Skip to content
anlyon.devby Anlyon

Moretes Architect MCP

io.github.fernando-moretes/moretes-aws-architect-mcpfernando-moretesstreamable-httpv0.3.0Scanned

Evidence-first architecture workbench: 48 deterministic tools, 10 architect personas, any cloud

48 tools: 1 do something that can't be undone, 38 change things and 9 only read.

Tools: 0 delete, 1 irreversible, 38 write, 9 read.
  • Reads private data · 4
  • Reads text others write · 7
  • Can send data out · 2
  • 11 findings

Anlyon alternative

39 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →
Compare with similar serversMarkdownJSONReport this listing

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

48 tools

Can't be undone 1Claude Code: ask
  • service_equivalentsMap a cloud capability to equivalent managed services on AWS, Azure, Google Cloud, OCI and open source.Can send data out1 finding

    Why it is in this group

    • The input addresses people (input.to): what it sends cannot be taken back.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • outboundThe input takes a destination (input.to): what the tool writes goes there.

    Findings

    • Warn

      The server marks "service_equivalents" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The input addresses people (input.to): what it sends cannot be taken back.

      What this check looks for
    Description, as the server wrote it
    Map a cloud capability to equivalent managed services on AWS, Azure, Google Cloud, OCI and open source. Names as of the snapshot date; verify current naming, regions and pricing before deciding.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
Changes things 38Claude Code: ask
  • agent_eval_planDesign an evaluation plan for an AI agent: golden set sizing, metrics, judge rubric, red-team cases and regression cadence from explicit capabilities and risks.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Design an evaluation plan for an AI agent: golden set sizing, metrics, judge rubric, red-team cases and regression cadence from explicit capabilities and risks.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • agent_tool_contractDesign a per-operation authorization and recovery contract for an agent tool.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Design a per-operation authorization and recovery contract for an agent tool.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • architect_panelConvene architect personas (solution, enterprise, business, data, infrastructure, software, AI, security, governance, FinOps) on a subject: each returns its questions, checks, deli…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Convene architect personas (solution, enterprise, business, data, infrastructure, software, AI, security, governance, FinOps) on a subject: each returns its questions, checks, deliverables and the workbench tools to call. Lens, not a verdict.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • architecture_diagramBuild Mermaid from explicit nodes and edges.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Build Mermaid from explicit nodes and edges. Sanitizes labels and rejects dangling edges.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • architecture_patternSelect a reference architecture by explicit workload pattern; returns tradeoffs, questions and Mermaid.1 finding

    Why it is in this group

    • The description's first verb is "select": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "architecture_pattern" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "select": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Select a reference architecture by explicit workload pattern; returns tradeoffs, questions and Mermaid. provider maps the AWS services to Azure, GCP, OCI or open source equivalents.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • aws_regional_availabilityCheck current regional support.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Check current regional support. Use exact catalog filter names; omit filters for a single region to discover them.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • c4_modelBuild C4 context or container diagrams (Mermaid) from explicit people, systems, containers and relations.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Build C4 context or container diagrams (Mermaid) from explicit people, systems, containers and relations. Validates endpoints; no infrastructure discovery.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • capacity_planCalculate concurrency and daily data volume from explicit traffic assumptions.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Calculate concurrency and daily data volume from explicit traffic assumptions. No service sizing guarantee.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • cloudformation_reviewReview a CloudFormation JSON template for selected risky configuration patterns.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Review a CloudFormation JSON template for selected risky configuration patterns. Intrinsic functions are flagged for human review.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • code_review_architectureHeuristic architecture and security scan of source code pasted as text (any language): secrets, insecure calls, SQL built by concatenation, disabled TLS, hardcoded endpoints, missi…1 finding

    Why it is in this group

    • The input takes a statement or command to run (input.code), which can change anything it can reach.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "code_review_architecture" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The input takes a statement or command to run (input.code), which can change anything it can reach.

      What this check looks for
    Description, as the server wrote it
    Heuristic architecture and security scan of source code pasted as text (any language): secrets, insecure calls, SQL built by concatenation, disabled TLS, hardcoded endpoints, missing timeouts and retry hazards. Not a linter or SAST replacement.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • cost_modelCalculate an auditable scenario using caller-supplied unit rates and source URLs.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Calculate an auditable scenario using caller-supplied unit rates and source URLs. Does not guess AWS prices or credit coverage.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • data_classificationClassify data elements, map them to regulation hints (LGPD, GDPR, PCI DSS, HIPAA) and list handling controls and open questions.1 finding

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Info

      The input schema at properties.elements.items.properties.category.enum[6] mentions "credential".

      Matched text

      inputSchema.properties.elements.items.properties.category.enum[6]: "credential"

      What this check looks for
    Description, as the server wrote it
    Classify data elements, map them to regulation hints (LGPD, GDPR, PCI DSS, HIPAA) and list handling controls and open questions. Review aid, not legal advice.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • decision_recordGenerate an ADR from explicit alternatives, decision and consequences.1 finding

    Why it is in this group

    • The description's first verb is "generate": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "decision_record" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "generate": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Generate an ADR from explicit alternatives, decision and consequences. Does not invent acceptance.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • dependency_manifest_reviewReview a dependency manifest (package.json, requirements.txt, pyproject, go.mod, pom.xml, Gemfile, Cargo.toml as text) for unpinned ranges, git or URL sources, wildcard versions an…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Review a dependency manifest (package.json, requirements.txt, pyproject, go.mod, pom.xml, Gemfile, Cargo.toml as text) for unpinned ranges, git or URL sources, wildcard versions and missing lockfile hints.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • event_contractDesign an event contract: envelope fields, schema evolution rules, idempotency, ordering, DLQ and replay decisions for a named business event.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Design an event contract: envelope fields, schema evolution rules, idempotency, ordering, DLQ and replay decisions for a named business event. Deterministic template with open questions.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • failure_rehearsalDesign a controlled failure drill with observable success criteria and stop conditions; never executes it.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Design a controlled failure drill with observable success criteria and stop conditions; never executes it.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • finops_unit_economicsCompute cost per unit (request, customer, transaction), fixed versus variable split and the volume at which the marginal cost crosses a target.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Compute cost per unit (request, customer, transaction), fixed versus variable split and the volume at which the marginal cost crosses a target. Caller supplies costs; no provider prices are guessed.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • implementation_planTurn an architecture decision into a delivery checklist with validation gates.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Turn an architecture decision into a delivery checklist with validation gates.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • integration_configGenerate a version-pinned local configuration for an official AWS server, or a remote Knowledge config.1 finding

    Why it is in this group

    • The description's first verb is "generate": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "integration_config" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "generate": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Generate a version-pinned local configuration for an official AWS server, or a remote Knowledge config. Does not install, start or approve tools.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • kubernetes_manifest_reviewReview Kubernetes manifests (parsed JSON objects) for probes, resources, security context, image pinning, host access, secrets in env, PDB and NetworkPolicy coverage.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Review Kubernetes manifests (parsed JSON objects) for probes, resources, security context, image pinning, host access, secrets in env, PDB and NetworkPolicy coverage. No cluster access.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • latency_budgetSplit an end-to-end latency objective across hops and show which hops exceed their share.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Split an end-to-end latency objective across hops and show which hops exceed their share. Pure arithmetic over caller-supplied estimates.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • mcp_config_reviewReview an MCP client configuration JSON (mcpServers map) for unpinned packages, inline secrets, plain HTTP, auto-approved tools and unreviewed enablement.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Review an MCP client configuration JSON (mcpServers map) for unpinned packages, inline secrets, plain HTTP, auto-approved tools and unreviewed enablement.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • mcp_server_reviewHeuristic safety review of ANOTHER MCP server from its tools/list output: tool-poisoning text, missing annotations, risky parameters, free-form schemas, name shadowing and context …1 finding

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The description contains "ANOTHER MCP server", wording about other tools or servers.

      Matched text

      description: "Heuristic safety review of ANOTHER MCP server from its tools/list output: tool-poison..."

      What this check looks for
    Description, as the server wrote it
    Heuristic safety review of ANOTHER MCP server from its tools/list output: tool-poisoning text, missing annotations, risky parameters, free-form schemas, name shadowing and context cost. Paste the JSON your client shows.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • migration_planPrepare phased discovery, pilot, migration and rollback gates; includes AWS Transform integration discovery.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Prepare phased discovery, pilot, migration and rollback gates; includes AWS Transform integration discovery.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • openapi_reviewHeuristic review of an OpenAPI 3.x document (JSON): security, pagination, error responses, idempotency, versioning and documentation gaps.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Heuristic review of an OpenAPI 3.x document (JSON): security, pagination, error responses, idempotency, versioning and documentation gaps. Not a linter replacement.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • postmortemGenerate a blameless postmortem document from incident facts: timeline, impact, detection, contributing factors and owned action items.1 finding

    Why it is in this group

    • The description's first verb is "generate": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "postmortem" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "generate": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Generate a blameless postmortem document from incident facts: timeline, impact, detection, contributing factors and owned action items. Rejects action items without owner and due date.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • prompt_injection_checklistEnumerate injection paths and controls for an agent from its tools and untrusted data sources; produces a checklist with status to fill, not a scan.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Enumerate injection paths and controls for an agent from its tools and untrusted data sources; produces a checklist with status to fill, not a scan.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • queue_sizingSize consumers for a queue with Little's law and Erlang C: utilization, wait probability, backlog drain time and consumers needed for a target utilization.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Size consumers for a queue with Little's law and Erlang C: utilization, wait probability, backlog drain time and consumers needed for a target utilization.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • rag_pipeline_planPlan a retrieval-augmented generation pipeline from corpus facts: chunking, embedding, indexing, authorization, evaluation and cost drivers, with open questions.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Plan a retrieval-augmented generation pipeline from corpus facts: chunking, embedding, indexing, authorization, evaluation and cost drivers, with open questions. No vendor is chosen for you.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • requirements_checkTurn a workload brief into explicit requirements, gaps and research questions.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Turn a workload brief into explicit requirements, gaps and research questions. No inferred SLA or budget.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • retry_policyCompute an exponential backoff schedule with jitter, the worst-case wait and whether it fits a deadline; adds idempotency and circuit-breaker guidance.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Compute an exponential backoff schedule with jitter, the worst-case wait and whether it fits a deadline; adds idempotency and circuit-breaker guidance.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • runbookGenerate an operational runbook from service facts: alerts, diagnostic steps, remediation, rollback, escalation and verification.1 finding

    Why it is in this group

    • The description's first verb is "generate": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "runbook" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "generate": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Generate an operational runbook from service facts: alerts, diagnostic steps, remediation, rollback, escalation and verification. Template with explicit placeholders for what the caller did not provide.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • sequence_diagramBuild a Mermaid sequence diagram from participants and ordered messages, with optional activation, notes and alt/loop blocks.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Build a Mermaid sequence diagram from participants and ordered messages, with optional activation, notes and alt/loop blocks. Rejects unknown participants.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • slo_budgetCalculate an availability error budget for a chosen period.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Calculate an availability error budget for a chosen period.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • storage_growthProject storage volume and relative cost over time from ingest, retention, compression, replication and growth; suggests tiering thresholds.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Project storage volume and relative cost over time from ingest, retention, compression, replication and growth; suggests tiering thresholds.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • terraform_plan_reviewReview a Terraform or OpenTofu plan exported as JSON (terraform show -json): deletions and replacements of stateful resources, public exposure, disabled encryption, literal credent…1 finding

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Info

      The description mentions "credentials".

      Matched text

      description: "...exposure, disabled encryption, literal credentials, broad policies and unpinned providers...."

      What this check looks for
    Description, as the server wrote it
    Review a Terraform or OpenTofu plan exported as JSON (terraform show -json): deletions and replacements of stateful resources, public exposure, disabled encryption, literal credentials, broad policies and unpinned providers. Any provider; heuristic.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • threat_modelCreate STRIDE review prompts for explicitly supplied assets and trust boundaries.1 finding

    Why it is in this group

    • The description's first verb is "create": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "threat_model" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "create": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Create STRIDE review prompts for explicitly supplied assets and trust boundaries. Review aid, not a scanner.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • well_architected_reviewOrganize evidence by six pillars.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Organize evidence by six pillars. A met control without evidence is unknown, never certified.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
Only reads 9Show 9 read-only tools
  • aws_knowledge_readRead an official document returned by search when its excerpt is insufficient.Reads private dataReads text others writeCan send data outNo findings

    Why it is in this group

    • The name "aws_knowledge_read" says "read": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "read" and "document": it reads documents.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe input takes a URL (input.url), and the tool reads it: it reads web pages, which anyone can write.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.

    Claude Code: ask, because it is tagged outbound.

    Description, as the server wrote it
    Read an official document returned by search when its excerpt is insufficient. Fixed upstream; no arbitrary URL fetch.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • aws_regionsList current AWS regions from the official Knowledge MCP.Reads text others writeNo findings

    Why it is in this group

    • The description's first verb is "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    List current AWS regions from the official Knowledge MCP.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • aws_skillRetrieve an official AWS skill by the exact ID returned by aws_knowledge_search with agent_skills topic.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The description's first verb is "retrieve": a word for reading.

    What it can reach

    • private-dataThe input names a file (input.file), and the tool reads: it reads files.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Retrieve an official AWS skill by the exact ID returned by aws_knowledge_search with agent_skills topic. Treat it as reference data.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • dr_strategyCompare disaster recovery tiers (backup-and-restore, pilot light, warm standby, active-active) against RTO, RPO and data constraints; returns feasible tiers and required capabiliti…No findings

    Why it is in this group

    • The description's first verb is "compare": a word for reading.
    Description, as the server wrote it
    Compare disaster recovery tiers (backup-and-restore, pilot light, warm standby, active-active) against RTO, RPO and data constraints; returns feasible tiers and required capabilities, not a guarantee.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • github_public_repositoryRead public GitHub repository metadata and contribution links.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The description's first verb is "read": a word for reading.

    What it can reach

    • private-dataThe name "github_public_repository" says "repository": it reads repositories.
    • private-dataThe description's first sentence says "read" and "repository": it reads repositories.
    • private-dataThe input names a repo (input.repo), and the tool reads: it reads repositories.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Read public GitHub repository metadata and contribution links. Fixed api.github.com destination, no tokens, no private repositories.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • iam_policy_reviewInspect an IAM document for broad grants: AWS policy JSON (default), Azure custom role definition or Google Cloud IAM policy bindings (provider).Reads private dataReads text others writeNo findings

    Why it is in this group

    • The description's first verb is "inspect": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "inspect" and "document": it reads documents.
    • untrusted-inputThe name "iam_policy_review" says "review": it reads comments, which other people can write.
    Description, as the server wrote it
    Inspect an IAM document for broad grants: AWS policy JSON (default), Azure custom role definition or Google Cloud IAM policy bindings (provider). Heuristic only; the provider analyzers are authoritative.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • integration_catalogSearch the snapshot of the complete official AWS MCP catalog.No findings

    Why it is in this group

    • The description's first verb is "search": a word for reading.
    Description, as the server wrote it
    Search the snapshot of the complete official AWS MCP catalog. Discovery entries are not hosted/executed tools.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • service_compareCompare curated AWS service families against user constraints.No findings

    Why it is in this group

    • The name "service_compare" says "compare": a word for reading.
    Description, as the server wrote it
    Compare curated AWS service families against user constraints. No automatic winner or fabricated scores.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

56 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 2 outbound tools breaks every one.

Reads private data4
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write7
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out2
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
deny to break every path
{
  "permissions": {
    "deny": [
      "mcp__moretes-aws-architect__aws_knowledge_read",
      "mcp__moretes-aws-architect__service_equivalents"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

9 warn2 info
  • Warncode_review_architecture

    The server marks "code_review_architecture" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The input takes a statement or command to run (input.code), which can change anything it can reach.

    What this check looks for
  • Warnarchitecture_pattern

    The server marks "architecture_pattern" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "select": a word for a change.

    What this check looks for
  • Warndecision_record

    The server marks "decision_record" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "generate": a word for a change.

    What this check looks for
  • Warnthreat_model

    The server marks "threat_model" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "create": a word for a change.

    What this check looks for
  • Warnservice_equivalents

    The server marks "service_equivalents" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The input addresses people (input.to): what it sends cannot be taken back.

    What this check looks for
  • Warnpostmortem

    The server marks "postmortem" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "generate": a word for a change.

    What this check looks for
Show 5 more findings
  • Warnrunbook

    The server marks "runbook" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "generate": a word for a change.

    What this check looks for
  • Warnmcp_server_review

    The description contains "ANOTHER MCP server", wording about other tools or servers.

    Matched text

    description: "Heuristic safety review of ANOTHER MCP server from its tools/list output: tool-poison..."

    What this check looks for
  • Warnintegration_config

    The server marks "integration_config" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "generate": a word for a change.

    What this check looks for
  • Infodata_classification

    The input schema at properties.elements.items.properties.category.enum[6] mentions "credential".

    Matched text

    inputSchema.properties.elements.items.properties.category.enum[6]: "credential"

    What this check looks for
  • Infoterraform_plan_review

    The description mentions "credentials".

    Matched text

    description: "...exposure, disabled encryption, literal credentials, broad policies and unpinned providers...."

    What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 0.3.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http moretes-aws-architect https://m9od37vm41.execute-api.us-east-1.amazonaws.com/mcp
claude mcp add --transport http moretes-aws-architect https://m9od37vm41.execute-api.us-east-1.amazonaws.com/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__moretes-aws-architect__service_compare",
      "mcp__moretes-aws-architect__dr_strategy",
      "mcp__moretes-aws-architect__iam_policy_review",
      "mcp__moretes-aws-architect__aws_knowledge_search",
      "mcp__moretes-aws-architect__aws_regions",
      "mcp__moretes-aws-architect__aws_skill",
      "mcp__moretes-aws-architect__integration_catalog",
      "mcp__moretes-aws-architect__github_public_repository"
    ],
    "ask": [
      "mcp__moretes-aws-architect__architect_panel",
      "mcp__moretes-aws-architect__code_review_architecture",
      "mcp__moretes-aws-architect__dependency_manifest_review",
      "mcp__moretes-aws-architect__requirements_check",
      "mcp__moretes-aws-architect__architecture_pattern",
      "mcp__moretes-aws-architect__decision_record",
      "mcp__moretes-aws-architect__well_architected_review",
      "mcp__moretes-aws-architect__threat_model",
      "mcp__moretes-aws-architect__failure_rehearsal",
      "mcp__moretes-aws-architect__capacity_plan",
      "mcp__moretes-aws-architect__cost_model",
      "mcp__moretes-aws-architect__slo_budget",
      "mcp__moretes-aws-architect__migration_plan",
      "mcp__moretes-aws-architect__architecture_diagram",
      "mcp__moretes-aws-architect__implementation_plan",
      "mcp__moretes-aws-architect__agent_tool_contract",
      "mcp__moretes-aws-architect__c4_model",
      "mcp__moretes-aws-architect__sequence_diagram",
      "mcp__moretes-aws-architect__service_equivalents",
      "mcp__moretes-aws-architect__data_classification",
      "mcp__moretes-aws-architect__openapi_review",
      "mcp__moretes-aws-architect__event_contract",
      "mcp__moretes-aws-architect__latency_budget",
      "mcp__moretes-aws-architect__queue_sizing",
      "mcp__moretes-aws-architect__retry_policy",
      "mcp__moretes-aws-architect__storage_growth",
      "mcp__moretes-aws-architect__finops_unit_economics",
      "mcp__moretes-aws-architect__postmortem",
      "mcp__moretes-aws-architect__runbook",
      "mcp__moretes-aws-architect__agent_eval_plan",
      "mcp__moretes-aws-architect__prompt_injection_checklist",
      "mcp__moretes-aws-architect__rag_pipeline_plan",
      "mcp__moretes-aws-architect__mcp_server_review",
      "mcp__moretes-aws-architect__mcp_config_review",
      "mcp__moretes-aws-architect__cloudformation_review",
      "mcp__moretes-aws-architect__terraform_plan_review",
      "mcp__moretes-aws-architect__kubernetes_manifest_review",
      "mcp__moretes-aws-architect__aws_knowledge_read",
      "mcp__moretes-aws-architect__aws_regional_availability",
      "mcp__moretes-aws-architect__integration_config"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as moretes-aws-architect. Review it before you use it.

Capability tags behind 8 rules
  • mcp__moretes-aws-architect__service_equivalents outbound
  • mcp__moretes-aws-architect__iam_policy_review private-data, untrusted-input
  • mcp__moretes-aws-architect__aws_knowledge_search untrusted-input
  • mcp__moretes-aws-architect__aws_knowledge_read private-data, untrusted-input, outbound
  • mcp__moretes-aws-architect__aws_regions untrusted-input
  • mcp__moretes-aws-architect__aws_regional_availability untrusted-input
  • mcp__moretes-aws-architect__aws_skill private-data, untrusted-input
  • mcp__moretes-aws-architect__github_public_repository private-data, untrusted-input

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/io.github.fernando-moretes/moretes-aws-architect-mcp/verify?hash=f6016b36e212150e43a4e79c0cab67de6ca2618876166c4ab4c9a9a733a600c2" | jq -e '.changed == false'

Pinned hash f6016b36e212, from Oct 25, 2026, 18:27 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/io.github.fernando-moretes/moretes-aws-architect-mcp/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for io.github.fernando-moretes/moretes-aws-architect-mcp
[![anlyon.dev](https://anlyon.dev/badge/io.github.fernando-moretes/moretes-aws-architect-mcp.svg)](https://anlyon.dev/servers/io.github.fernando-moretes/moretes-aws-architect-mcp)

Source: MCP Registry · repository. Synced Oct 25, 2026, 19:17 UTC.