Cloudlist CLI
The CLI collects hostnames and IP addresses from cloud accounts so agents can prepare a consolidated asset inventory.
- 1,057 ★ on the repository
- Last commit
- MIT
Extended access
Why this level
- The CLI uses cloud credentials to read assets and can expose internal addresses in saved exports.
Install
The author does not provide a one-line install. Open the repository and follow the README.
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- The CLI uses cloud credentials to read assets and can expose internal addresses in saved exports.
This is third-party code. Review the repository files before installing.
What it does
Cloudlist queries configured cloud providers and lists discovered assets. An agent can combine addresses from multiple accounts, select a service and pass results to an approved inventory process. JSON and quiet output support further processing. Connections use a provider file or environment-based discovery for supported platforms. Filters select accounts, providers and services. GCP offers project-specific APIs and organization-level asset inventory.
Who it is for. Cloud inventory specialists collecting assets from multiple authorized accounts.
Good fit when
- An organization uses several clouds and needs one address inventory.
- A report should contain assets from one provider only.
- Private IP addresses should be excluded before an approved audit.
- A team compares project-level GCP assets with organization inventory.
Not a fit when
- The task is to provision or delete cloud resources.
- The account is expected to reveal projects outside its permissions.
- You need a standalone vulnerability scanner without additional tools.
Example request
Inventory authorized AWS and GCP accounts, select hostnames and save JSON without starting scanners.Limitations
Inventory coverage depends on configured providers and credential permissions; inaccessible assets will not appear. Environment discovery covers AWS, GCP, Azure and Kubernetes, so other connections need explicit configuration. For GCP, select the API scope and permissions carefully: project discovery is different from organization inventory. Exported addresses describe infrastructure, so share them with agents and downstream tools only within the approved workflow.
How to disable. Stop Cloudlist and scheduled callers. Remove unused credentials from the provider configuration or environment.
FAQ
How do I view supported options?
Run `cloudlist -h` for filters and output options.
Can I print IP addresses only?
Yes, use `-ip`; `-host` selects hostnames.
How do I exclude private addresses?
Add `-exclude-private` when generating the list.
Is JSON output available?
Yes. Choose `-json` for machine-readable results.
Does it automatically scan vulnerabilities?
No. Cloudlist creates an inventory; separate tools perform further assessments.
Discussion
No questions or reviews yet.
Related
CLI toolsuncover is a network-asset search CLI that queries external indexes; discovered hosts still need separate availability checks.
httpx is a ProjectDiscovery CLI that reports on a list of web endpoints using selected fields and a configured request rate.
Coi is an Incus container CLI that preserves edits on the host under the file owner, even after the environment is removed.
A CLI agent for authorized pentesting: from a natural-language brief it runs recon, finds and verifies vulnerabilities and prepares a report
A pack of about fifty Claude Code subagents for authorized pentesting: planning, recon, exploit research and chaining, post-exploitation, detection and reportin
A local dashboard for Claude Code, Codex CLI and OpenCode: what the agent loads, its token cost and an MCP server security scan
README in short
Configuration supports multiple accounts per provider, with service inclusion and exclusion filters.