Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@iam-tap capture AWS SDK calls during npm test and generate a least-privilege IAM policy as JSON"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
One line: npx iam-tap -- npm test (or bunx iam-tap -- bun test) produces a least-privilege IAM policy from real AWS SDK calls via Client-Side Monitoring (CSM UDP :31000).
bunx iam-tap -- npm test
npx iam-tap -- npm test
# or install in your project / globally
bun add -d iam-tap
npm i -D iam-tapJSR:
bunx jsr add @kanchingyg/iam-tap
npx jsr add @kanchingyg/iam-tapgo install github.com/kanchingyg/iam-tap@latestThe core engine is Go (main.go, internal/): CSM UDP listener with token auth, argv-only child spawn (no shell), IAM policy emission, and --mcp JSON-RPC on stdio. TypeScript under src/*.ts is included for npx / bunx / JSR usage and MCP bridge helpers when no native binary is present.
Related MCP server: viberevert
npx iam-tap -- npm test
bunx iam-tap -- bun test
npx iam-tap --format terraform -- vitest run
npx iam-tap --mcp
iam-tap --help # after go installDry-run is the default: mutating MCP tools (write_policy_file) are blocked until you pass --allow-write (which disables dry-run). Policy writes are path-contained under the working directory.
{
"mcpServers": {
"iam-tap": {
"command": "npx",
"args": ["-y", "iam-tap", "--mcp"]
}
}
}This server cannot be deployed
IaC attack-path auditor: finds internet-to-crown-jewel chains in Terraform/CFN/K8s.
MCP server for mandates, delegation, policy-gated execution, credential grants, and audit.
Fail-closed policy guardrails for AI agents running kubectl, terraform, helm, and argocd.
Remote MCP for Copilot CLI switch gate MCP, structured receipts, audit logs, and reviewer-ready evid
