Stigmer

Measured conclusion: Deep-tested. L2 outcome: tools_ok.

Execution graph of AWS: verified contracts, least-privilege IAM policies, pre-flight authorization.

Add to your agent

Copy this into your MCP client config:

{
  "mcpServers": {
    "Stigmer": {
      "url": "https://stigmer.network/mcp",
      "transport": "streamable-http"
    }
  }
}

Measured tools (8)

• query

  Search for verified method contracts for any library. Pass any text -- library name, method, what you're building, or an error you hit.

  Parameters:

  • sig — string
  • limit — integer
  • query — string — What are you looking for? A method name, a library, an error message, or what you're building. Examples: s3 put_object, auto_gptq import, pandas merge, ImportError peft.
  • packages — array
  • error_type — string — (deprecated -- use query instead) Error type if searching by error

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• list_services

  List all libraries and services that have verified method contracts. Use this first to discover what's available, then query for specific methods.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• list_methods

  List all methods for a given library or service. Use after list_services to drill into a specific one.

  Parameters:

  • service (required) — string — Library or service name. Get these from list_services first.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• policy

  Generate a least-privilege IAM policy for an AWS workflow. Pass a named workflow, explicit IAM actions, or a description. Returns the exact policy with confidence tier and any unresolved operations.

  Parameters:

  • workflow — string — A named workflow from list_workflows (e.g. 's3-multipart-kms')
  • operations — string — Explicit IAM action strings or SDK symbols, comma-separated (e.g. 's3:PutObject,s3:GetObject')
  • description — string — Describe the workflow (e.g. 'upload a large file to S3 with KMS')

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• list_workflows

  List the curated named workflows that can generate least-privilege IAM policies.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• verify

  Feed a generated policy back to AWS's own policy evaluation engine (SimulateCustomPolicy) and confirm it grants exactly the intended operations and nothing extra. Returns verified (True|False|unknown), grants_all, grants_extra. Requires AWS credentials; without them verified=unknown with the reason. Wildcarded operations are expanded to concrete actions first.

  Parameters:

  • policy — string — Optional. A complete IAM policy JSON document to verify.
  • workflow — string — A named workflow from list_workflows to generate and then verify
  • operations — string — Intended IAM actions, comma-separated. Required if policy is provided.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• authorize

  Pre-flight authorization check for an AWS operation. Resolves the IAM actions the operation requires, then asks AWS's own policy simulator (SimulatePrincipalPolicy) whether the current role (or a given principal) allows them. Returns resolution (exact|partial|unresolved) and evaluation (allowed|denied|unknown) as separate fields. Requires AWS credentials; without them evaluation=unknown with the reason.

  Parameters:

  • workflow — string — A named workflow from list_workflows (e.g. 's3-multipart-kms')
  • operations — string — IAM action strings or SDK symbols, comma-separated (e.g. 's3:PutObject' or 's3.PutObject')
  • principal_arn — string — Optional. IAM role/user ARN to simulate against. Defaults to the current caller via sts:GetCallerIdentity.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• register

  Register a fix. Three actions: confirm (it worked), append_thread (variant worked), new_receipt (nothing matched, I fixed it).

  Parameters:

  • action (required) — string
  • library (required) — string
  • symbol (required) — string
  • env — string
  • fix — string
  • error — string
  • version — string
  • error_class — string
  • receipt_sig — string

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

Publisher website Repository

Measured by MCPYP probing. Untested fields are omitted, never estimated. Listing is always free; MCPYP never proxies calls or stores user tokens.