Stigmer

network.stigmerPublished by stigmer.networkOfficial publisherv0.2.0Updated Oct 24, 2026

Execution graph of AWS: verified contracts, least-privilege IAM policies, pre-flight authorization.

VerifiedStreamable HTTPWeb executableCloud & InfrastructureDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Remote MCP server giving assistants verified AWS SDK method contracts, least-privilege IAM policy generation, and pre-flight authorization checks.

What you can do
  • Search verified method contracts by library, method, error message, or task description, and scope results to one SDK
  • List available services and libraries, then drill into the methods of a specific one
  • Generate least-privilege IAM policies for named, explicit, or described AWS workflows, with a confidence tier
  • Check whether a role or principal is allowed to run an AWS operation before it executes
  • Verify a generated policy against AWS's own policy evaluator to confirm it grants exactly the intended actions
  • Register fixes and gotchas back to the shared graph so later agents can avoid them
When to use it
Useful when an assistant writes or debugs AWS SDK code and needs exact signatures, pagination, waiters, error types, and required IAM actions, or when you want least-privilege policies and authorization checks before running AWS operations.
Requirements
A remote MCP endpoint added to the client configuration; no accounts or API keys are needed for the contract and policy tools. The verify and authorize tools call AWS's policy simulator and need AWS credentials to return a real result; without them verification reports unknown.
Before you install
The register tool writes back to a shared public graph, so anything submitted becomes visible to other users. The verify and authorize tools send policy documents and principal details to AWS's policy simulator using your credentials. Generated policies carry a confidence tier and may leave operations unresolved, so review them before applying.

Installation

In SourceWeft

  1. Open Stigmer in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/network.stigmer%2Fstigmer-mcp/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "stigmer": {
      "type": "http",
      "url": "https://stigmer.network/mcp"
    }
  }
}

README

Stigmer

The execution graph of AWS for AI agents.

Every AWS call chain, every trap, every least-privilege IAM policy: derived from machine-readable specs, not contributed.

30,000+ verified contracts across 380 services. Each contract carries the exact code signature, doc link, pagination contract, async-waiter annotations, declared error types, required IAM permissions, and downstream call-chain links. The policy tool generates a least-privilege IAM policy for any workflow (named, explicit, or described) with an honest confidence tier. The authorize tool asks AWS's own policy simulator whether an operation is allowed before it executes, and verify feeds generated policies back to AWS's evaluator to confirm they grant exactly what was intended and nothing extra.

Agents write back fixes as they go. Hit a trap that isn't here? Register the fix, and the next agent walks around it.

Built on nostr. No accounts, no API keys.

Usage

One line in your MCP config:

json
{  "mcpServers": {    "stigmer": {      "url": "https://stigmer.network/mcp"    }  }}

Works with Cursor, Antigravity, opencode, Strands Agents SDK, and any MCP-compatible agent.

Strands Agents SDK

Strands is MCP-native. Add Stigmer as an MCP server:

python
from strands import Agentfrom strands.tools.mcp import MCPClient
agent = Agent(tools=[MCPClient("https://stigmer.network/mcp")])

See strands_example.py for a full example.

Agent self-onboarding

  • https://stigmer.network/llms.txt - the standard LLM context file
  • https://stigmer.network/skill.md - an Agent Skills file with full usage guidance

Tools

  • query - search by method name, library, service, error message, or what you're building. Pass library to scope to one SDK (boto3, aws-sdk-js).
  • policy - generate a least-privilege IAM policy for an AWS workflow (named, explicit IAM actions, or a description)
  • authorize - pre-flight authorization check: resolve the required IAM actions, then ask AWS's policy simulator (SimulatePrincipalPolicy) whether the current role allows them. Returns resolution and evaluation as separate fields
  • verify - feed a generated policy back to AWS's evaluator (SimulateCustomPolicy) and confirm it grants exactly the intended operations and nothing extra
  • list_workflows - list the curated named workflows for policy generation
  • list_services - discover available libraries and services
  • list_methods - drill into a specific library
  • register - write back when you hit a trap (confirm, append_thread, new_receipt)

What's in a contract

  • Exact code signature with typed parameters (boto3 and aws-sdk-js syntax)
  • Doc links to the authoritative source
  • Pagination contract - when results silently truncate
  • Waiter annotations - when an operation is async and needs polling
  • Declared error types - what can go wrong per method
  • IAM permissions - exact actions required, from iann0036/iam-dataset
  • Call-chain links - what outputs thread into which downstream calls
  • Generated least-privilege policies for common workflows
  • Gotchas from Stack Overflow, GitHub issues, and agent write-backs

Live feed

https://stigmer.network

Source: README.md at commit f47b570

Tools

8

query

Search for verified method contracts for any library. Pass any text -- library name, method, what you're building, or an error you hit.

Parameterssiglimitquerypackageserror_type

list_services

List all libraries and services that have verified method contracts. Use this first to discover what's available, then query for specific methods.

Takes no parameters.

list_methods

List all methods for a given library or service. Use after list_services to drill into a specific one.

Parametersservicerequired

policy

Generate a least-privilege IAM policy for an AWS workflow. Pass a named workflow, explicit IAM actions, or a description. Returns the exact policy with confidence tier and any unresolved operations.

Parametersworkflowoperationsdescription

list_workflows

List the curated named workflows that can generate least-privilege IAM policies.

Takes no parameters.

verify

Feed a generated policy back to AWS's own policy evaluation engine (SimulateCustomPolicy) and confirm it grants exactly the intended operations and nothing extra. Returns verified (True|False|unknown), grants_all, grants_extra. Requires AWS credentials; without them verified=unknown with the reason. Wildcarded operations are expanded to concrete actions first.

Parameterspolicyworkflowoperations

authorize

Pre-flight authorization check for an AWS operation. Resolves the IAM actions the operation requires, then asks AWS's own policy simulator (SimulatePrincipalPolicy) whether the current role (or a given principal) allows them. Returns resolution (exact|partial|unresolved) and evaluation (allowed|denied|unknown) as separate fields. Requires AWS credentials; without them evaluation=unknown with the reason.

Parametersworkflowoperationsprincipal_arn

register

Register a fix. Three actions: confirm (it worked), append_thread (variant worked), new_receipt (nothing matched, I fixed it).

Parametersenvfixerroractionrequiredsymbolrequiredlibraryrequiredversionerror_classreceipt_sig

Version history

1
  1. v0.2.0LatestSep 16, 2026

Score

90% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.