# Stigmer [Health: Active]

**Category:** ☁️ Cloud Platforms  
**Repository:** https://github.com/LNSHRIVAS/stigmer  
**GitHub Stars:** 0  
**Views:** 2  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/stigmer

## Description
Execution graph of AWS: verified method contracts, IAM permissions, and least-privilege policies.

## Tools
Capabilities this server exposes over MCP:

- **query** — Search for verified method contracts for any library. Pass any text -- library name, method, what you're building, or an error you hit.
- **list_services** — List all libraries and services that have verified method contracts. Use this first to discover what's available, then query for specific methods.
- **list_methods** — List all methods for a given library or service. Use after list_services to drill into a specific one.
- **policy** — Generate a least-privilege IAM policy for an AWS workflow. Pass a named workflow, explicit IAM actions, or a description. Returns the exact policy with confidence tier and any unresolved operations.
- **list_workflows** — List the curated named workflows that can generate least-privilege IAM policies.
- **verify** — Feed a generated policy back to AWS's own policy evaluation engine (SimulateCustomPolicy) and confirm it grants exactly the intended operations and nothing extra. Returns verified (True|False|unknown), grants_all, grants_extra. Requires AWS credentials; without them verified=unknown with the reason. Wildcarded operations are expanded to concrete actions first.
- **authorize** — Pre-flight authorization check for an AWS operation. Resolves the IAM actions the operation requires, then asks AWS's own policy simulator (SimulatePrincipalPolicy) whether the current role (or a given principal) allows them. Returns resolution (exact|partial|unresolved) and evaluation (allowed|denied|unknown) as separate fields. Requires AWS credentials; without them evaluation=unknown with the reason.
- **register** — Register a fix. Three actions: confirm (it worked), append_thread (variant worked), new_receipt (nothing matched, I fixed it).

## Claude Desktop Quick Installation
Remote MCP endpoint (confidence: high). Install path detected from listing signals. Add as a URL/SSE server in your client:

```json
"mcpServers": {
  "stigmer": {
    "url": "https://stigmer.network/mcp"
  }
}
```

## Documentation

## What the Stigmer MCP server does

The Stigmer MCP server gives AI agents a structured reference for AWS execution paths, SDK methods, and IAM permissions. Its contract data covers more than 30,000 operations across 380 AWS services. Each contract can include typed boto3 and aws-sdk-js signatures, authoritative documentation links, pagination behavior, asynchronous waiter information, declared errors, required IAM actions, and links to downstream calls.

Agents can search by method, SDK library, AWS service, error message, or a description of what they are building. The service also provides curated workflows that can be used as inputs for IAM policy generation. When an agent encounters an undocumented trap, the `register` tool can record a confirmation, append a thread, or create a receipt for later use.

## How it works

Requests are sent to Stigmer through MCP. Discovery tools narrow the available data: `list_services` shows libraries and services, `list_methods` drills into a selected library, and `list_workflows` returns named workflows available for policy generation. The `query` tool provides broader search across the contract data.

The `policy` tool creates a least-privilege IAM policy from a named workflow, a set of explicit IAM actions, or a natural-language workflow description. It also reports a confidence tier for the result. `authorize` resolves the actions needed for an operation and asks AWS's `SimulatePrincipalPolicy` evaluator whether the current role permits them. Its response separates the action resolution from the AWS evaluation.

For policy validation, `verify` submits a generated policy to AWS through `SimulateCustomPolicy`. This checks whether the policy grants the intended operations without granting additional permissions. The underlying contract data is derived from machine-readable specifications and includes IAM action mappings from the referenced IAM dataset.

## Setup and configuration

Add the remote MCP endpoint to an MCP client configuration:

```json
{
  "mcpServers": {
    "stigmer": {
      "url": "https://stigmer.network/mcp"
    }
  }
}
```

The Stigmer MCP server does not require a Stigmer account or API key. For Strands, the endpoint is passed to `MCPClient` when constructing an agent.

The project publishes `llms.txt` and `skill.md` files for agent onboarding and usage guidance.

## Tools and capabilities

- `query`: Search methods, services, libraries, errors, or implementation goals; optionally restrict searches to an SDK such as boto3 or aws-sdk-js.
- `policy`: Generate a least-privilege IAM policy from a workflow name, explicit actions, or a description.
- `authorize`: Resolve required actions and evaluate the current role with AWS's principal-policy simulator.
- `verify`: Evaluate a custom policy and check for intended access without extra permissions.
- `list_workflows`: Enumerate named workflows supported by policy generation.
- `list_services`: Discover supported libraries and services.
- `list_methods`: Inspect methods within a chosen library.
- `register`: Submit confirmations, discussion threads, or new receipts for encountered traps.

## Limitations and notes

The Stigmer MCP server is focused on AWS execution contracts and IAM analysis rather than general-purpose cloud management. Policy results depend on the available contract specifications and may carry different confidence tiers. Authorization and verification use AWS policy-simulation operations, so their evaluations concern the supplied AWS identity or custom policy. Stigmer is built on Nostr, but the provided setup does not describe a local package installation or additional configuration beyond the MCP endpoint.

_Full upstream README: https://allmcps.com/mcp/stigmer/readme_