io.github.fernando-moretes由 GitHub 账号 fernando-moretes 发布v0.5.0更新于 Nov 7, 2026
Evidence-first architecture workbench: 48 deterministic tools, 10 architect personas, any cloud
确定性的架构工作台：48 个工具和 10 个架构师角色，覆盖需求、云设计、成本、可靠性与 IaC 审查。
Web executable，通过 Streamable HTTP。 远程服务在工作区中配置后即可从网页运行时运行。
把这段提示词粘贴到 Claude Code、Codex、Cursor 等智能体，或 SourceWeft 对话中。智能体会读取该服务器的安装指南，先向你展示发布者、端点和登录方式，经你同意后再把它添加到你的客户端。密钥不会写进任何命令。
阅读 https://sourceweft.com/mcp/io.github.fernando-moretes%2Fmoretes-aws-architect-mcp/install.md，并按其中说明把这个 MCP 服务器接入我的客户端。修改任何配置之前，先告诉我它的发布者、端点和登录方式，等我确认。不要把 API 密钥写进命令或我会提交的文件；问我密钥应从哪里获取。把它添加到你客户端的 mcpServers 配置中。
{
"mcpServers": {
"moretes-architect": {
"type": "http",
"url": "https://mcp.moretes.com/mcp"
}
}
}[CI] [CodeQL] [MCP Registry] [Licença MIT] [Versão 0.5.0] [48 ferramentas] [Sem chamadas a modelo] [Sem chave de API] [Node 22 e 24] [Curso grátis em vídeo]
Claude Code · Codex · Kiro · Cursor · VS Code · Gemini CLI · Amazon Q · Claude Desktop
Conectar ·
Ver funcionando ·
Ferramentas ·
Pipeline ·
Privacidade ·
Tutorial e curso ·
English
Um servidor MCP que coloca 48 ferramentas determinísticas de arquitetura e 10 personas de arquiteto dentro do seu agente de código. O modelo do seu cliente raciocina; o servidor devolve cálculos, estruturas, fontes oficiais e lacunas explícitas. O servidor nunca chama um modelo, nunca acessa a sua conta pela internet e não precisa de chave de API.
Feito por Fernando Azevedo, Arquiteto de Tecnologia da Informação Especialista e AWS Community Builder (AI Engineering). É o que eu uso para decidir arquitetura no dia a dia, aberto para a comunidade usar, auditar e estender.
Pede uma API, ele pergunta antes de sugerir. O agente chama requirements_check e depois architect_panel; nenhum número é inventado.
Calcula, não chuta. No Kiro, latency_budget soma os passos em série, pega o maior dos paralelos e mostra onde o tempo vai.
[Kiro chamando latency_budget: 1460 de 2000 ms, pagamento com 900 ms]
Trava o apply perigoso no pipeline. O mesmo motor roda offline como CLI, com Markdown, JSON ou SARIF e exit code por severidade.
[Terminal rodando terraform_plan_review no CLI, achados high e exit code 1]
Os GIFs são trechos dos vídeos do curso gratuito, narrados na minha voz, com as chamadas e as respostas reais do servidor. Os JSON completos estão em docs/examples.
[Instalar no Cursor] [Instalar no VS Code]
Sem chave, sem cadastro:
Kiro (.kiro/settings/mcp.json), Cursor (.cursor/mcp.json) e Amazon Q (mcp.json):
VS Code (.vscode/mcp.json):
Claude Desktop e qualquer cliente stdio, depois de rodar local:
Passo a passo de cada cliente, verificação e erros comuns: docs/clients.md.
[Página fernando.moretes.com/mcp: abas com o comando de cada cliente]
Cota pública: 300 requisições por dia por cliente e 3.000 no total; acima disso, 429. O mesmo servidor responde em https://fernando.moretes.com/api/mcp, mas esse endereço passa pelo site e todos os seus usuários dividem uma única cota diária; use a URL direta para ter a sua. Para volume ou entradas privadas, rode local.
Depois de conectar, peça ao agente:
"Use o Moretes Architect. Preciso de uma API de pedidos para um marketplace, 300 pedidos por minuto no pico. Pergunte o que falta antes de sugerir, convoque os arquitetos de solução, segurança e FinOps, compare Lambda e ECS, desenhe o C4 e registre a decisão em um ADR."
[Os quatro usos: decidir, calcular, revisar, proteger agentes]
iam_policy_review lê política IAM da AWS, role definition do Azure e bindings do Google Cloud (provider). Toda ferramenta de cálculo e revisão publica outputSchema, e o cliente valida a saída.
Mais 20 prompts (10 fluxos e um architect_<papel> por persona), 18 resources (moretes://guide, moretes://boundaries, moretes://tools, moretes://personas/<id>, moretes://skills/<id>) e, só no modo local, 5 ferramentas opcionais de conta AWS e federação com os servidores oficiais.
Guia de cada ferramenta: docs/tools-guide.md · Schemas: docs/tools.md · Saídas reais: docs/examples · Personas: docs/personas.md
Na versão 0.5.0, node dist/cli.js manifest exporta os contratos públicos completos com hashes por ferramenta, incluindo schemas de saída e anotações de segurança. Como verificar e comparar contratos. A instalação local e o endpoint HTTP permitem comparar os mesmos contratos; confira a versão em uso antes de comparar.
c4_modelEntrada: pessoas, sistemas e relações explícitas. Saída: Mermaid validado (id duplicado, aresta solta e rótulo com sintaxe perigosa são recusados). O GitHub renderiza abaixo exatamente o que a ferramenta devolveu em docs/examples/c4_model.json:
mcp_server_review recebe o tools/list de outro servidor e procura texto de instrução escondido na descrição, parâmetros perigosos, anotação mentirosa e nomes duplicados. Contra o servidor de exemplo em docs/examples/mcp_server_review.json:
Os servidores MCP de nuvem são operacionais: executam na conta. Faltava a parte de antes: levantar requisitos, comparar com honestidade entre provedores, calcular em vez de chutar, revisar com evidências e registrar a decisão. Este projeto faz essa parte, no mesmo lugar onde o código nasce, sem custo de inferência no servidor e sem receber credenciais.
Três regras atravessam todas as ferramentas:
Roda offline e sem cota. O SARIF entra no code scanning do GitHub; o Markdown vai para o resumo do job. GitHub Actions, GitLab CI e pre-commit prontos em docs/pipelines.md.
Detalhes e exemplos: docs/integrations-clients.md.
As ferramentas de conta AWS (identidade STS, recursos por tag, histórico de custo) e a federação com os servidores oficiais são opt-in por variável de ambiente e só existem no stdio: o HTTP público nunca as expõe. Detalhes em docs/clients.md e docs/integrations.md. O pacote está publicado no npm. Use npx --yes --package [email protected] moretes-architect list para o CLI ou npx --yes --package [email protected] moretes-aws-architect-mcp para stdio.
[Página do Moretes Architect MCP em fernando.moretes.com/mcp]
Em fernando.moretes.com/mcp: conexão por cliente, um playground que chama o servidor de verdade, as ferramentas por grupo, as personas, troubleshooting e FAQ. O curso tem dez aulas, cada uma com vídeo, áudio e texto, quizzes e certificado:
aws_knowledge_* (a consulta vai para o MCP oficial da AWS) e github_public_repository (api.github.com). Todo o resto é cálculo local./stats.json registram apenas nomes de ferramentas, sem argumentos, resultados ou identidade; não representam usuários únicos ou análises bem-sucedidas.sha256(dia + IP) com validade de dois dias; o IP bruto não é guardado.Tudo em PRIVACY.md e SECURITY.md.
[Landing do servidor público com o comando de cada cliente e as ferramentas por grupo]
A role da Lambda escreve e lê contadores somente na própria tabela DynamoDB e escreve nos próprios logs. Deploy por change set CloudFormation revisado. Design · Custos · Runbook · Evidências do deploy
41 testes offline, 99% das linhas cobertas, cobrem protocolo, cálculos, revisões, isolamento entre público e local, limites de entrada e federação. CI em Node 22 e 24, CodeQL, Dependabot e SBOM CycloneDX a cada release. Cada saída documentada em docs/examples é um teste: se uma ferramenta mudar de comportamento, o CI acusa. docs/tools.lock.json guarda o hash do nome, da descrição e do schema de cada ferramenta, então qualquer mudança no que o modelo do cliente lê aparece no diff.
Issues e PRs em português ou inglês. Use os templates: bug ou proposta de ferramenta (problema, entrada, saída esperada, limite). Uma ferramenta nova precisa de schema estrito, fronteira de dados externos explícita, limitações na saída e teste. Se você é AWS Community Builder, organiza User Group ou dá aula: o curso e os vídeos são livres para usar em sala.
Clientes · Ferramentas · Personas · Pipelines · FAQ · Troubleshooting · Glossário · Novidades · Workshop · Contribuir · Conduta · Roadmap · Changelog · Atribuições
Projeto independente. Não é um produto da AWS, nem revisão Well-Architected oficial, nem certificação de segurança, nem cotação de preço. AWS e outros nomes pertencem aos seus donos.
来源：README.md，提交 1965e0d
Convene architect personas (solution, enterprise, business, data, infrastructure, software, AI, security, governance, FinOps) on a subject: each returns its questions, checks, deliverables and the workbench tools to call. Lens, not a verdict.
roles必填subject必填knownFacts必填artifactType必填Heuristic architecture and security scan of source code pasted as text (any language): secrets, insecure calls, SQL built by concatenation, disabled TLS, hardcoded endpoints, missing timeouts and retry hazards. Not a linter or SAST replacement.
code必填filename必填language必填Review a dependency manifest (package.json, requirements.txt, pyproject, go.mod, pom.xml, Gemfile, Cargo.toml as text) for unpinned ranges, git or URL sources, wildcard versions and missing lockfile hints.
content必填filename必填lockfilePresentTurn a workload brief into explicit requirements, gaps and research questions. No inferred SLA or budget.
workload必填constraints必填requirements必填Select a reference architecture by explicit workload pattern; returns tradeoffs, questions and Mermaid. provider maps the AWS services to Azure, GCP, OCI or open source equivalents.
pattern必填provider必填workload必填Compare curated AWS service families against user constraints. No automatic winner or fabricated scores.
family必填constraints必填Generate an ADR from explicit alternatives, decision and consequences. Does not invent acceptance.
title必填status必填context必填options必填decision必填consequences必填Organize evidence by six pillars. A met control without evidence is unknown, never certified.
controls必填workload必填Create STRIDE review prompts for explicitly supplied assets and trust boundaries. Review aid, not a scanner.
assets必填boundaries必填dataClassification必填Design a controlled failure drill with observable success criteria and stop conditions; never executes it.
target必填failure必填operation必填Calculate concurrency and daily data volume from explicit traffic assumptions. No service sizing guarantee.
headroom必填payloadKB必填durationMs必填requestsPerSecond必填Calculate an auditable scenario using caller-supplied unit rates and source URLs. Does not guess AWS prices or credit coverage.
items必填currency必填contingencyPercent必填Calculate an availability error budget for a chosen period.
periodDays必填availabilityPercent必填usedDowntimeMinutes必填Prepare phased discovery, pilot, migration and rollback gates; includes AWS Transform integration discovery.
source必填target必填strategy必填constraints必填Build Mermaid from explicit nodes and edges. Sanitizes labels and rejects dangling edges.
edges必填nodes必填Turn an architecture decision into a delivery checklist with validation gates.
decision必填deliverables必填Design a per-operation authorization and recovery contract for an agent tool.
operation必填reversible必填resourceScope必填approvalRequired必填maxDurationSeconds必填Build C4 context or container diagrams (Mermaid) from explicit people, systems, containers and relations. Validates endpoints; no infrastructure discovery.
level必填people必填system必填relations必填containers必填externalSystems必填Build a Mermaid sequence diagram from participants and ordered messages, with optional activation, notes and alt/loop blocks. Rejects unknown participants.
title必填messages必填participants必填Map a cloud capability to equivalent managed services on AWS, Azure, Google Cloud, OCI and open source. Names as of the snapshot date; verify current naming, regions and pricing before deciding.
to必填from必填querycategoriesClassify data elements, map them to regulation hints (LGPD, GDPR, PCI DSS, HIPAA) and list handling controls and open questions. Review aid, not legal advice.
system必填elements必填jurisdictions必填Heuristic review of an OpenAPI 3.x document (JSON): security, pagination, error responses, idempotency, versioning and documentation gaps. Not a linter replacement.
document必填Design an event contract: envelope fields, schema evolution rules, idempotency, ordering, DLQ and replay decisions for a named business event. Deterministic template with open questions.
ordering必填producer必填consumers必填eventName必填payloadFields必填deliveryGuarantee必填Split an end-to-end latency objective across hops and show which hops exceed their share. Pure arithmetic over caller-supplied estimates.
hops必填targetMs必填percentile必填Size consumers with Little's law and stable Erlang C: utilization, wait probability, backlog drain time and target consumers. At most 100,000 total concurrent slots (consumers × concurrency).
consumers必填serviceTimeMs必填backlogMessages必填arrivalsPerSecond必填targetUtilizationPercent必填maxConcurrencyPerConsumer必填Compare disaster recovery tiers (backup-and-restore, pilot light, warm standby, active-active) against RTO, RPO and data constraints; returns feasible tiers and required capabilities, not a guarantee.
dataGB必填workload必填rpoMinutes必填rtoMinutes必填statefulComponents必填regulatoryResidencyreplicationBandwidthMbpsCompute an exponential backoff schedule with jitter, the worst-case wait and whether it fits a deadline; adds idempotency and circuit-breaker guidance.
capMs必填factor必填jitter必填deadlineMsbaseDelayMs必填maxAttempts必填operationIdempotent必填Project storage volume and relative cost over time from ingest, retention, compression, replication and growth; suggests tiering thresholds.
months必填hotDays必填dailyIngestGB必填retentionDays必填compressionRatio必填replicationFactor必填monthlyGrowthPercent必填hotTierPricePerGBMonthcoldTierPricePerGBMonthCompute cost per unit (request, customer, transaction), fixed versus variable split and the volume at which the marginal cost crosses a target. Caller supplies costs; no provider prices are guessed.
units必填period必填currency必填fixedCosts必填variableCosts必填targetCostPerPrimaryUnitGenerate a blameless postmortem document from incident facts: timeline, impact, detection, contributing factors and owned action items. Rejects action items without owner and due date.
title必填impact必填severity必填timeline必填startedAt必填detectedAt必填resolvedAt必填actionItems必填mitigatedAt必填whatWentWell必填contributingFactors必填Generate an operational runbook from service facts: alerts, diagnostic steps, remediation, rollback, escalation and verification. Template with explicit placeholders for what the caller did not provide.
owner必填alerts必填service必填rollback必填dashboards必填escalation必填diagnostics必填remediation必填Design an evaluation plan for an AI agent: golden set sizing, metrics, judge rubric, red-team cases and regression cadence from explicit capabilities and risks.
agent必填risks必填tools必填capabilities必填releaseCadence必填Enumerate injection paths and controls for an agent from its tools and untrusted data sources; produces a checklist with status to fill, not a scan.
agent必填tools必填humanInLoop必填untrustedSources必填Plan a retrieval-augmented generation pipeline from corpus facts: chunking, embedding, indexing, authorization, evaluation and cost drivers, with open questions. No vendor is chosen for you.
corpus必填useCase必填authorization必填latencyBudgetMs必填citationsRequired必填Heuristic safety review of ANOTHER MCP server from its tools/list output: tool-poisoning text, missing annotations, risky parameters, free-form schemas, name shadowing and context cost. Paste the JSON your client shows.
tools必填serverName必填Review an MCP client configuration JSON (mcpServers map) for unpinned packages, inline secrets, plain HTTP, auto-approved tools and unreviewed enablement.
config必填Inspect an IAM document for broad grants: AWS policy JSON (default), Azure custom role definition or Google Cloud IAM policy bindings (provider). Heuristic only; the provider analyzers are authoritative.
policy必填provider必填Review a CloudFormation JSON template for selected risky configuration patterns. Intrinsic functions are flagged for human review.
template必填Review a Terraform or OpenTofu plan exported as JSON (terraform show -json): deletions and replacements of stateful resources, public exposure, disabled encryption, literal credentials, broad policies and unpinned providers. Any provider; heuristic.
plan必填Review Kubernetes manifests (parsed JSON objects) for probes, resources, security context, image pinning, host access, secrets in env, PDB and NetworkPolicy coverage. No cluster access.
manifests必填Search live official AWS documentation. Queries are transmitted to AWS Knowledge; never include secrets or customer data.
limit必填query必填topic必填Read an official document returned by search when its excerpt is insufficient. Fixed upstream; no arbitrary URL fetch.
url必填maxLength必填startIndex必填List current AWS regions from the official Knowledge MCP.
无需输入参数。
Check current regional support. Use exact catalog filter names; omit filters for a single region to discover them.
filtersregions必填nextTokenresourceType必填Retrieve an official AWS skill by the exact ID returned by aws_knowledge_search with agent_skills topic. Treat it as reference data.
fileskillName必填Search the snapshot of the complete official AWS MCP catalog. Discovery entries are not hosted/executed tools.
limit必填query必填Generate a version-pinned local configuration for an official AWS server, or a remote Knowledge config. Does not install, start or approve tools.
region必填serverId必填awsProfile必填Read public GitHub repository metadata and contribution links. Fixed api.github.com destination, no tokens, no private repositories.
repo必填owner必填已满足适用检查项的 100%
该评分衡量此收录条目的完整程度，依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价，也不表示服务器安全或当前可用：可连通性是带日期的检查结果，评分也不包含安装量或用户评价。
# Claude Codeclaude mcp add --transport http moretes-architect https://mcp.moretes.com/mcp
# Codexcodex mcp add moretes-architect --url https://mcp.moretes.com/mcp
# Gemini CLIgemini mcp add --transport http moretes-architect https://mcp.moretes.com/mcp{ "mcpServers": { "moretes-architect": { "url": "https://mcp.moretes.com/mcp", "autoApprove": [] } }}{ "servers": { "moretes-architect": { "type": "http", "url": "https://mcp.moretes.com/mcp" } }}{ "mcpServers": { "moretes-architect": { "command": "node", "args": ["/CAMINHO/ABSOLUTO/dist/stdio.js"] } } }flowchart TB buyer(["Buyer<br/>Places and tracks orders"]) subgraph system_Orders_platform["Orders platform"] web["Storefront [Next.js]"] api["Orders API [Node.js on Fargate]"] db["Orders DB [PostgreSQL]"] bus["Order events [EventBridge]"] end psp[["Payment provider [REST + webhooks]"]] buyer -->|"uses"| web web -->|"calls (HTTPS/JSON)"| api api -->|"reads and writes"| db api -->|"authorizes payment"| psp psp -->|"webhook: payment captured"| api api -->|"publishes OrderPlaced"| bus classDef person fill:#1f3b63,stroke:#5b9bd5,color:#fff class buyer person classDef external fill:#4a4a4a,stroke:#9a9a9a,color:#fff class psp external{ "summary": { "high": 5, "medium": 1, "info": 0 }, "verdict": "Do not auto-approve; review each high finding with the server author or pin to an allowlist", "findings": [ { "severity": "high", "target": "read_file", "message": "Description contains instruction-like text (references local secret files); tool-poisoning indicator." }, { "severity": "high", "target": "read_file", "message": "Parameters that typically carry commands, raw queries, URLs or paths: path. Require an allowlist and per-call approval." } ]}git clone https://github.com/fernando-moretes/moretes-aws-architect-mcp.gitcd moretes-aws-architect-mcp && npm ci --ignore-scripts && npm run build
terraform show -json tfplan > plan.jsonnode dist/cli.js call terraform_plan_review --input plan.json --format sarif --fail-on high > review.sarif# exit 0: ok · 1: achados no nível --fail-on ou acima · 2: erro de uso ou entradanpm ci --ignore-scripts && npm run buildnpm start # MCP stdio (o protocolo usa o stdout; não é um chat)npm run http # http://127.0.0.1:8787/mcp e a landing localnode dist/cli.js listflowchart LR C[Claude Code / Codex / Kiro / Cursor / VS Code] -->|Streamable HTTP| G[API Gateway: 5 rps, rajada 20] G --> L[Lambda arm64: 48 ferramentas públicas] L --> Q[DynamoDB: cota global e por cliente] L --> K[AWS Knowledge MCP oficial] L --> H[GitHub: metadados públicos] C -->|stdio, opcional| S[MCP local] S --> A[Credenciais do SDK + guarda de conta] A --> R[3 ferramentas de conta, somente leitura] A --> F[Servidores oficiais instalados + allowlist exata] P[CLI moretes-architect] --> T[Mesmas ferramentas, offline]npm run typecheck && npm test && npm run build && npm audit --omit=devnpm run smoke -- https://mcp.moretes.com/mcp # consulta pública realnode scripts/examples.mjs # regenera docs/examples com as saídas reais