IAM Policy Autopilot MCP Server: Setup for Claude, Cursor and Other Apps

• Writes a baseline IAM policy from your source files or a Terraform plan

  Reads the files you point it at (Python, Go, TypeScript, JavaScript or Java, or a Terraform plan in JSON) and lists the AWS actions the code calls. It returns IAM policy documents you can review. You can name the AWS services you use so the result is tighter, and set a region and account ID for the resource names.

  Try: “Generate an IAM policy for the Lambda function in src/handler.py. It uses S3 and DynamoDB in us-east-1.”

  Files · generate_application_policies

• Proposes the policy change that would fix an AWS AccessDenied error

  Takes the AccessDenied error text from AWS and returns a policy that would allow the blocked action. It only proposes the policy and does not change your account. The tool asks the assistant to show you the policy first.

  Try: “I got 'User arn:aws:iam::123456789012:user/test is not authorized to perform s3:GetObject'. What policy would fix it?”

  Read · generate_policy_for_access_denied

• Applies the fix for an AccessDenied error to the user or role in your AWS account

  Adds the proposed policy to the AWS user or role named in the error, using your AWS credentials. It asks you to confirm before it applies anything, and you can narrow or widen the resource it covers. Run it only after you have reviewed the policy from the previous tool.

  Try: “Apply that fix to the role, but limit it to the reports bucket.”

  Write · fix_access_denied

Watch out for

• One tool can change IAM permissions in your account

  The fix tool attaches a policy to the user or role named in the error and asks you to confirm first. Use a profile with only the IAM rights you accept, and read the policy before you agree. github.com

• Generated policies may be broader than your code needs

  Static analysis can include actions from other services with matching method names. Pass service hints and review the policy before deploying it. github.com

• Your assistant can edit the policy afterwards

  The assistant may add resource names or key IDs from its own reading of your code. Those changes are not from the analysis, so check the final template. github.com

• Needs internet access to fetch AWS metadata

  It fetches AWS service data over HTTPS at runtime. Allow the endpoint in the README if your network restricts outbound traffic. github.com

Security advisories