AWS/GCP KMS-based Ethereum signer for viem with enterprise-grade security. Sign transactions and messages using keys stored in AWS or GCP KMS without
AWS/GCP KMS-based Ethereum signer for viem with enterprise-grade security. Sign transactions and messages using keys stored in AWS or GCP KMS without exposing private keys. The evm mcp server wraps that behind the Model Context Protocol, so an assistant can use it through 5 defined tools rather than through you.
A TypeScript library that integrates AWS/GCP KMS (Key Management Service) with viem to create secure Ethereum signers. This allows you to sign Ethereum transactions and messages using keys stored in AWS or GCP KMS, providing enterprise-grade security for your Ethereum operations.
Everything the assistant can do here goes through one of these:
Prerequisites — 1. Create an ECC Key in AWS KMS: - Go to AWS KMS Console - Click "Create key" - Choose "Asymmetric" key type - Select "Sign and verify" key usageKmsSigner — The KmsSigner tool exposed by this serverConstructor — The Constructor tool exposed by this serverMethods — Returns the Ethereum address derived from the KMS public keyBuilding — The Building tool exposed by this serverYou will need 4 environment variables: KMS_KEY_ID, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, KEYRING_ID. The server will not start without them, which is usually why the tools fail to appear on a first run. Keep credentials in your client's env block or a secrets manager rather than in a file you might commit.
kms:GetPublicKey - kms:Sign 3. **NoteInstallation goes through your MCP client rather than a global install: point it at evm-kms-signer on npm and it is fetched when the client starts. The copy-paste blocks for Claude Desktop, Claude Code and Cursor are further down this page.
Plenty of cloud and infrastructure servers cover similar ground. The differences that matter in practice are scope of access and how much setup stands between you and a working tool call. Evm's toolset — Prerequisites, KmsSigner, Constructor and 2 more — is a fair guide to whether it matches your workflow. It is maintained by GitHub Actions; worth a glance at recent repository activity before you build anything load-bearing on it.
SyncDev reviews every entry in this directory against the project's own documentation before publishing, and revisits them as servers change.
| Tool | What it does |
|---|---|
| Prerequisites | 1. **Create an ECC Key in AWS KMS**: - Go to AWS KMS Console - Click "Create key" - Choose "Asymmetric" key type - Select "Sign and verify" key usage - Choose **ECC_SECG_P256K1** as the key spec (this is secp256k1, Ether |
| KmsSigner | The KmsSigner tool exposed by this server. |
| Constructor | The Constructor tool exposed by this server. |
| Methods | Returns the Ethereum address derived from the KMS public key. |
| Building | The Building tool exposed by this server. |
{
"mcpServers": {
"evm-signer": {
"command": "npx",
"args": ["-y", "evm-kms-signer"],
"env": {
"KMS_KEY_ID": "your-value",
"AWS_ACCESS_KEY_ID": "your-value",
"AWS_SECRET_ACCESS_KEY": "your-value",
"KEYRING_ID": "your-value"
}
}
}
}Add to claude_desktop_config.json, then restart Claude Desktop.
kms:GetPublicKey - kms:Sign 3. **Note| Variable | Description | Required |
|---|---|---|
| KMS_KEY_ID | Credential the server authenticates with. | Yes |
| AWS_ACCESS_KEY_ID | Credential the server authenticates with. | Yes |
| AWS_SECRET_ACCESS_KEY | Credential the server authenticates with. | Yes |
| KEYRING_ID | Credential the server authenticates with. | Yes |
Manage your whole Supabase project in conversation — database, auth, storage, Edge Functions and branches.
Stop letting your assistant hallucinate n8n node parameters — this server hands it the real schemas, templates and validation.
AWS Labs' official server suite — current AWS docs, CDK guidance, cost analysis and service tools.
Cloud browsers for AI agents — automation sessions that run in Browserbase's fleet, not on your machine.
Workers, KV, R2 and D1 by conversation — Cloudflare's official remote servers for building and observability.
Dashboards, Prometheus and Loki queries, incidents and alerts — observability by conversation.