for builders shipping to AWS with coding agents — no devops team required
Your agent deploys. Waypointer verifies — before apply and after. Independent, read-only, no migration.
Waypointer scans your AWS, you confirm the map once — and every plan your agent writes is checked against it.
Read-only AWS connect in five minutes — Waypointer never writes to AWS; your agent checks with Waypointer before it applies. Works with the AWS you already have, nothing to migrate.
The problem
The code it writes is just plumbing — you never read it. Waypointer turns every change into a plain verdict: what, where, which app, what’s untouched.
The plan is checked against what is actually running — not against a state file that may already be wrong. The verdict is in plain words: app, environment, what’s affected — no Terraform to read.
Valid Terraform aimed at the primary instance stops here.
The agent says “done”. Waypointer reads AWS and shows what actually changed — including what the plan never promised.
Two resources promised, one created — you hear it from us, not from the bill.
Your agent doesn’t start from zero. It reads the map and the change history before writing a line — context survives between sessions.
“What did we do to billing last week?” — answered before you finish typing it.
How Waypointer knows what your agent is touching
Repo, application, environment, cloud account — joined once and kept joined. Your agent works across the top; Waypointer runs underneath and checks every link it touches.
“What if I already have a cloud full of resources — and nothing linking them?”
That’s the default, and that’s what the Sherlock skill is for: your agent deduces which resource belongs to which app and environment — and shows you the evidence. You just confirm.
Security
Cross-account role with a least-privilege policy: describe/list only, no data-plane reads, no PassRole, scoped by ExternalID.
No create, modify, or delete permissions exist on the role. Blocking happens in your agent — Waypointer only returns the verdict.
Deploys run with your agent’s credentials on your machine. Waypointer never holds write access to your AWS.
The exact IAM policy ships with your invite — review every line before you connect.
Connect one AWS account read-only and watch the next plan get checked.
$ npx @waypointer/cli connect
Read-only IAM role · nothing to migrate · private beta