CoreStack

CoreStack is a multi-cloud governance and security platform that unifies FinOps (cost visibility, budgets, anomaly detection, rightsizing and commitment optimization), CloudOps (workload lifecycle, tagging, automation and self-service), SecOps/compliance (policy guardrails, posture management and continuous assessment against ISO, NIST, HIPAA, PCI DSS, CIS and the AWS Well-Architected Framework), and Graphion, its AI-native CNAPP layer covering SBOM, container findings and vulnerability intelligence, across AWS, Microsoft Azure, Google Cloud and Oracle Cloud Infrastructure. Every one of those capabilities is exposed through the CoreStack External API — a Swagger 2.0 contract of 838 operations across 767 paths, published live at the API host — and, since 2026, through a hosted unified MCP server that surfaces 100 documented tools to AI clients over OAuth or API key headers.

CoreStack publishes 1 API on the APIs.io network: External API. Tagged areas include cloud-governance, finops, cloud-cost-management, cloud-security-posture-management, and compliance.

The CoreStack catalog on APIs.io includes 1 event-driven AsyncAPI specification.

CoreStack’s developer surface includes documentation, API reference, getting-started guide, support, engineering blog, pricing, signup flow, and 28 more developer resources.

🌐 Visit website 📡 Source on GitHub
61.9/100 strong ▬ flat Agent 53/100 agent ready Full breakdown ↓
scored 2026-08-17 · rubric v0.11.0
2 APIs 2 MCP Servers
cloud-governancefinopscloud-cost-managementcloud-security-posture-managementcompliancemulti-cloudcnapppolicy-as-codecloudopsmcpagent-nativekubernetes

Kin Score

Kin Score Kin Score How this is scored →
scored 2026-08-17 · rubric v0.11.0
Composite quality — 61.9/100 · strong
Contract Quality 11.0 / 21
Developer Ergonomics 11.5 / 17
Commercial Clarity 14.3 / 17
Operational Transparency 4.9 / 11
Governance 2.1 / 10
Discoverability 7.4 / 9
Regulatory Posture 10.7 / 15
Agent readiness — 53/100 · agent ready
Machine-Readable Contract 18 / 18
Agentic Access Contract 0 / 10
MCP Server 12 / 12
Machine-Readable Auth 10 / 10
Idempotency 0 / 9
Stable Error Semantics 8 / 8
Request/Response Examples 0 / 7
Rate-Limit Signaling 7 / 7
Typed Event Surface 6 / 6
Agent Skills 5 / 5
Well-Known Catalog 0 / 4
Consent & Bot Identity 0 / 3
A2A Agent Card 0 / 8
Dry-Run / Simulate Mode 0 / 4
Regulatory Posture applies to this provider. Its tags matched the Insurance regime, so Regulatory Posture carries 15 points of the composite. If this regime is wrong for your business, say so on your provider repo — the applicability map is public and we will correct it.
The six quality facets above are damped to 85 points between them, because the conditional facet above carries the other 15. That is why each facet's contribution is shown against a damped maximum: raising a quality facet moves the composite by 85% of its nominal weight, not 100%. The full arithmetic is at apis.io/rating/.
Improve this rating by publishing the missing artifacts — every area above can be raised, and the full rubric is at apis.io/rating/. This rating is computed from github.com/api-evangelist/corestack: open an issue to ask a question, or submit a pull request to add artifacts. Want it done for you? Prioritized profiling — $2,500 →

APIs 2

Individual APIs this provider publishes, each with its own machine-readable definition.

CoreStack External API

REST API covering the whole CoreStack governance surface — authorization, identity and RBAC, guardrail policies, account governance, operations and automation, security, cost an...

CoreStack MCP Server

Hosted, unified Model Context Protocol server exposing 100 documented tools across five domains — Common/Auth (10), FinOps (24), Graphion (45), Assessment (15) and Workload (6) ...

Open Collections 1

Open, tool-agnostic API collections (OpenAPI-derived and Bruno).

CoreStack External API

OPEN COLLECTION

MCP Servers 2

Model Context Protocol servers that expose these APIs to AI agents.

corestack-mcp.yml

MCP SERVER

mcp

MCP SERVER

Pricing Plans 1

Published pricing tiers and plan structures.

Corestack Plans Pricing

6 plans

PLANS

Rate Limits 1

Documented rate limits and quota policies.

Corestack Rate Limits

0 limits

RATE LIMITS

Event Specifications 1

AsyncAPI definitions for this provider's event-driven and streaming APIs.

Corestack Webhooks

ASYNCAPI

Security Posture 2

Authentication, domain security, vulnerability disclosure, and trust-center signals.

Corestack Authentication

apiKey/oauth2 · 4 schemes

SECURITY

Corestack Domain Security

TLSv1.3 · HSTS · DNSSEC · DMARC

SECURITY

Scopes 1

OAuth scopes governing access to this provider's APIs.

Corestack Scopes

OAuth 2.0 · no documented scopes

0 scopes

SCOPES

Resources

Get Started 4

Portal, sign-up, and the first successful call

DeveloperPortal
DeveloperPortal
 GettingStarted
GettingStarted
 SignUp
SignUp
 Login
Login

Documentation 2

Reference material describing how the API behaves

Documentation
Documentation
 APIReference
APIReference

Agent Surfaces 4

MCP servers, agent skills, and machine-readable catalogs

LLMsTxt
LLMsTxt
 WellKnown
WellKnown
 MCPServer
MCPServer
 AgentSkill
AgentSkill

Design & Contract 6

Pagination, idempotency, versioning, errors, and events

Conventions
Conventions
 ErrorCatalog
ErrorCatalog
 Lifecycle
Lifecycle
 Conformance
Conformance
 DataModel
DataModel
 Webhooks
Webhooks

Build 2

SDKs, sample code, and the tooling you integrate with

ToolCrosswalk
ToolCrosswalk
 Packages
Packages

Access & Security 4

Authentication, authorization, and security posture

DomainSecurity
DomainSecurity
 Compliance
Compliance
 Authentication
Authentication
 OAuthScopes
OAuthScopes

Operate 6

Status, limits, changes, and where to get help

Support
Support
 StatusPage
StatusPage
 ChangeLog
ChangeLog
 ChangeLog
ChangeLog
 Roadmap
Roadmap
 RateLimits
RateLimits

Commercial 4

Pricing, plans, and the legal terms of use

Pricing
Pricing
 TermsOfService
TermsOfService
 PrivacyPolicy
PrivacyPolicy
 Plans
Plans

Company 2

The organization behind the API

Website
Website
 Blog
Blog

Other 1

Properties that don't map to a standard resource type

Overlay
Overlay

Source (apis.yml)

apis.yml Raw ↑ 
aid: corestack
name: CoreStack
x-enrichment:
  date: '2026-08-11'
  status: enriched
  artifacts_added: 25
  pass: local-v1
description: CoreStack is a multi-cloud governance and security platform that unifies FinOps (cost visibility, budgets, anomaly
  detection, rightsizing and commitment optimization), CloudOps (workload lifecycle, tagging, automation and self-service),
  SecOps/compliance (policy guardrails, posture management and continuous assessment against ISO, NIST, HIPAA, PCI DSS, CIS
  and the AWS Well-Architected Framework), and Graphion, its AI-native CNAPP layer covering SBOM, container findings and vulnerability
  intelligence, across AWS, Microsoft Azure, Google Cloud and Oracle Cloud Infrastructure. Every one of those capabilities
  is exposed through the CoreStack External API — a Swagger 2.0 contract of 838 operations across 767 paths, published live
  at the API host — and, since 2026, through a hosted unified MCP server that surfaces 100 documented tools to AI clients
  over OAuth or API key headers.
url: https://raw.githubusercontent.com/api-evangelist/corestack/refs/heads/main/apis.yml
image: https://www.corestack.io/wp-content/uploads/Agentic-Governance-OS-Unified-Governance-Across-Cloud-SaaS-and-AI.png
x-type: company
x-source: harvest:secondary-market
specificationVersion: '0.21'
created: '2026-08-11'
modified: '2026-08-11'
tags:
- cloud-governance
- finops
- cloud-cost-management
- cloud-security-posture-management
- compliance
- multi-cloud
- cnapp
- policy-as-code
- cloudops
- mcp
- agent-native
- kubernetes
apis:
- name: CoreStack External API
  description: REST API covering the whole CoreStack governance surface — authorization, identity and RBAC, guardrail policies,
    account governance, operations and automation, security, cost and budgets, access, resources, compliance assessments and
    self-service. Published as a live Swagger 2.0 document with 838 uniquely-identified operations. Authentication is a short-lived
    X-Auth-Token minted from an Access Key / Secret Key pair, paired with an X-Auth-User header.
  humanURL: https://docs.corestack.io/reference
  baseURL: https://api.corestack.io/
  tags:
  - cloud-governance
  - finops
  - compliance
  - multi-cloud
  - policy-as-code
  properties:
  - type: OpenAPI
    url: openapi/corestack-external-api-openapi-original.json
  - type: Documentation
    url: https://docs.corestack.io/docs/corestack-api-modules
  - type: APIReference
    url: https://docs.corestack.io/reference
  - type: Authentication
    url: authentication/corestack-authentication.yml
  - type: Conventions
    url: conventions/corestack-conventions.yml
  - type: ErrorCatalog
    url: errors/corestack-problem-types.yml
  - type: DataModel
    url: data-model/corestack-data-model.yml
  - type: Overlay
    url: overlays/corestack-external-api-overlay.yaml
- name: CoreStack MCP Server
  description: Hosted, unified Model Context Protocol server exposing 100 documented tools across five domains — Common/Auth
    (10), FinOps (24), Graphion (45), Assessment (15) and Workload (6) — at a single /mcp endpoint on each regional environment.
    Streamable HTTP transport, authenticated either by OAuth 2.1 (authorization code + PKCE, dynamic client registration)
    or by X-API-Access-Key / X-API-Secret-Key headers. Disabled by default and enabled per account by an Account Administrator;
    every tool call inherits the calling user's existing CoreStack role permissions.
  humanURL: https://docs.corestack.io/docs/mcp-tool-guide
  baseURL: https://cloud.corestack.io/mcp
  tags:
  - mcp
  - agent-native
  - finops
  - cnapp
  - cloud-governance
  properties:
  - type: MCPServer
    url: mcp/corestack-mcp.yml
  - type: MCPServer
    url: https://cloud.corestack.io/mcp
  - type: ToolCrosswalk
    url: mcp/corestack-tool-crosswalk.yml
  - type: Documentation
    url: https://docs.corestack.io/docs/mcp-client-configuration
  - type: OAuthScopes
    url: scopes/corestack-scopes.yml
maintainers:
- FN: Kin Lane
  email: kin@apievangelist.com
- FN: APIs.json
  email: info@apis.io
common:
- type: DomainSecurity
  url: security/corestack-domain-security.yml
- type: Website
  url: https://www.corestack.io/
- type: DeveloperPortal
  url: https://docs.corestack.io/
- type: Documentation
  url: https://docs.corestack.io/
- type: APIReference
  url: https://docs.corestack.io/reference
- type: GettingStarted
  url: https://docs.corestack.io/docs/corestack-api-modules
- type: Support
  url: https://support.corestack.io/portal/en/home
- type: Blog
  url: https://www.corestack.io/blog/
- type: Pricing
  url: https://www.corestack.io/solutions/pricing/
- type: SignUp
  url: https://www.corestack.io/contact-us/
- type: Login
  url: https://cloud.corestack.io/auth/login
- type: TermsOfService
  url: https://www.corestack.io/terms-of-service/
- type: PrivacyPolicy
  url: https://www.corestack.io/privacy-policy/
- type: StatusPage
  url: https://corestack.statuspage.io/
- type: ChangeLog
  url: https://docs.corestack.io/changelog
- type: ChangeLog
  url: changelog/corestack-changelog.yml
- type: Roadmap
  url: https://docs.corestack.io/docs/external-apis-62-2603
- type: Compliance
  url: https://www.corestack.io/blog/corestack-achieves-soc-2-type-ii-certification/
- type: LLMsTxt
  url: llms/corestack-llms.txt
- type: WellKnown
  url: well-known/corestack-well-known.yml
- type: MCPServer
  url: mcp/corestack-mcp.yml
- type: ToolCrosswalk
  url: mcp/corestack-tool-crosswalk.yml
- type: Authentication
  url: authentication/corestack-authentication.yml
- type: OAuthScopes
  url: scopes/corestack-scopes.yml
- type: Conventions
  url: conventions/corestack-conventions.yml
- type: ErrorCatalog
  url: errors/corestack-problem-types.yml
- type: Lifecycle
  url: lifecycle/corestack-lifecycle.yml
- type: Conformance
  url: conformance/corestack-conformance.yml
- type: DataModel
  url: data-model/corestack-data-model.yml
- type: Plans
  url: plans/corestack-plans-pricing.yml
- type: RateLimits
  url: rate-limits/corestack-rate-limits.yml
- type: Webhooks
  url: asyncapi/corestack-webhooks.yml
- type: AgentSkill
  url: skills/_index.yml
- type: Overlay
  url: overlays/corestack-external-api-overlay.yaml
- type: Packages
  url: packages/corestack-packages.yml