Shieldly Io

io.github.shieldly-ioPublished by GitHub account shieldly-iov1.0.1Updated Nov 3, 2026

AI-Powered AWS security analysis: scan IAM policies and CloudFormation for risks and escalation.

VerifiedSTDIODesktop onlyCloud & InfrastructureSecurity & Monitoring

Overview

AI-generated overview

Shieldly's MCP server lets an AI assistant analyze AWS IAM policies and CloudFormation templates for security risks such as privilege escalation and…

What you can do
  • Analyze IAM policies: review an identity policy, or a cross-account trust plus identity pair, for privilege escalation paths, wildcards and over-permissive access
  • Analyze CloudFormation templates: extract IAM roles and policies from a template and flag risky permissions
  • Run without an account: both tools work in a rate-limited demo mode when no API key is set
When to use it
Useful when reviewing AWS IAM policies or CloudFormation stacks and you want an assistant to point out escalation paths and overly broad permissions before deployment. It fits security review of infrastructure-as-code inside an MCP-capable client such as Claude Code, Claude Desktop or Cursor.
Requirements
Runs locally over stdio via npx from the npm package @shieldly/mcp, so Node.js and network access are needed. No account is required for the rate-limited demo mode; higher limits need an API key in the SHIELDLY_API_KEY environment variable, available on the Builder plan or above. Desktop clients only.
Before you install
The optional SHIELDLY_API_KEY is a secret and should be supplied through the environment, not committed to config files. Policy and template contents you submit are sent to Shieldly's service for analysis, so avoid pasting sensitive account details. The tools only analyze input and do not modify AWS resources.

Installation

In SourceWeft

  1. Open Shieldly Io in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

@shieldly/mcp

AI-Powered Security Analysis for AWS — official MCP server.

Gives any MCP-compatible AI assistant (Claude Code, Claude Desktop, Cursor, etc.) two tools to analyze AWS IAM policies and CloudFormation templates for security risks — privilege escalation paths, wildcards, and other over-permissive access. Powered by Shieldly.

Setup

Add to your MCP client config (e.g. Claude Desktop's claude_desktop_config.json, or Claude Code's .mcp.json):

json
{  "mcpServers": {    "shieldly": {      "command": "npx",      "args": ["-y", "@shieldly/mcp"]    }  }}

Try it free — no account needed

Both tools run in demo mode without an API key (rate-limited, no signup). For higher limits, set SHIELDLY_API_KEY:

json
{  "mcpServers": {    "shieldly": {      "command": "npx",      "args": ["-y", "@shieldly/mcp"],      "env": { "SHIELDLY_API_KEY": "sk_live_..." }    }  }}

Get an API key (Builder plan or above): https://www.shieldly.io/app/api

Tools

analyze_iam_policy

Analyzes an IAM identity policy, or a cross-account trust+identity pair.

ArgumentTypeDescription
policystringThe IAM policy JSON as a string.
policyTypeidentity | cross_accountDefaults to identity.

analyze_cloudformation_template

Analyzes a CloudFormation template — extracts IAM roles/policies and flags over-permissive access.

ArgumentTypeDescription
templatestringThe CloudFormation template JSON as a string.

Also available as

License

MIT

Source: README.md at commit 85c470a

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v1.0.1LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts