io.github.fernando-moretesPublished by GitHub account fernando-moretesv0.5.0Updated Nov 7, 2026
Evidence-first architecture workbench: 48 deterministic tools, 10 architect personas, any cloud
Deterministic architecture workbench: 48 tools and 10 architect personas for requirements, cloud design, cost, reliability and IaC review.
Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.
Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.
Read https://sourceweft.com/mcp/io.github.fernando-moretes%2Fmoretes-aws-architect-mcp/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.Add this to your client's mcpServers config.
{
"mcpServers": {
"moretes-architect": {
"type": "http",
"url": "https://mcp.moretes.com/mcp"
}
}
}[CI] [CodeQL] [MCP Registry] [Licença MIT] [Versão 0.5.0] [48 ferramentas] [Sem chamadas a modelo] [Sem chave de API] [Node 22 e 24] [Curso grátis em vídeo]
Claude Code · Codex · Kiro · Cursor · VS Code · Gemini CLI · Amazon Q · Claude Desktop
Conectar ·
Ver funcionando ·
Ferramentas ·
Pipeline ·
Privacidade ·
Tutorial e curso ·
English
Um servidor MCP que coloca 48 ferramentas determinísticas de arquitetura e 10 personas de arquiteto dentro do seu agente de código. O modelo do seu cliente raciocina; o servidor devolve cálculos, estruturas, fontes oficiais e lacunas explícitas. O servidor nunca chama um modelo, nunca acessa a sua conta pela internet e não precisa de chave de API.
Feito por Fernando Azevedo, Arquiteto de Tecnologia da Informação Especialista e AWS Community Builder (AI Engineering). É o que eu uso para decidir arquitetura no dia a dia, aberto para a comunidade usar, auditar e estender.
Pede uma API, ele pergunta antes de sugerir. O agente chama requirements_check e depois architect_panel; nenhum número é inventado.
Calcula, não chuta. No Kiro, latency_budget soma os passos em série, pega o maior dos paralelos e mostra onde o tempo vai.
[Kiro chamando latency_budget: 1460 de 2000 ms, pagamento com 900 ms]
Trava o apply perigoso no pipeline. O mesmo motor roda offline como CLI, com Markdown, JSON ou SARIF e exit code por severidade.
[Terminal rodando terraform_plan_review no CLI, achados high e exit code 1]
Os GIFs são trechos dos vídeos do curso gratuito, narrados na minha voz, com as chamadas e as respostas reais do servidor. Os JSON completos estão em docs/examples.
[Instalar no Cursor] [Instalar no VS Code]
Sem chave, sem cadastro:
Kiro (.kiro/settings/mcp.json), Cursor (.cursor/mcp.json) e Amazon Q (mcp.json):
VS Code (.vscode/mcp.json):
Claude Desktop e qualquer cliente stdio, depois de rodar local:
Passo a passo de cada cliente, verificação e erros comuns: docs/clients.md.
[Página fernando.moretes.com/mcp: abas com o comando de cada cliente]
Cota pública: 300 requisições por dia por cliente e 3.000 no total; acima disso, 429. O mesmo servidor responde em https://fernando.moretes.com/api/mcp, mas esse endereço passa pelo site e todos os seus usuários dividem uma única cota diária; use a URL direta para ter a sua. Para volume ou entradas privadas, rode local.
Depois de conectar, peça ao agente:
"Use o Moretes Architect. Preciso de uma API de pedidos para um marketplace, 300 pedidos por minuto no pico. Pergunte o que falta antes de sugerir, convoque os arquitetos de solução, segurança e FinOps, compare Lambda e ECS, desenhe o C4 e registre a decisão em um ADR."
[Os quatro usos: decidir, calcular, revisar, proteger agentes]
iam_policy_review lê política IAM da AWS, role definition do Azure e bindings do Google Cloud (provider). Toda ferramenta de cálculo e revisão publica outputSchema, e o cliente valida a saída.
Mais 20 prompts (10 fluxos e um architect_<papel> por persona), 18 resources (moretes://guide, moretes://boundaries, moretes://tools, moretes://personas/<id>, moretes://skills/<id>) e, só no modo local, 5 ferramentas opcionais de conta AWS e federação com os servidores oficiais.
Guia de cada ferramenta: docs/tools-guide.md · Schemas: docs/tools.md · Saídas reais: docs/examples · Personas: docs/personas.md
Na versão 0.5.0, node dist/cli.js manifest exporta os contratos públicos completos com hashes por ferramenta, incluindo schemas de saída e anotações de segurança. Como verificar e comparar contratos. A instalação local e o endpoint HTTP permitem comparar os mesmos contratos; confira a versão em uso antes de comparar.
c4_modelEntrada: pessoas, sistemas e relações explícitas. Saída: Mermaid validado (id duplicado, aresta solta e rótulo com sintaxe perigosa são recusados). O GitHub renderiza abaixo exatamente o que a ferramenta devolveu em docs/examples/c4_model.json:
mcp_server_review recebe o tools/list de outro servidor e procura texto de instrução escondido na descrição, parâmetros perigosos, anotação mentirosa e nomes duplicados. Contra o servidor de exemplo em docs/examples/mcp_server_review.json:
Os servidores MCP de nuvem são operacionais: executam na conta. Faltava a parte de antes: levantar requisitos, comparar com honestidade entre provedores, calcular em vez de chutar, revisar com evidências e registrar a decisão. Este projeto faz essa parte, no mesmo lugar onde o código nasce, sem custo de inferência no servidor e sem receber credenciais.
Três regras atravessam todas as ferramentas:
Roda offline e sem cota. O SARIF entra no code scanning do GitHub; o Markdown vai para o resumo do job. GitHub Actions, GitLab CI e pre-commit prontos em docs/pipelines.md.
Detalhes e exemplos: docs/integrations-clients.md.
As ferramentas de conta AWS (identidade STS, recursos por tag, histórico de custo) e a federação com os servidores oficiais são opt-in por variável de ambiente e só existem no stdio: o HTTP público nunca as expõe. Detalhes em docs/clients.md e docs/integrations.md. O pacote está publicado no npm. Use npx --yes --package [email protected] moretes-architect list para o CLI ou npx --yes --package [email protected] moretes-aws-architect-mcp para stdio.
[Página do Moretes Architect MCP em fernando.moretes.com/mcp]
Em fernando.moretes.com/mcp: conexão por cliente, um playground que chama o servidor de verdade, as ferramentas por grupo, as personas, troubleshooting e FAQ. O curso tem dez aulas, cada uma com vídeo, áudio e texto, quizzes e certificado:
aws_knowledge_* (a consulta vai para o MCP oficial da AWS) e github_public_repository (api.github.com). Todo o resto é cálculo local./stats.json registram apenas nomes de ferramentas, sem argumentos, resultados ou identidade; não representam usuários únicos ou análises bem-sucedidas.sha256(dia + IP) com validade de dois dias; o IP bruto não é guardado.Tudo em PRIVACY.md e SECURITY.md.
[Landing do servidor público com o comando de cada cliente e as ferramentas por grupo]
A role da Lambda escreve e lê contadores somente na própria tabela DynamoDB e escreve nos próprios logs. Deploy por change set CloudFormation revisado. Design · Custos · Runbook · Evidências do deploy
41 testes offline, 99% das linhas cobertas, cobrem protocolo, cálculos, revisões, isolamento entre público e local, limites de entrada e federação. CI em Node 22 e 24, CodeQL, Dependabot e SBOM CycloneDX a cada release. Cada saída documentada em docs/examples é um teste: se uma ferramenta mudar de comportamento, o CI acusa. docs/tools.lock.json guarda o hash do nome, da descrição e do schema de cada ferramenta, então qualquer mudança no que o modelo do cliente lê aparece no diff.
Issues e PRs em português ou inglês. Use os templates: bug ou proposta de ferramenta (problema, entrada, saída esperada, limite). Uma ferramenta nova precisa de schema estrito, fronteira de dados externos explícita, limitações na saída e teste. Se você é AWS Community Builder, organiza User Group ou dá aula: o curso e os vídeos são livres para usar em sala.
Clientes · Ferramentas · Personas · Pipelines · FAQ · Troubleshooting · Glossário · Novidades · Workshop · Contribuir · Conduta · Roadmap · Changelog · Atribuições
Projeto independente. Não é um produto da AWS, nem revisão Well-Architected oficial, nem certificação de segurança, nem cotação de preço. AWS e outros nomes pertencem aos seus donos.
Source: README.md at commit 1965e0d
Convene architect personas (solution, enterprise, business, data, infrastructure, software, AI, security, governance, FinOps) on a subject: each returns its questions, checks, deliverables and the workbench tools to call. Lens, not a verdict.
rolesrequiredsubjectrequiredknownFactsrequiredartifactTyperequiredHeuristic architecture and security scan of source code pasted as text (any language): secrets, insecure calls, SQL built by concatenation, disabled TLS, hardcoded endpoints, missing timeouts and retry hazards. Not a linter or SAST replacement.
coderequiredfilenamerequiredlanguagerequiredReview a dependency manifest (package.json, requirements.txt, pyproject, go.mod, pom.xml, Gemfile, Cargo.toml as text) for unpinned ranges, git or URL sources, wildcard versions and missing lockfile hints.
contentrequiredfilenamerequiredlockfilePresentTurn a workload brief into explicit requirements, gaps and research questions. No inferred SLA or budget.
workloadrequiredconstraintsrequiredrequirementsrequiredSelect a reference architecture by explicit workload pattern; returns tradeoffs, questions and Mermaid. provider maps the AWS services to Azure, GCP, OCI or open source equivalents.
patternrequiredproviderrequiredworkloadrequiredCompare curated AWS service families against user constraints. No automatic winner or fabricated scores.
familyrequiredconstraintsrequiredGenerate an ADR from explicit alternatives, decision and consequences. Does not invent acceptance.
titlerequiredstatusrequiredcontextrequiredoptionsrequireddecisionrequiredconsequencesrequiredOrganize evidence by six pillars. A met control without evidence is unknown, never certified.
controlsrequiredworkloadrequiredCreate STRIDE review prompts for explicitly supplied assets and trust boundaries. Review aid, not a scanner.
assetsrequiredboundariesrequireddataClassificationrequiredDesign a controlled failure drill with observable success criteria and stop conditions; never executes it.
targetrequiredfailurerequiredoperationrequiredCalculate concurrency and daily data volume from explicit traffic assumptions. No service sizing guarantee.
headroomrequiredpayloadKBrequireddurationMsrequiredrequestsPerSecondrequiredCalculate an auditable scenario using caller-supplied unit rates and source URLs. Does not guess AWS prices or credit coverage.
itemsrequiredcurrencyrequiredcontingencyPercentrequiredCalculate an availability error budget for a chosen period.
periodDaysrequiredavailabilityPercentrequiredusedDowntimeMinutesrequiredPrepare phased discovery, pilot, migration and rollback gates; includes AWS Transform integration discovery.
sourcerequiredtargetrequiredstrategyrequiredconstraintsrequiredBuild Mermaid from explicit nodes and edges. Sanitizes labels and rejects dangling edges.
edgesrequirednodesrequiredTurn an architecture decision into a delivery checklist with validation gates.
decisionrequireddeliverablesrequiredDesign a per-operation authorization and recovery contract for an agent tool.
operationrequiredreversiblerequiredresourceScoperequiredapprovalRequiredrequiredmaxDurationSecondsrequiredBuild C4 context or container diagrams (Mermaid) from explicit people, systems, containers and relations. Validates endpoints; no infrastructure discovery.
levelrequiredpeoplerequiredsystemrequiredrelationsrequiredcontainersrequiredexternalSystemsrequiredBuild a Mermaid sequence diagram from participants and ordered messages, with optional activation, notes and alt/loop blocks. Rejects unknown participants.
titlerequiredmessagesrequiredparticipantsrequiredMap a cloud capability to equivalent managed services on AWS, Azure, Google Cloud, OCI and open source. Names as of the snapshot date; verify current naming, regions and pricing before deciding.
torequiredfromrequiredquerycategoriesClassify data elements, map them to regulation hints (LGPD, GDPR, PCI DSS, HIPAA) and list handling controls and open questions. Review aid, not legal advice.
systemrequiredelementsrequiredjurisdictionsrequiredHeuristic review of an OpenAPI 3.x document (JSON): security, pagination, error responses, idempotency, versioning and documentation gaps. Not a linter replacement.
documentrequiredDesign an event contract: envelope fields, schema evolution rules, idempotency, ordering, DLQ and replay decisions for a named business event. Deterministic template with open questions.
orderingrequiredproducerrequiredconsumersrequiredeventNamerequiredpayloadFieldsrequireddeliveryGuaranteerequiredSplit an end-to-end latency objective across hops and show which hops exceed their share. Pure arithmetic over caller-supplied estimates.
hopsrequiredtargetMsrequiredpercentilerequiredSize consumers with Little's law and stable Erlang C: utilization, wait probability, backlog drain time and target consumers. At most 100,000 total concurrent slots (consumers × concurrency).
consumersrequiredserviceTimeMsrequiredbacklogMessagesrequiredarrivalsPerSecondrequiredtargetUtilizationPercentrequiredmaxConcurrencyPerConsumerrequiredCompare disaster recovery tiers (backup-and-restore, pilot light, warm standby, active-active) against RTO, RPO and data constraints; returns feasible tiers and required capabilities, not a guarantee.
dataGBrequiredworkloadrequiredrpoMinutesrequiredrtoMinutesrequiredstatefulComponentsrequiredregulatoryResidencyreplicationBandwidthMbpsCompute an exponential backoff schedule with jitter, the worst-case wait and whether it fits a deadline; adds idempotency and circuit-breaker guidance.
capMsrequiredfactorrequiredjitterrequireddeadlineMsbaseDelayMsrequiredmaxAttemptsrequiredoperationIdempotentrequiredProject storage volume and relative cost over time from ingest, retention, compression, replication and growth; suggests tiering thresholds.
monthsrequiredhotDaysrequireddailyIngestGBrequiredretentionDaysrequiredcompressionRatiorequiredreplicationFactorrequiredmonthlyGrowthPercentrequiredhotTierPricePerGBMonthcoldTierPricePerGBMonthCompute cost per unit (request, customer, transaction), fixed versus variable split and the volume at which the marginal cost crosses a target. Caller supplies costs; no provider prices are guessed.
unitsrequiredperiodrequiredcurrencyrequiredfixedCostsrequiredvariableCostsrequiredtargetCostPerPrimaryUnitGenerate a blameless postmortem document from incident facts: timeline, impact, detection, contributing factors and owned action items. Rejects action items without owner and due date.
titlerequiredimpactrequiredseverityrequiredtimelinerequiredstartedAtrequireddetectedAtrequiredresolvedAtrequiredactionItemsrequiredmitigatedAtrequiredwhatWentWellrequiredcontributingFactorsrequiredGenerate an operational runbook from service facts: alerts, diagnostic steps, remediation, rollback, escalation and verification. Template with explicit placeholders for what the caller did not provide.
ownerrequiredalertsrequiredservicerequiredrollbackrequireddashboardsrequiredescalationrequireddiagnosticsrequiredremediationrequiredDesign an evaluation plan for an AI agent: golden set sizing, metrics, judge rubric, red-team cases and regression cadence from explicit capabilities and risks.
agentrequiredrisksrequiredtoolsrequiredcapabilitiesrequiredreleaseCadencerequiredEnumerate injection paths and controls for an agent from its tools and untrusted data sources; produces a checklist with status to fill, not a scan.
agentrequiredtoolsrequiredhumanInLooprequireduntrustedSourcesrequiredPlan a retrieval-augmented generation pipeline from corpus facts: chunking, embedding, indexing, authorization, evaluation and cost drivers, with open questions. No vendor is chosen for you.
corpusrequireduseCaserequiredauthorizationrequiredlatencyBudgetMsrequiredcitationsRequiredrequiredHeuristic safety review of ANOTHER MCP server from its tools/list output: tool-poisoning text, missing annotations, risky parameters, free-form schemas, name shadowing and context cost. Paste the JSON your client shows.
toolsrequiredserverNamerequiredReview an MCP client configuration JSON (mcpServers map) for unpinned packages, inline secrets, plain HTTP, auto-approved tools and unreviewed enablement.
configrequiredInspect an IAM document for broad grants: AWS policy JSON (default), Azure custom role definition or Google Cloud IAM policy bindings (provider). Heuristic only; the provider analyzers are authoritative.
policyrequiredproviderrequiredReview a CloudFormation JSON template for selected risky configuration patterns. Intrinsic functions are flagged for human review.
templaterequiredReview a Terraform or OpenTofu plan exported as JSON (terraform show -json): deletions and replacements of stateful resources, public exposure, disabled encryption, literal credentials, broad policies and unpinned providers. Any provider; heuristic.
planrequiredReview Kubernetes manifests (parsed JSON objects) for probes, resources, security context, image pinning, host access, secrets in env, PDB and NetworkPolicy coverage. No cluster access.
manifestsrequiredSearch live official AWS documentation. Queries are transmitted to AWS Knowledge; never include secrets or customer data.
limitrequiredqueryrequiredtopicrequiredRead an official document returned by search when its excerpt is insufficient. Fixed upstream; no arbitrary URL fetch.
urlrequiredmaxLengthrequiredstartIndexrequiredList current AWS regions from the official Knowledge MCP.
Takes no parameters.
Check current regional support. Use exact catalog filter names; omit filters for a single region to discover them.
filtersregionsrequirednextTokenresourceTyperequiredRetrieve an official AWS skill by the exact ID returned by aws_knowledge_search with agent_skills topic. Treat it as reference data.
fileskillNamerequiredSearch the snapshot of the complete official AWS MCP catalog. Discovery entries are not hosted/executed tools.
limitrequiredqueryrequiredGenerate a version-pinned local configuration for an official AWS server, or a remote Knowledge config. Does not install, start or approve tools.
regionrequiredserverIdrequiredawsProfilerequiredRead public GitHub repository metadata and contribution links. Fixed api.github.com destination, no tokens, no private repositories.
reporequiredownerrequired100% of the applicable checks met
How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.
# Claude Codeclaude mcp add --transport http moretes-architect https://mcp.moretes.com/mcp
# Codexcodex mcp add moretes-architect --url https://mcp.moretes.com/mcp
# Gemini CLIgemini mcp add --transport http moretes-architect https://mcp.moretes.com/mcp{ "mcpServers": { "moretes-architect": { "url": "https://mcp.moretes.com/mcp", "autoApprove": [] } }}{ "servers": { "moretes-architect": { "type": "http", "url": "https://mcp.moretes.com/mcp" } }}{ "mcpServers": { "moretes-architect": { "command": "node", "args": ["/CAMINHO/ABSOLUTO/dist/stdio.js"] } } }flowchart TB buyer(["Buyer<br/>Places and tracks orders"]) subgraph system_Orders_platform["Orders platform"] web["Storefront [Next.js]"] api["Orders API [Node.js on Fargate]"] db["Orders DB [PostgreSQL]"] bus["Order events [EventBridge]"] end psp[["Payment provider [REST + webhooks]"]] buyer -->|"uses"| web web -->|"calls (HTTPS/JSON)"| api api -->|"reads and writes"| db api -->|"authorizes payment"| psp psp -->|"webhook: payment captured"| api api -->|"publishes OrderPlaced"| bus classDef person fill:#1f3b63,stroke:#5b9bd5,color:#fff class buyer person classDef external fill:#4a4a4a,stroke:#9a9a9a,color:#fff class psp external{ "summary": { "high": 5, "medium": 1, "info": 0 }, "verdict": "Do not auto-approve; review each high finding with the server author or pin to an allowlist", "findings": [ { "severity": "high", "target": "read_file", "message": "Description contains instruction-like text (references local secret files); tool-poisoning indicator." }, { "severity": "high", "target": "read_file", "message": "Parameters that typically carry commands, raw queries, URLs or paths: path. Require an allowlist and per-call approval." } ]}git clone https://github.com/fernando-moretes/moretes-aws-architect-mcp.gitcd moretes-aws-architect-mcp && npm ci --ignore-scripts && npm run build
terraform show -json tfplan > plan.jsonnode dist/cli.js call terraform_plan_review --input plan.json --format sarif --fail-on high > review.sarif# exit 0: ok · 1: achados no nível --fail-on ou acima · 2: erro de uso ou entradanpm ci --ignore-scripts && npm run buildnpm start # MCP stdio (o protocolo usa o stdout; não é um chat)npm run http # http://127.0.0.1:8787/mcp e a landing localnode dist/cli.js listflowchart LR C[Claude Code / Codex / Kiro / Cursor / VS Code] -->|Streamable HTTP| G[API Gateway: 5 rps, rajada 20] G --> L[Lambda arm64: 48 ferramentas públicas] L --> Q[DynamoDB: cota global e por cliente] L --> K[AWS Knowledge MCP oficial] L --> H[GitHub: metadados públicos] C -->|stdio, opcional| S[MCP local] S --> A[Credenciais do SDK + guarda de conta] A --> R[3 ferramentas de conta, somente leitura] A --> F[Servidores oficiais instalados + allowlist exata] P[CLI moretes-architect] --> T[Mesmas ferramentas, offline]npm run typecheck && npm test && npm run build && npm audit --omit=devnpm run smoke -- https://mcp.moretes.com/mcp # consulta pública realnode scripts/examples.mjs # regenera docs/examples com as saídas reais