Stigmer

Search for verified method contracts for any library. Pass any text -- library name, method, what you're building, or an error you hit.

{
  "type": "object",
  "properties": {
    "query": {
      "type": "string",
      "description": "What are you looking for? A method name, a library, an error message, or what you're building. Examples: s3 put_object, auto_gptq import, pandas merge, ImportError peft."
    },
    "error_type": {
      "type": "string",
      "description": "(deprecated -- use query instead) Error type if searching by error"
    },
    "sig": {
      "type": "string"
    },
    "packages": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "limit": {
      "type": "integer"
    }
  }
}

List all libraries and services that have verified method contracts. Use this first to discover what's available, then query for specific methods.

{
  "type": "object",
  "properties": {}
}

List all methods for a given library or service. Use after list_services to drill into a specific one.

{
  "type": "object",
  "properties": {
    "service": {
      "type": "string",
      "description": "Library or service name. Get these from list_services first."
    }
  },
  "required": [
    "service"
  ]
}

Generate a least-privilege IAM policy for an AWS workflow. Pass a named workflow, explicit IAM actions, or a description. Returns the exact policy with confidence tier and any unresolved operations.

{
  "type": "object",
  "properties": {
    "workflow": {
      "type": "string",
      "description": "A named workflow from list_workflows (e.g. 's3-multipart-kms')"
    },
    "operations": {
      "type": "string",
      "description": "Explicit IAM action strings or SDK symbols, comma-separated (e.g. 's3:PutObject,s3:GetObject')"
    },
    "description": {
      "type": "string",
      "description": "Describe the workflow (e.g. 'upload a large file to S3 with KMS')"
    }
  }
}

List the curated named workflows that can generate least-privilege IAM policies.

{
  "type": "object",
  "properties": {}
}

Feed a generated policy back to AWS's own policy evaluation engine (SimulateCustomPolicy) and confirm it grants exactly the intended operations and nothing extra. Returns verified (True|False|unknown), grants_all, grants_extra. Requires AWS credentials; without them verified=unknown with the reason. Wildcarded operations are expanded to concrete actions first.

{
  "type": "object",
  "properties": {
    "workflow": {
      "type": "string",
      "description": "A named workflow from list_workflows to generate and then verify"
    },
    "operations": {
      "type": "string",
      "description": "Intended IAM actions, comma-separated. Required if policy is provided."
    },
    "policy": {
      "type": "string",
      "description": "Optional. A complete IAM policy JSON document to verify."
    }
  }
}

Pre-flight authorization check for an AWS operation. Resolves the IAM actions the operation requires, then asks AWS's own policy simulator (SimulatePrincipalPolicy) whether the current role (or a given principal) allows them. Returns resolution (exact|partial|unresolved) and evaluation (allowed|denied|unknown) as separate fields. Requires AWS credentials; without them evaluation=unknown with the reason.

{
  "type": "object",
  "properties": {
    "operations": {
      "type": "string",
      "description": "IAM action strings or SDK symbols, comma-separated (e.g. 's3:PutObject' or 's3.PutObject')"
    },
    "workflow": {
      "type": "string",
      "description": "A named workflow from list_workflows (e.g. 's3-multipart-kms')"
    },
    "principal_arn": {
      "type": "string",
      "description": "Optional. IAM role/user ARN to simulate against. Defaults to the current caller via sts:GetCallerIdentity."
    }
  }
}

Register a fix. Three actions: confirm (it worked), append_thread (variant worked), new_receipt (nothing matched, I fixed it).

{
  "type": "object",
  "properties": {
    "action": {
      "type": "string",
      "enum": [
        "confirm",
        "append_thread",
        "new_receipt"
      ]
    },
    "library": {
      "type": "string"
    },
    "symbol": {
      "type": "string"
    },
    "version": {
      "type": "string"
    },
    "error": {
      "type": "string"
    },
    "fix": {
      "type": "string"
    },
    "error_class": {
      "type": "string"
    },
    "env": {
      "type": "string"
    },
    "receipt_sig": {
      "type": "string"
    }
  },
  "required": [
    "action",
    "library",
    "symbol"
  ]
}