Arquitetura AWS.
Decisões com evidências.

Requisitos, padrões AWS, alternativas, diagramas Mermaid e ADRs.

Well-Architected, ameaças, IAM e CloudFormation. Lacunas ficam explícitas.

Capacidade, cenários de custo, SLO, migração e ensaios de falha.

Cinco adaptadores AWS Knowledge e catálogo oficial de integrações por especialidade.

Solução, enterprise, negócio, dados, infra, software, IA, segurança, governança e FinOps: cada um com perguntas, checagens e entregáveis.

Plano Terraform, CloudFormation, Kubernetes, código, dependências, outros servidores MCP e a configuração do seu cliente.

Convene architect personas (solution, enterprise, business, data, infrastructure, software, AI, security, governance, FinOps) on a subject: each returns its questions, checks, deliverables and the workbench tools to call. Lens, not a verdict.

Heuristic architecture and security scan of source code pasted as text (any language): secrets, insecure calls, SQL built by concatenation, disabled TLS, hardcoded endpoints, missing timeouts and retry hazards. Not a linter or SAST replacement.

Review a dependency manifest (package.json, requirements.txt, pyproject, go.mod, pom.xml, Gemfile, Cargo.toml as text) for unpinned ranges, git or URL sources, wildcard versions and missing lockfile hints.

Turn a workload brief into explicit requirements, gaps and research questions. No inferred SLA or budget.

Select a reference architecture by explicit workload pattern; returns tradeoffs, questions and Mermaid. provider maps the AWS services to Azure, GCP, OCI or open source equivalents.

Compare curated AWS service families against user constraints. No automatic winner or fabricated scores.

Generate an ADR from explicit alternatives, decision and consequences. Does not invent acceptance.

Organize evidence by six pillars. A met control without evidence is unknown, never certified.

Create STRIDE review prompts for explicitly supplied assets and trust boundaries. Review aid, not a scanner.

Design a controlled failure drill with observable success criteria and stop conditions; never executes it.

Calculate concurrency and daily data volume from explicit traffic assumptions. No service sizing guarantee.

Calculate an auditable scenario using caller-supplied unit rates and source URLs. Does not guess AWS prices or credit coverage.

Calculate an availability error budget for a chosen period.

Prepare phased discovery, pilot, migration and rollback gates; includes AWS Transform integration discovery.

Build Mermaid from explicit nodes and edges. Sanitizes labels and rejects dangling edges.

Turn an architecture decision into a delivery checklist with validation gates.

Design a per-operation authorization and recovery contract for an agent tool.

Build C4 context or container diagrams (Mermaid) from explicit people, systems, containers and relations. Validates endpoints; no infrastructure discovery.

Build a Mermaid sequence diagram from participants and ordered messages, with optional activation, notes and alt/loop blocks. Rejects unknown participants.

Map a cloud capability to equivalent managed services on AWS, Azure, Google Cloud, OCI and open source. Names as of the snapshot date; verify current naming, regions and pricing before deciding.

Classify data elements, map them to regulation hints (LGPD, GDPR, PCI DSS, HIPAA) and list handling controls and open questions. Review aid, not legal advice.

Heuristic review of an OpenAPI 3.x document (JSON): security, pagination, error responses, idempotency, versioning and documentation gaps. Not a linter replacement.

Design an event contract: envelope fields, schema evolution rules, idempotency, ordering, DLQ and replay decisions for a named business event. Deterministic template with open questions.

Split an end-to-end latency objective across hops and show which hops exceed their share. Pure arithmetic over caller-supplied estimates.

Size consumers for a queue with Little's law and Erlang C: utilization, wait probability, backlog drain time and consumers needed for a target utilization.

Compare disaster recovery tiers (backup-and-restore, pilot light, warm standby, active-active) against RTO, RPO and data constraints; returns feasible tiers and required capabilities, not a guarantee.

Compute an exponential backoff schedule with jitter, the worst-case wait and whether it fits a deadline; adds idempotency and circuit-breaker guidance.

Project storage volume and relative cost over time from ingest, retention, compression, replication and growth; suggests tiering thresholds.

Compute cost per unit (request, customer, transaction), fixed versus variable split and the volume at which the marginal cost crosses a target. Caller supplies costs; no provider prices are guessed.

Generate a blameless postmortem document from incident facts: timeline, impact, detection, contributing factors and owned action items. Rejects action items without owner and due date.

Generate an operational runbook from service facts: alerts, diagnostic steps, remediation, rollback, escalation and verification. Template with explicit placeholders for what the caller did not provide.

Design an evaluation plan for an AI agent: golden set sizing, metrics, judge rubric, red-team cases and regression cadence from explicit capabilities and risks.

Enumerate injection paths and controls for an agent from its tools and untrusted data sources; produces a checklist with status to fill, not a scan.

Plan a retrieval-augmented generation pipeline from corpus facts: chunking, embedding, indexing, authorization, evaluation and cost drivers, with open questions. No vendor is chosen for you.

Heuristic safety review of ANOTHER MCP server from its tools/list output: tool-poisoning text, missing annotations, risky parameters, free-form schemas, name shadowing and context cost. Paste the JSON your client shows.

Review an MCP client configuration JSON (mcpServers map) for unpinned packages, inline secrets, plain HTTP, auto-approved tools and unreviewed enablement.

Inspect an IAM document for broad grants: AWS policy JSON (default), Azure custom role definition or Google Cloud IAM policy bindings (provider). Heuristic only; the provider analyzers are authoritative.

Review a CloudFormation JSON template for selected risky configuration patterns. Intrinsic functions are flagged for human review.

Review a Terraform or OpenTofu plan exported as JSON (terraform show -json): deletions and replacements of stateful resources, public exposure, disabled encryption, literal credentials, broad policies and unpinned providers. Any provider; heuristic.

Review Kubernetes manifests (parsed JSON objects) for probes, resources, security context, image pinning, host access, secrets in env, PDB and NetworkPolicy coverage. No cluster access.

Search live official AWS documentation. Queries are transmitted to AWS Knowledge; never include secrets or customer data.

Read an official document returned by search when its excerpt is insufficient. Fixed upstream; no arbitrary URL fetch.

List current AWS regions from the official Knowledge MCP.

Check current regional support. Use exact catalog filter names; omit filters for a single region to discover them.

Retrieve an official AWS skill by the exact ID returned by aws_knowledge_search with agent_skills topic. Treat it as reference data.

Search the snapshot of the complete official AWS MCP catalog. Discovery entries are not hosted/executed tools.

Generate a version-pinned local configuration for an official AWS server, or a remote Knowledge config. Does not install, start or approve tools.

Read public GitHub repository metadata and contribution links. Fixed api.github.com destination, no tokens, no private repositories.