Stigmer
by stigmer.network · remote · no sign-in to list tools · v0.2.0 · published by network.stigmer
Execution graph of AWS: verified contracts, least-privilege IAM policies, pre-flight authorization.
8 tools: 4 change things and 4 only read.
Scanned Oct 21, 2026
- Deletes or cancels0Claude Code: deny
- Can't be undone0Claude Code: ask
- Changes things4Claude Code: ask: see these tools
- Only reads4Claude Code: allow: see these tools
2 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.
claude mcp add --transport http stigmer https://stigmer.network/mcpFindings
Matches of fixed checks, with the text they matched.
- Infoverify
The description mentions "credentials".
What this check looks forMatched text
description: "...grants_all, grants_extra. Requires AWS credentials; without them verified=unknown with the..."
- Infoauthorize
The description mentions "credentials".
What this check looks forMatched text
description: "...known) as separate fields. Requires AWS credentials; without them evaluation=unknown with t..."
Tools
Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.
8 tools
Changes things 4Claude Code: ask
authorizePre-flight authorization check for an AWS operation.1 finding
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Findings
- Info
The description mentions "credentials".
What this check looks forMatched text
description: "...known) as separate fields. Requires AWS credentials; without them evaluation=unknown with t..."
Description, as the server wrote it Pre-flight authorization check for an AWS operation. Resolves the IAM actions the operation requires, then asks AWS's own policy simulator (SimulatePrincipalPolicy) whether the current role (or a given principal) allows them. Returns resolution (exact|partial|unresolved) and evaluation (allowed|denied|unknown) as separate fields. Requires AWS credentials; without them evaluation=unknown with the reason.
policyGenerate a least-privilege IAM policy for an AWS workflow.No findings
Why it is in this group
- The description's first verb is "generate": a word for a change.
Description, as the server wrote it Generate a least-privilege IAM policy for an AWS workflow. Pass a named workflow, explicit IAM actions, or a description. Returns the exact policy with confidence tier and any unresolved operations.
registerRegister a fix.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Register a fix. Three actions: confirm (it worked), append_thread (variant worked), new_receipt (nothing matched, I fixed it).
verifyFeed a generated policy back to AWS's own policy evaluation engine (SimulateCustomPolicy) and confirm it grants exactly the intended operations and nothing extra.1 finding
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Findings
- Info
The description mentions "credentials".
What this check looks forMatched text
description: "...grants_all, grants_extra. Requires AWS credentials; without them verified=unknown with the..."
Description, as the server wrote it Feed a generated policy back to AWS's own policy evaluation engine (SimulateCustomPolicy) and confirm it grants exactly the intended operations and nothing extra. Returns verified (True|False|unknown), grants_all, grants_extra. Requires AWS credentials; without them verified=unknown with the reason. Wildcarded operations are expanded to concrete actions first.
Only reads 4Claude Code: allow
list_methodsList all methods for a given library or service.No findings
Why it is in this group
- The name "list_methods" says "list": a word for reading.
Description, as the server wrote it List all methods for a given library or service. Use after list_services to drill into a specific one.
list_servicesList all libraries and services that have verified method contracts.No findings
Why it is in this group
- The name "list_services" says "list": a word for reading.
Description, as the server wrote it List all libraries and services that have verified method contracts. Use this first to discover what's available, then query for specific methods.
list_workflowsList the curated named workflows that can generate least-privilege IAM policies.No findings
Why it is in this group
- The name "list_workflows" says "list": a word for reading.
Description, as the server wrote it List the curated named workflows that can generate least-privilege IAM policies.
querySearch for verified method contracts for any library.No findings
Why it is in this group
- The name "query" says "query": a word for reading.
Description, as the server wrote it Search for verified method contracts for any library. Pass any text -- library name, method, what you're building, or an error you hit.
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Install
Pinned to version 0.2.0. Values in angle brackets are yours to fill in.
claude mcp add --transport http stigmer https://stigmer.network/mcpRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__stigmer__query",
"mcp__stigmer__list_services",
"mcp__stigmer__list_methods",
"mcp__stigmer__list_workflows"
],
"ask": [
"mcp__stigmer__policy",
"mcp__stigmer__verify",
"mcp__stigmer__authorize",
"mcp__stigmer__register"
],
"deny": []
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as stigmer. Review it before you use it.