Execution graph of AWS: verified contracts, least-privilege IAM policies, pre-flight authorization.
Maintain this server? Claim it
Call this server's tools from your browser. Nothing to install.
Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.
Tool list from our last check. Connect live to refresh it.
Pre-flight authorization check for an AWS operation. Resolves the IAM actions the operation requires, then asks AWS's own policy simulator (SimulatePrincipalPolicy) whether the current role (or a given principal) allows them. Returns resolution (exact|partial|unresolved) and evaluation (allowed|denied|unknown) as separate fields. Requires AWS credentials; without them evaluation=unknown with the reason.
A named workflow from list_workflows (e.g. 's3-multipart-kms')
IAM action strings or SDK symbols, comma-separated (e.g. 's3:PutObject' or 's3.PutObject')
Optional. IAM role/user ARN to simulate against. Defaults to the current caller via sts:GetCallerIdentity.
This tool isn't marked read-only, so it may change something on the server or in an account you connected.
Pre-flight authorization check for an AWS operation. Resolves the IAM actions the operation requires, then asks AWS's own policy simulator (SimulatePrincipalPolicy) whether the current role (or a given principal) allows them. Returns resolution (exact|partial|unresolved) and evaluation (allowed|denied|unknown) as separate fields. Requires AWS credentials; without them evaluation=unknown with the reason.
| Argument | Type | Description |
|---|---|---|
| workflow | string | A named workflow from list_workflows (e.g. 's3-multipart-kms') |
| operations | string | IAM action strings or SDK symbols, comma-separated (e.g. 's3:PutObject' or 's3.PutObject') |
| principal_arn | string | Optional. IAM role/user ARN to simulate against. Defaults to the current caller via sts:GetCallerIdentity. |
{
"type": "object",
"properties": {
"workflow": {
"type": "string",
"description": "A named workflow from list_workflows (e.g. 's3-multipart-kms')"
},
"operations": {
"type": "string",
"description": "IAM action strings or SDK symbols, comma-separated (e.g. 's3:PutObject' or 's3.PutObject')"
},
"principal_arn": {
"type": "string",
"description": "Optional. IAM role/user ARN to simulate against. Defaults to the current caller via sts:GetCallerIdentity."
}
}
}List all methods for a given library or service. Use after list_services to drill into a specific one.
| Argument | Type | Description |
|---|---|---|
| service* | string | Library or service name. Get these from list_services first. |
{
"type": "object",
"required": [
"service"
],
"properties": {
"service": {
"type": "string",
"description": "Library or service name. Get these from list_services first."
}
}
}List all libraries and services that have verified method contracts. Use this first to discover what's available, then query for specific methods.
No arguments.
{
"type": "object",
"properties": {}
}List the curated named workflows that can generate least-privilege IAM policies.
No arguments.
{
"type": "object",
"properties": {}
}Generate a least-privilege IAM policy for an AWS workflow. Pass a named workflow, explicit IAM actions, or a description. Returns the exact policy with confidence tier and any unresolved operations.
| Argument | Type | Description |
|---|---|---|
| workflow | string | A named workflow from list_workflows (e.g. 's3-multipart-kms') |
| operations | string | Explicit IAM action strings or SDK symbols, comma-separated (e.g. 's3:PutObject,s3:GetObject') |
| description | string | Describe the workflow (e.g. 'upload a large file to S3 with KMS') |
{
"type": "object",
"properties": {
"workflow": {
"type": "string",
"description": "A named workflow from list_workflows (e.g. 's3-multipart-kms')"
},
"operations": {
"type": "string",
"description": "Explicit IAM action strings or SDK symbols, comma-separated (e.g. 's3:PutObject,s3:GetObject')"
},
"description": {
"type": "string",
"description": "Describe the workflow (e.g. 'upload a large file to S3 with KMS')"
}
}
}Search for verified method contracts for any library. Pass any text -- library name, method, what you're building, or an error you hit.
| Argument | Type | Description |
|---|---|---|
| sig | string | |
| limit | integer | |
| query | string | What are you looking for? A method name, a library, an error message, or what you're building. Examples: s3 put_object, auto_gptq import, pandas merge, ImportError peft. |
| packages | array | |
| error_type | string | (deprecated -- use query instead) Error type if searching by error |
{
"type": "object",
"properties": {
"sig": {
"type": "string"
},
"limit": {
"type": "integer"
},
"query": {
"type": "string",
"description": "What are you looking for? A method name, a library, an error message, or what you're building. Examples: s3 put_object, auto_gptq import, pandas merge, ImportError peft."
},
"packages": {
"type": "array",
"items": {
"type": "string"
}
},
"error_type": {
"type": "string",
"description": "(deprecated -- use query instead) Error type if searching by error"
}
}
}Register a fix. Three actions: confirm (it worked), append_thread (variant worked), new_receipt (nothing matched, I fixed it).
| Argument | Type | Description |
|---|---|---|
| env | string | |
| fix | string | |
| error | string | |
| action* | string | |
| symbol* | string | |
| library* | string | |
| version | string | |
| error_class | string | |
| receipt_sig | string |
{
"type": "object",
"required": [
"action",
"library",
"symbol"
],
"properties": {
"env": {
"type": "string"
},
"fix": {
"type": "string"
},
"error": {
"type": "string"
},
"action": {
"enum": [
"confirm",
"append_thread",
"new_receipt"
],
"type": "string"
},
"symbol": {
"type": "string"
},
"library": {
"type": "string"
},
"version": {
"type": "string"
},
"error_class": {
"type": "string"
},
"receipt_sig": {
"type": "string"
}
}
}Feed a generated policy back to AWS's own policy evaluation engine (SimulateCustomPolicy) and confirm it grants exactly the intended operations and nothing extra. Returns verified (True|False|unknown), grants_all, grants_extra. Requires AWS credentials; without them verified=unknown with the reason. Wildcarded operations are expanded to concrete actions first.
| Argument | Type | Description |
|---|---|---|
| policy | string | Optional. A complete IAM policy JSON document to verify. |
| workflow | string | A named workflow from list_workflows to generate and then verify |
| operations | string | Intended IAM actions, comma-separated. Required if policy is provided. |
{
"type": "object",
"properties": {
"policy": {
"type": "string",
"description": "Optional. A complete IAM policy JSON document to verify."
},
"workflow": {
"type": "string",
"description": "A named workflow from list_workflows to generate and then verify"
},
"operations": {
"type": "string",
"description": "Intended IAM actions, comma-separated. Required if policy is provided."
}
}
}