning

The SDK, not a template language

01

AWS-shaped resource types

140 resource types, each named the way CloudFormation names it (AWS::EC2::VPC, AWS::S3::Bucket, AWS::RDS::DBInstance) with the same property names. If you know the schema, you know Foundry's.

02

boto3 only

Every type is a Python class that creates, reads, updates, and deletes through the AWS SDK. No Terraform, no CloudFormation templates, no CDK.

03

Plan before apply

A plan is the typed diff of what you declared against what is live. Apply runs the plan, destroy tears a stack down, and a converged stack plans to nothing.

04

Versions and releases

Stack changes are saved as immutable versions you can list, diff, and roll back to. A release groups changes across stacks through plan, approval, apply, and rollback.

05

Import what exists

Import live resources with their physical IDs attached, so the next plan on the imported stack is empty and nothing is rebuilt.

Inventory and compliance

Every account, one place to look

06

Org-wide inventory

132 discoverers describe the organization's resources across every account Foundry knows, in three regions by default, eight account and region pairs at a time. Scans start on demand.

07

129 compliance packs

979 rules over 28 resource types, evaluated against the stored inventory, with a finding per failing resource. Coverage is partial: about half the rules read properties no discoverer collects yet.

08

102 advisor checks

Trusted Advisor style checks written in house: 46 security, 24 cost, 14 service limits, 13 fault tolerance, and 5 performance, each with severity, affected resources, and an estimated saving where one applies.

Cost and capacity

Numbers that show their coverage

09

Cost that says what it covers

Cost Explorer first, the Cost and Usage Report when it is provisioned. Actual and estimated spend are reported separately, and a total is never shown without the coverage behind it.

10

Forecasts and anomalies

Thirty, 60, and 90 day spend forecasts from a linear trend, and a flag on any day more than two standard deviations out. Findings on managed resources become governed rightsizing patches.

11

IP space and CIDR authority

Free and used IPs per subnet, a ledger of every VPC and subnet CIDR, overlap checks, suggested blocks from a supernet budget, a peering and transit gateway map, and an exhaustion forecast per VPC.

Governance

Gates in front of every change

12

Tag taxonomy and enforcement

Define the tag keys and rules, find untagged and expiring resources, chargeback by taxonomy, and see which resources violate which policy.

13

Blast radius and CIDR gates

Before an apply, Foundry scores every resource that depends on what is changing, and blocks a high-risk apply until an operator dismisses the report. The CIDR gate blocks overlapping creates. Both are configuration switches.

14

Remediation that asks first

A policy binds a finding to a corrective stack patch. A curated safe list applies automatically; everything else opens an approval card in Docket.

Adoption and continuity

From unmanaged to managed, and back to a known state

15

Brownfield adoption

Cluster an unmanaged account's inventory into dependency-coherent stacks, import each with its physical IDs, and report managed coverage.

16

Resource history

Stack versions, deployments, and CloudTrail events fused into one timeline per resource, with the property state reconstructed at any past moment and a single-resource rollback.

17

Stack mirror

A shadow of a stack in a disaster recovery account and region, with zone, image, CIDR, and ARN values rewritten, a readiness score, and a failover call.

18

Plain-English synthesis

Describe a stack and get one back that matches the resource schemas, wired and cycle-checked, with a plan ready. Types outside the registry are rejected, not guessed.

Screens

See it in light and dark

Real captures of the running tool, with fictional StrataForge Robotics data. They follow your theme.

A stack's resources tab listing each logical ID, its AWS type, status, and physical ID, with deployment health beside it.A stack's resources tab listing each logical ID, its AWS type, status, and physical ID, with deployment health beside it.
A stack's resources, with the physical ID AWS gave each.
A plan diff for the fleet-console-api-prod stack: unchanged resources marked no-op, one alarm to create, and two resources to update.A plan diff for the fleet-console-api-prod stack: unchanged resources marked no-op, one alarm to create, and two resources to update.
A plan diff: what will be created and updated before anything runs.
Foundry's inventory table of resources across StrataForge's AWS accounts, with type, account, region, and owner, product, and service tags.Foundry's inventory table of resources across StrataForge's AWS accounts, with type, account, region, and owner, product, and service tags.
Inventory: every resource, with its account, region, and tags.
The cost page: month-to-date spend split by the project tag, with a tagging coverage chart over 27 days.The cost page: month-to-date spend split by the project tag, with a tagging coverage chart over 27 days.
Cost by taxonomy tag, with the tagging coverage behind it.
The compliance page: finding counts by severity, tag coverage at 98 percent, and links to the taxonomy, tag compliance, chargeback, and enforcement screens.The compliance page: finding counts by severity, tag coverage at 98 percent, and links to the taxonomy, tag compliance, chargeback, and enforcement screens.
Compliance: findings and tag coverage at a glance.
The advisor page: findings in cost, security, performance, fault tolerance, and service limit categories, with estimated monthly savings.The advisor page: findings in cost, security, performance, fault tolerance, and service limit categories, with estimated monthly savings.
Advisor: findings by category, with estimated savings.
The IP space page: six VPCs with their CIDR blocks, subnet counts, and availability.The IP space page: six VPCs with their CIDR blocks, subnet counts, and availability.
IP space: every VPC and its subnets.
The remediation page: executions awaiting approval or already succeeded, each tied to the advisor check that triggered it.The remediation page: executions awaiting approval or already succeeded, each tied to the advisor check that triggered it.
Remediation: what is waiting on approval, and what ran.
How it works

Author, plan, apply, govern

  1. Author

    Declare a stack as a flat list of resources with CloudFormation-shaped types and properties. There is no template language and no module hierarchy.

  2. Plan

    Foundry resolves dependencies and diffs the declaration against live state. Every create, update, replace, and destroy is listed in order before anything happens.

  3. Apply

    boto3 executes the plan through the governance and safety gates, and the deployment is recorded with its plan and per-resource outcome.

  4. Inventory and govern

    Scans keep the inventory current. Compliance, advisor, cost, and IP space recompute from it, and remediation policies turn findings into governed patches.

Accessibility

Built so everyone can use Foundry.

This website is scanned with axe-core in light and dark at phone and desktop widths and has no serious or critical findings. The Foundry console started at 94 serious or critical findings in the same scan of 17 screens; after the repairs of 10/29/2026 the scan finds none, in light and dark, at phone and desktop widths, and we list what is still open below. We do not claim a WCAG conformance level.

  • Keyboard operation Partly supported

    The console has a skip link to the main content, a main landmark, and labeled navigation regions. Every scrolling region (tables, JSON blocks, lists) is a named region a keyboard can reach, and the inventory table's header checkbox is its own control. A keyboard-only walkthrough of every flow has not been recorded.

  • Screen reader landmarks and labels Partly supported

    Landmarks are labeled, every icon button has a name, and axe-core finds no naming or label violation on any scanned screen. Nothing has been tested with a screen reader.

  • Contrast in light and dark Partly supported

    Text contrast passes in light and dark. The console has real light, dark, and system themes on design-system tokens, a token-level test checks every text and tint pair at 4.5 to 1 in both, and the axe scan finds no color-contrast violation on any of the 17 screens. It was checked by tools, not by a person with low vision.

  • Reduced motion Not yet tested

    The Renkara design system carries a reduced-motion rule that the console inherits. Foundry's own tests do not check it.

  • Text resize and zoom Not yet tested

    Resizing text to 200 percent has not been tested.

  • Mobile and touch Partly supported

    At 375 by 667 pixels none of the 17 scanned console screens scrolls sideways, in either theme. The side navigation is a drawer below 768 pixels, and tables scroll inside labeled regions. It was checked in a desktop browser at that width, not on a phone.

Read the accessibility statement and evidence
Tech specs

Under the hood

Foundry technical specification
Backend
  • Python 3.12 or newer, FastAPI, and FastMCP
  • SQLAlchemy 2 (async) with asyncpg on PostgreSQL
  • Valkey for cache and push fan-out
  • boto3 for every AWS call, with an endpoint override for local emulators
  • structlog logging and OpenTelemetry traces
Console
  • React 19 and TypeScript on Vite
  • Built on the Renkara design system; the console has light, dark, and system themes
  • Commands over REST (POST /api/v1/ops/{op}) and live refresh over server-sent events
  • Sign-in through the fleet identity service; deciding and applying are role-checked
AWS integration
  • 140 provisionable resource types and 132 inventory discoverers
  • Cross-account access through assume-role with an external ID, never the task role's own credentials
  • AWS Organizations account discovery and Control Tower status
  • Pricing API estimates with a static fallback, Cost Explorer, and the Cost and Usage Report when provisioned
Rules and checks
  • 129 compliance packs with 979 rules
  • 102 advisor checks in five categories
  • Ten governance subsystems: remediation, forecasting, monitoring, synthesis, blast radius, adoption, history, access graph, mirror, and CIDR authority
Agent interface
  • 153 MCP tools over streamable HTTP at /mcp
  • Service token or admin sign-in required on every call
  • 6,871 backend tests collected (10/29/2026)
Replaces

What it stands in for

  • Hand-written infrastructure templates
  • Per-account config rule dashboards
  • Separate advisor and cost tools
Works with

Part of the Renkara fleet

  • Docket

    Remediation opens an approval card in Docket for anything outside the safe list.

  • Vigil

    When monitoring is switched on, every apply and destroy reconciles the Vigil monitors for the resources it changed.

  • Chronicle

    Foundry ships its logs and traces to Chronicle.

  • Narrative

    Narrative sites are described to Foundry through a service-token handshake.

MCP tools

Built for agents as well as people

Everything the console does is also a tool. An agent can plan, release, scan, query, and remediate through the same role checks and gates a person meets. A selection of the tools:

Stacks and deployments

  • foundry_list_stacks
  • foundry_get_stack
  • foundry_create_stack
  • foundry_plan_deployment
  • foundry_apply_deployment
  • foundry_destroy_stack
  • foundry_detect_drift
  • foundry_list_stack_versions
  • foundry_rollback_stack

Resources and releases

  • foundry_add_resource
  • foundry_update_resource
  • foundry_validate_resource
  • foundry_list_resource_types
  • foundry_create_release
  • foundry_plan_release
  • foundry_approve_release
  • foundry_apply_release

Inventory and scans

  • foundry_query_inventory
  • foundry_inventory_summary
  • foundry_scan_fleet
  • foundry_get_scan
  • foundry_untagged_inventory
  • foundry_resource_timeline

Compliance and advisor

  • foundry_list_compliance_packs
  • foundry_run_compliance_pack
  • foundry_list_compliance_findings
  • foundry_run_advisor
  • foundry_list_advisor_findings
  • foundry_advisor_savings_summary

Cost

  • foundry_cost_summary
  • foundry_cost_forecast
  • foundry_cost_anomalies
  • foundry_cost_by_taxonomy
  • foundry_stack_cost
  • foundry_chargeback_report

Network

  • foundry_cidr_check_conflict
  • foundry_cidr_suggest
  • foundry_cidr_topology
  • foundry_cidr_exhaustion_forecast
  • foundry_vpc_ip_summary

Governance and remediation

  • foundry_taxonomy_list
  • foundry_governance_coverage
  • foundry_governance_enforcement_violations
  • foundry_create_remediation_policy
  • foundry_evaluate_remediation_policies
  • foundry_approve_remediation

Synthesis, adoption, and continuity

  • foundry_synthesize_stack
  • foundry_adoption_start
  • foundry_reconstruct_state
  • foundry_create_stack_mirror
  • foundry_stack_mirror_failover
  • foundry_simulate_blast_radius
  • foundry_access_graph_run_analysis
FAQ

Questions people ask

When does Foundry open?

Foundry is currently in a closed engineering preview. The Solo and Team tiers open to everyone when it leaves the preview; join the waitlist and we'll email you the day they do. Enterprise onboarding is currently active on a rolling basis.

How do I get on the waitlist?

Email contact@renkara.com with the subject "Foundry early access" and a line about what you manage. There is no form on this site.

Is there a price?

Not yet. Nothing here states one, and no checkout exists.

Is the data in the screenshots real?

No. Every screenshot is a capture of the running app against a fictional StrataForge Robotics AWS organization, with no real account, resource, or cost data.

Does Foundry replace Terraform?

For the accounts it manages, yes: it provisions through the AWS SDK and does not use Terraform, CloudFormation templates, or CDK. It can import resources that already exist.

How complete is the compliance coverage?

Partial. Foundry ships 129 packs and 979 rules, but about half the rules read properties no discoverer collects yet, so they cannot pass.

Contact

Questions about this tool?

Write to Renkara Media Group and a person will answer.

Email contact@renkara.com