Probes a local Ollama instance (/api/show, alongside llama.cpp /props and vLLM /v1/models) to discover the model's context window size, which is used to scale the middle-truncation of tool outputs to fit the context budget.
Renders the generated least-privilege IAM policy as Terraform (via --format terraform or the generate_iam_policy tool), so the emitted policy can be dropped directly into Terraform-managed AWS infrastructure code.
This server does not currently have a deployable release on Glama. Follow the repository's setup instructions to install and configure it for your MCP client, including any required credentials and local dependencies.
One line: npx iam-tap -- npm test (or bunx iam-tap -- bun test) produces a least-privilege IAM policy from real AWS SDK calls via Client-Side Monitoring (CSM UDP :31000).
bunx iam-tap -- npm test
npx iam-tap -- npm test
# or install in your project / globally
bun add -d iam-tap
npm i -D iam-tapJSR:
bunx jsr add @kanchingyg/iam-tap
npx jsr add @kanchingyg/iam-tapgo install github.com/kanchingyg/iam-tap@latestThe core engine is Go (main.go, internal/): CSM UDP listener with token auth, argv-only child spawn (no shell), IAM policy emission, and --mcp JSON-RPC on stdio. TypeScript under src/*.ts is included for npx / bunx / JSR usage and MCP bridge helpers when no native binary is present.
Related MCP server: viberevert
npx iam-tap -- npm test
bunx iam-tap -- bun test
npx iam-tap --format terraform -- vitest run
npx iam-tap --mcp
iam-tap --help # after go installDry-run is the default: mutating MCP tools (write_policy_file) are blocked until you pass --allow-write (which disables dry-run). Policy writes are path-contained under the working directory.
Tool | Mutates | Description |
|
| Spawn a child command ( |
|
| Render a least-privilege IAM policy from a recorded trace ID in |
|
| Tighten wildcard Resource ARNs using static service templates and captured region metadata. |
|
| Write the generated IAM policy to a path contained inside the current working directory (requires |
.cursor/mcp.json){
"mcpServers": {
"iam-tap": {
"command": "npx",
"args": ["-y", "iam-tap", "--mcp"]
}
}
}claude mcp add iam-tap -- npx -y iam-tap --mcpimport * as bridge from "jsr:@kanchingyg/iam-tap/bridge";Stdio frame isolation: When --mcp is active, hijackStdoutForMcp() redirects accidental console.log calls to stderr so JSON-RPC 2.0 frames on stdout never corrupt.
Read-only by default: Mutating tools (mutates: true) are blocked in --dry-run mode and require explicit --allow-write authorization.
Loop breaker: Repeated identical (toolName, args) invocations are hashed with SHA-256 and halted after 3 consecutive repeats to prevent runaway agent loops.
Context budget truncation: Tool outputs are middle-truncated (60% head / 40% tail) scaled to the probed local model n_ctx (Ollama /api/show, llama.cpp /props, vLLM /v1/models).
Secret redaction and path normalization: AWS keys (AKIA*, ASIA*), bearer tokens, and sk-* keys are scrubbed before returning tool output, and Windows drive paths (C:\...) translate cleanly to /mnt/c/... when WSL mode is enabled.
This server cannot be deployed
IaC attack-path auditor: finds internet-to-crown-jewel chains in Terraform/CFN/K8s.
MCP server for mandates, delegation, policy-gated execution, credential grants, and audit.
Fail-closed policy guardrails for AI agents running kubectl, terraform, helm, and argocd.
Remote MCP for Copilot CLI switch gate MCP, structured receipts, audit logs, and reviewer-ready evid
