BlueArch.io
BA v0.13.7 · TM v0.12.5 · GH v0.2.5Get free assessment →
New product · Beta · MCP-nativeFor AWS architects & platform teams

Your AWS,
reviewed before
it ships.

Steward is an MCP-first architecture reviewer. Ask about one live resource or a proposed Terraform change, and it reviews the dependencies that matter — Well-Architected knowledge, business impact, and an evidence-backed correction plan — right inside Claude, Cursor, or any MCP client. Read-only by default.

Install Steward →See the benchmarks →
Standalone · no BlueArch Core required · Python 3.10+ · pip or uv · User-owned, read-only AWS credentials
claude · bluearch-aws-stewardMCP · read-only session
> review the prod payments DLQ before Friday’s deploy
Focus: sqs/prod-payments-dlq · neighborhood: 4 resources
Reading live state… ledger: 12 reads · 0 writes
Well-Architected: reliability, security packs applied
3 findings · 1 high · correction plan ready for review
What you get

A second opinion, with evidence, on every change.

Broad scanners produce findings. Steward works the last mile — from a finding to a reviewed AWS or IaC fix, and post-fix verification.

01 · Review

Contextual, not account-wide

Point Steward at one resource or one proposed Terraform / CloudFormation change. It walks the dependencies that matter, applies validated Well-Architected knowledge, and states what it read, what it skipped, and what it could not know.

1–5 focus resources · evidence ledger →
02 · Converse

MCP-native from the first prompt

Steward lives in your MCP client. It asks for focus, objective, profile, and Region in-band, runs assessments in the background, and pages through findings without rescanning AWS.

Claude · Cursor · Codex →
03 · Remediate

Plans first, writes guarded

Every finding carries evidence, risk, cost status, and remediation safety. Fixes ship as reviewed plans — and the eight low-risk rules can apply only after you approve one exact, short-lived plan.

Read-only IAM · guarded apply →
120
Native rules · 17 runtime scopes
Including a 20-rule EKS / Kubernetes pack.
649
Catalog entries, searchable
The full aws-misconfig-db knowledge base, bundled.
5
Signal sources, one queue
Steward, Security Hub, Compute Optimizer, Cost Optimization Hub, Prowler.
0
Writes without approval
Read-only assessments; guarded apply needs one exact, short-lived plan.
CloudArch Eval · sweep-2026-08-12

Benchmarked in the open. Warts and all.

CloudArch Eval is our open-source, stateful AWS incident benchmark. We publish the complete sweep — including configurations that underperform — because that is what makes a benchmark worth trusting.

Remediation · measured 2026-08-18

Does the agent fix the incident?

Remediation benchmark: the agent gets a ticket and tools, must find and repair a planted AWS incident, and a hidden grader verifies the repaired state. Three arms per model — AWS CLI baseline, + Steward 0.9.0b1 (PyPI), + Steward main@b37a92b (pre-0.10.0b1).

#ConfigurationPass rate · valid trialsValid trialsInfra-invalidMean calls
1
Claude Opus 5
AWS CLI + Steward main@b37a92b (pre-0.10.0b1)
100.0%42/42
42/421810.3
2
Claude Opus 5
AWS CLI only
99.2%119/120
119/12008.8
3
Claude Opus 5
AWS CLI + Steward 0.9.0b1 (PyPI)
95.5%106/111
106/11199.5
4
Claude Sonnet 5
AWS CLI only
94.5%104/110
104/11017.1
5
Claude Sonnet 5
AWS CLI + Steward main@b37a92b (pre-0.10.0b1)
94.3%50/53
50/53710.8
6
Claude Sonnet 5
AWS CLI + Steward 0.9.0b1 (PyPI)
89.9%98/109
98/109119.1
7
Claude Haiku 4.5
AWS CLI + Steward 0.9.0b1 (PyPI)
80.2%85/106
85/106138.0
8
Claude Haiku 4.5
AWS CLI only
75.9%82/108
82/10806.8
9
Claude Haiku 4.5
AWS CLI + Steward main@b37a92b (pre-0.10.0b1)
72.7%40/55
40/55510.2

Measured 2026-08-18 · CloudArch Eval sweep-2026-08-12 · pass rates over valid trials; MCP startup failures reported as infra-invalid · LocalEmu synthetic sandbox, no real AWS · github.com/bluearchio/cloudarch-eval

Install · Beta · Python 3.10+ · PyPI

One wheel. Every MCP client.

python3 -m venv .venvsource .venv/bin/activatepython -m pip install --upgrade bluearch-aws-steward
Standalone. No BlueArch Core, hosted login, or telemetry — AWS stays the source of truth.Read-only. Assessments never write; guarded apply requires approval of one exact plan.
01

Install with pip

python3 -m venv .venvsource .venv/bin/activatepython -m pip install --upgrade bluearch-aws-stewardTypical: 1–2 min

A standard Python installation: an isolated virtual environment plus the complete application from PyPI — MCP server, knowledge packs, IaC parsers, native rules, and EKS support included. On Windows, activate with .venv\Scripts\activate.

02

Verify the runtime

bluearch-steward --versionbluearch-steward mcp smokeTypical: under 30 sec

Confirms the MCP runtime and its tools are healthy before you register a client.

03

Register your MCP client

bluearch-steward mcp install --client claudeTypical: under 1 min

Also supports --client cursor and --client codex. Existing client configuration is preserved and backed up; restart the client after registration.

04

Authenticate AWS and ask

aws sso login --profile my-profileexport AWS_PROFILE=my-profileTypical: 1–2 min

Keep your existing AWS SSO profile. Then ask your client to review a resource or a Terraform change — Steward clarifies focus, objective, and Region in-band.

Prefer uv?

uv installs the same complete wheel as a persistent, isolated command — no virtual environment to manage by hand.

uv tool install --upgrade bluearch-aws-stewarduv tool update-shell
Want a version-pinned uvx config instead?

Generate an MCP client configuration that resolves the exact released package on demand.

bluearch-steward mcp config --runtime uvx
FAQ

Common questions.

Full docs live in the repository. Or ask Steward — it is an MCP server, after all.

Does Steward replace Security Hub or Prowler?+
No — it complements them. Broad scanners produce findings; Steward works the last mile from a finding to a reviewed fix. It merges Security Hub, Compute Optimizer, Cost Optimization Hub, and Prowler signals into one deduplicated, explainably-scored queue.
Can it change my AWS account?+
Not without you. Assessments are point-in-time and read-only, with your own credentials. Guarded apply exists for eight low-risk rules and requires approval of one exact, short-lived plan.
Does it need BlueArch Core or a hosted account?+
No. Steward is standalone — no Core, no hosted login, no telemetry, no local inventory database. AWS remains the source of truth.
Can it review Terraform or CloudFormation?+
Yes — Terraform HCL, Terraform plan JSON, and CloudFormation JSON / YAML, reviewed safely without executing plans, transforms, macros, or custom resources.
How are the benchmark numbers produced?+
With CloudArch Eval, our open-source synthetic AWS incident benchmark. Every trial runs in an isolated emulator with hidden graders — no real AWS accounts. The harness, scenarios, and image digests are public, and we publish complete sweeps.

One pip install from a second opinion.

Install in two minutes, register your MCP client, and review your next change before it ships.

Book a review →Pair with BlueArch CLI →