infrawise 0.10.3 → 0.11.0

package/README.md

@@ -156,7 +156,8 @@ Add to your editor's MCP config:
 | `postgres_index_suggestions` | Exact `CREATE INDEX` SQL for your actual table                                                              |
 | `suggest_mongo_index`        | Exact `createIndex` command for a MongoDB collection + field                                                |
 | `mysql_index_suggestions`    | Exact `ALTER TABLE ADD INDEX` SQL for your MySQL table                                                      |
-| `get_queue_details`          | SQS queues — DLQ status, encryption, message counts                                                         |
+| `get_queue_details`          | SQS queues — DLQ status, encryption, FIFO type, visibility timeout, message counts                          |
+| `get_api_routes`             | API Gateway APIs (REST, HTTP, WebSocket) — routes, HTTP methods, paths, and Lambda integrations             |
 | `get_topic_details`          | SNS topics — subscription counts, protocols, and filter policies (required message attributes per subscription) |
 | `get_secrets_overview`       | Secrets Manager — names and rotation status (values never included)                                         |
 | `get_parameter_overview`     | SSM Parameter Store — names, types, tiers (values never included)                                           |
@@ -274,6 +275,9 @@ s3:
 kafka:
   enabled: false
 
+apiGateway:
+  enabled: false
+
 cloudwatchLogs:
   enabled: false
   logGroupPrefixes: []
@@ -281,6 +285,9 @@ cloudwatchLogs:
 
 analysis:
   sampleSize: 100
+  hotPartitionThreshold: 5
+  hotPartitionThresholds:
+    high-traffic-table: 12
 ```
 
 ### AWS setup
@@ -334,13 +341,14 @@ Works from AWS APIs, database schema introspection, and IaC files — no depende
 | DynamoDB schema                  | Tables, GSIs, partition keys                                                                                       |
 | PostgreSQL / MySQL schema        | Tables, indexes, column types                                                                                      |
 | MongoDB schema                   | Collections, indexes                                                                                               |
-| SQS                              | Missing DLQs, unencrypted queues, large backlogs                                                                   |
+| SQS                              | Missing DLQs, unencrypted queues, large backlogs, FIFO detection, visibility timeout vs Lambda timeout mismatch    |
 | SNS                              | Subscription filter policies — required message attributes per subscription                                        |
 | Kafka (kafkajs)                  | Producer/consumer topic mapping from code                                                                          |
 | Secrets Manager                  | Missing secret rotation                                                                                            |
 | Lambda                           | Default memory (128 MB), high timeouts, triggers (SQS/DynamoDB/Kinesis/EventBridge/S3), missing DLQ on trigger source |
 | S3                               | Public access blocking (verify), missing versioning, missing encryption                                            |
 | EventBridge                      | Rules, schedules, event patterns, target Lambda functions                                                          |
+| API Gateway                      | REST, HTTP, and WebSocket APIs — routes, methods, Lambda integrations                                             |
 | RDS                              | Publicly accessible, no backups, unencrypted, no deletion protection, single-AZ                                    |
 | CloudWatch Logs                  | Log groups with no retention policy                                                                                |
 | Terraform / CloudFormation / CDK | IaC drift vs deployed state                                                                                        |
@@ -361,6 +369,9 @@ Uses [ts-morph](https://ts-morph.com/) AST analysis to detect which functions ca
 | MySQL Full Table Scan      | High     | Full table scan patterns in MySQL queries     |
 | Missing Mongo Index        | Medium   | Collections queried without secondary indexes |
 | Collection Scan            | High     | `find()` calls without filter predicates      |
+| Pipeline: scan in consumer | High / Verify | Full scan inside an event-triggered Lambda handler (High when the lambda-to-code link is IaC-proven, Verify when name-matched) |
+| Pipeline: repeated table access | Medium / Verify | Same table read by 2+ functions in one service pipeline |
+| Pipeline: missing DLQ hop  | Medium   | Mid-pipeline queue (has producer and consumer) with no Dead Letter Queue |
 
 Non-TypeScript/JavaScript projects still get full value from infrastructure-level analyzers — code correlation (function-to-table mapping, N+1 patterns) is skipped.
 
@@ -409,10 +420,10 @@ src/
   core/         Config (Zod + YAML), logger (Pino), local cache
   graph/        Graph engine — nodes, edges, builder
   adapters/
-    aws/        DynamoDB, S3, Lambda, SQS/SNS/SSM/Secrets/EventBridge/RDS, CloudWatch
+    aws/        DynamoDB, S3, Lambda, SQS/SNS/SSM/Secrets/EventBridge/RDS/APIGateway, CloudWatch
     db/         PostgreSQL, MySQL, MongoDB
     iac/        Terraform, CDK, CloudFormation (local file parsing)
-  analyzers/    27 rule-based analyzers
+  analyzers/    29 rule-based analyzers
   context/      Repository scanner (ts-morph AST)
   server/       Fastify MCP server (@modelcontextprotocol/sdk, Streamable HTTP)
   cli/          CLI commands (Commander.js)

package/dist/adapters/aws/services.js

@@ -1,4 +1,6 @@
 import { SQSClient, ListQueuesCommand, GetQueueAttributesCommand } from '@aws-sdk/client-sqs';
+import { APIGatewayClient, GetRestApisCommand, GetResourcesCommand, } from '@aws-sdk/client-api-gateway';
+import { ApiGatewayV2Client, GetApisCommand, GetRoutesCommand, GetIntegrationsCommand, } from '@aws-sdk/client-apigatewayv2';
 import { SNSClient, ListTopicsCommand, GetTopicAttributesCommand, ListSubscriptionsByTopicCommand, GetSubscriptionAttributesCommand, } from '@aws-sdk/client-sns';
 import { SSMClient, DescribeParametersCommand } from '@aws-sdk/client-ssm';
 import { SecretsManagerClient, ListSecretsCommand } from '@aws-sdk/client-secrets-manager';
@@ -66,6 +68,7 @@ export async function extractSQSMetadata(cfg = {}) {
                     : undefined;
                 const encrypted = !!(a['KmsMasterKeyId'] || a['SqsManagedSseEnabled'] === 'true');
                 const retentionSeconds = parseInt(a['MessageRetentionPeriod'] ?? '345600', 10);
+                const isFifo = name.endsWith('.fifo') || a['FifoQueue'] === 'true';
                 queues.push({
                     name,
                     url,
@@ -73,6 +76,7 @@ export async function extractSQSMetadata(cfg = {}) {
                     hasDLQ: !!dlqArn,
                     dlqArn,
                     encrypted,
+                    isFifo,
                     visibilityTimeoutSec: parseInt(a['VisibilityTimeout'] ?? '30', 10),
                     retentionDays: Math.round(retentionSeconds / 86400),
                     approximateMessages: parseInt(a['ApproximateNumberOfMessages'] ?? '0', 10),
@@ -382,3 +386,105 @@ export async function extractRDSMetadata(cfg = {}) {
 export async function validateRDSAccess(cfg = {}) {
     await new RDSClient(clientConfig(cfg)).send(new DescribeDBInstancesCommand({ MaxRecords: 20 }));
 }
+// ─── API Gateway ──────────────────────────────────────────────────────────────
+function lambdaNameFromArn(arn) {
+    if (!arn)
+        return undefined;
+    const parts = arn.split(':');
+    return parts[parts.length - 1] || undefined;
+}
+export async function extractAPIGatewayMetadata(cfg = {}) {
+    const results = [];
+    const ccfg = clientConfig(cfg);
+    // REST APIs (v1)
+    try {
+        const restClient = new APIGatewayClient(ccfg);
+        let position;
+        const restApis = [];
+        do {
+            const res = await restClient.send(new GetRestApisCommand({ position, limit: 500 }));
+            for (const api of res.items ?? []) {
+                if (api.id && api.name)
+                    restApis.push({ id: api.id, name: api.name });
+            }
+            position = res.position;
+        } while (position);
+        for (const api of restApis) {
+            const routes = [];
+            try {
+                const resourcesRes = await restClient.send(new GetResourcesCommand({ restApiId: api.id, embed: ['methods'], limit: 500 }));
+                for (const resource of resourcesRes.items ?? []) {
+                    const resourcePath = resource.path ?? '/';
+                    for (const [method, methodItem] of Object.entries(resource.resourceMethods ?? {})) {
+                        if (method === 'OPTIONS')
+                            continue;
+                        const integration = methodItem
+                            ?.methodIntegration;
+                        const lambdaArn = typeof integration?.uri === 'string' ? integration.uri : undefined;
+                        const lambdaName = lambdaArn
+                            ? lambdaNameFromArn(lambdaArn.split('/functions/')[1]?.split('/')[0])
+                            : undefined;
+                        routes.push({ method, path: resourcePath, lambdaArn, lambdaName });
+                    }
+                }
+            }
+            catch (err) {
+                logger.warn(`API Gateway REST resources failed for ${api.name}: ${err instanceof Error ? err.message : String(err)}`);
+            }
+            results.push({ name: api.name, id: api.id, type: 'REST', routes });
+        }
+    }
+    catch (err) {
+        logger.warn(`API Gateway REST list failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    // HTTP + WebSocket APIs (v2)
+    try {
+        const v2Client = new ApiGatewayV2Client(ccfg);
+        let nextToken;
+        const v2Apis = [];
+        do {
+            const res = await v2Client.send(new GetApisCommand({ NextToken: nextToken, MaxResults: '500' }));
+            for (const api of res.Items ?? []) {
+                if (api.ApiId && api.Name) {
+                    v2Apis.push({ id: api.ApiId, name: api.Name, protocolType: api.ProtocolType ?? 'HTTP' });
+                }
+            }
+            nextToken = res.NextToken;
+        } while (nextToken);
+        for (const api of v2Apis) {
+            const apiType = api.protocolType === 'WEBSOCKET' ? 'WEBSOCKET' : 'HTTP';
+            const routes = [];
+            try {
+                const [routesRes, integrationsRes] = await Promise.all([
+                    v2Client.send(new GetRoutesCommand({ ApiId: api.id, MaxResults: '500' })),
+                    v2Client.send(new GetIntegrationsCommand({ ApiId: api.id, MaxResults: '500' })),
+                ]);
+                const integrationMap = new Map();
+                for (const integ of integrationsRes.Items ?? []) {
+                    if (integ.IntegrationId && integ.IntegrationUri) {
+                        integrationMap.set(integ.IntegrationId, integ.IntegrationUri);
+                    }
+                }
+                for (const route of routesRes.Items ?? []) {
+                    const routeKey = route.RouteKey ?? '';
+                    const [method, ...pathParts] = routeKey.split(' ');
+                    const routePath = pathParts.join(' ') || '/';
+                    const integrationId = route.Target?.replace('integrations/', '');
+                    const lambdaArn = integrationId ? integrationMap.get(integrationId) : undefined;
+                    const lambdaName = lambdaArn
+                        ? lambdaNameFromArn(lambdaArn.split('/functions/')[1]?.split('/')[0])
+                        : undefined;
+                    routes.push({ method: method ?? routeKey, path: routePath, lambdaArn, lambdaName });
+                }
+            }
+            catch (err) {
+                logger.warn(`API Gateway v2 routes failed for ${api.name}: ${err instanceof Error ? err.message : String(err)}`);
+            }
+            results.push({ name: api.name, id: api.id, type: apiType, routes });
+        }
+    }
+    catch (err) {
+        logger.debug(`API Gateway v2 list failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    return results;
+}

package/dist/adapters/iac/terraform.js

@@ -135,6 +135,7 @@ export async function extractTerraformSchema(repoPath) {
                     schema.lambdas.push({
                         name: tfStr(body, 'function_name') ?? resourceName,
                         runtime: tfStr(body, 'runtime'),
+                        handler: tfStr(body, 'handler'),
                         source: 'terraform',
                         filePath,
                     });
@@ -299,6 +300,7 @@ function processCFNResources(resources, schema, filePath, source) {
                 schema.lambdas.push({
                     name: cfnStr(props, 'FunctionName') ?? logicalId,
                     runtime: cfnStr(props, 'Runtime'),
+                    handler: cfnStr(props, 'Handler'),
                     source,
                     filePath,
                 });

package/dist/analyzers/aws-services.js

@@ -64,6 +64,42 @@ export class LargeQueueBacklogAnalyzer {
         return findings;
     }
 }
+export class VisibilityTimeoutMismatchAnalyzer {
+    name = 'VisibilityTimeoutMismatchAnalyzer';
+    async analyze(graph) {
+        const findings = [];
+        const lambdaTimeouts = new Map();
+        for (const node of graph.nodes) {
+            if (node.type === 'lambda' && node.timeoutSec) {
+                lambdaTimeouts.set(node.name, node.timeoutSec);
+            }
+        }
+        for (const node of graph.nodes) {
+            if (node.type !== 'queue' || node.visibilityTimeoutSec === undefined)
+                continue;
+            const triggeringEdge = graph.edges.find((e) => e.type === 'triggers' && e.from === `queue:aws:${node.name}`);
+            if (!triggeringEdge)
+                continue;
+            const lambdaName = triggeringEdge.to.replace('lambda:aws:', '');
+            const lambdaTimeout = lambdaTimeouts.get(lambdaName);
+            if (lambdaTimeout && node.visibilityTimeoutSec < lambdaTimeout) {
+                findings.push({
+                    severity: 'high',
+                    issue: `Queue "${node.name}" visibility timeout (${node.visibilityTimeoutSec}s) is less than Lambda "${lambdaName}" timeout (${lambdaTimeout}s)`,
+                    description: `If the Lambda takes longer than the visibility timeout, SQS will re-deliver the message to another consumer while the original invocation is still running, causing duplicate processing.`,
+                    recommendation: `Set the visibility timeout for "${node.name}" to at least ${lambdaTimeout * 6}s (6× the Lambda timeout of ${lambdaTimeout}s), per AWS best practice.`,
+                    metadata: {
+                        queueName: node.name,
+                        visibilityTimeoutSec: node.visibilityTimeoutSec,
+                        lambdaName,
+                        lambdaTimeoutSec: lambdaTimeout,
+                    },
+                });
+            }
+        }
+        return findings;
+    }
+}
 // ─── Secrets Manager ─────────────────────────────────────────────────────────
 export class MissingSecretRotationAnalyzer {
     name = 'MissingSecretRotationAnalyzer';

package/dist/analyzers/dynamodb.js

@@ -90,8 +90,10 @@ export class MissingGSIAnalyzer {
 export class HotPartitionAnalyzer {
     name = 'HotPartitionAnalyzer';
     hotThreshold;
-    constructor(hotThreshold = 5) {
+    tableThresholds;
+    constructor(hotThreshold = 5, tableThresholds = {}) {
         this.hotThreshold = hotThreshold;
+        this.tableThresholds = tableThresholds;
     }
     async analyze(graph) {
         const findings = [];
@@ -110,10 +112,11 @@ export class HotPartitionAnalyzer {
             accessors.add(edge.from);
         }
         for (const [tableId, accessors] of tableAccessCount) {
-            if (accessors.size >= this.hotThreshold) {
-                const tableNode = graph.nodes.find((n) => n.id === tableId);
-                if (!tableNode)
-                    continue;
+            const tableNode = graph.nodes.find((n) => n.id === tableId);
+            if (!tableNode)
+                continue;
+            const threshold = this.tableThresholds[tableNode.name] ?? this.hotThreshold;
+            if (accessors.size >= threshold) {
                 // Also check edge frequency for repeated access patterns
                 let maxFreq = 0;
                 for (const [key, freq] of edgeFrequency) {
@@ -128,6 +131,7 @@ export class HotPartitionAnalyzer {
                     metadata: {
                         tableName: tableNode.name,
                         accessorCount: accessors.size,
+                        threshold,
                         maxEdgeFrequency: maxFreq,
                     },
                 });

package/dist/analyzers/index.js

@@ -4,7 +4,8 @@ export { MissingIndexAnalyzer, NplusOneAnalyzer, LargeSelectAnalyzer } from './p
 export { MissingMySQLIndexAnalyzer, MySQLFullTableScanAnalyzer } from './mysql.js';
 export { MissingMongoIndexAnalyzer, MongoCollectionScanAnalyzer } from './mongodb.js';
 export { IaCDriftAnalyzer } from './terraform.js';
-export { MissingDLQAnalyzer, UnencryptedQueueAnalyzer, LargeQueueBacklogAnalyzer, MissingSecretRotationAnalyzer, MissingLogRetentionAnalyzer, LambdaDefaultMemoryAnalyzer, LambdaHighTimeoutAnalyzer, LambdaMissingTriggerDLQAnalyzer, S3PublicAccessAnalyzer, S3MissingVersioningAnalyzer, S3UnencryptedAnalyzer, } from './aws-services.js';
+export { PipelineAnalyzer } from './pipeline.js';
+export { MissingDLQAnalyzer, UnencryptedQueueAnalyzer, LargeQueueBacklogAnalyzer, VisibilityTimeoutMismatchAnalyzer, MissingSecretRotationAnalyzer, MissingLogRetentionAnalyzer, LambdaDefaultMemoryAnalyzer, LambdaHighTimeoutAnalyzer, LambdaMissingTriggerDLQAnalyzer, S3PublicAccessAnalyzer, S3MissingVersioningAnalyzer, S3UnencryptedAnalyzer, } from './aws-services.js';
 export { RDSPubliclyAccessibleAnalyzer, RDSNoBackupAnalyzer, RDSUnencryptedAnalyzer, RDSNoDeletionProtectionAnalyzer, RDSNoMultiAZAnalyzer, } from './rds.js';
 export async function runAllAnalyzers(graph, analyzers) {
     const allFindings = [];

package/dist/analyzers/linkers.js

@@ -0,0 +1,106 @@
+const STAGE_TOKENS = new Set([
+    'prod',
+    'production',
+    'dev',
+    'development',
+    'staging',
+    'stage',
+    'test',
+    'qa',
+]);
+const NOISE_TOKENS = new Set(['handler', 'fn', 'func', 'function', 'lambda']);
+export function normalizeName(raw) {
+    let s = raw.toLowerCase().trim();
+    s = s.split('/').pop() ?? s;
+    s = s.replace(/\.(ts|js|mjs|cjs)$/, '');
+    let segs = s.split(/[-_.\s]+/).filter(Boolean);
+    if (segs.length > 1 && STAGE_TOKENS.has(segs[segs.length - 1] ?? ''))
+        segs.pop();
+    segs = segs.filter((seg) => !NOISE_TOKENS.has(seg));
+    return segs.join('');
+}
+function lambdaNodes(graph) {
+    return graph.nodes.filter((n) => n.type === 'lambda');
+}
+function functionNodes(graph) {
+    return graph.nodes.filter((n) => n.type === 'function');
+}
+export class HeuristicLinker {
+    link(graph) {
+        const fns = functionNodes(graph);
+        const links = [];
+        for (const lam of lambdaNodes(graph)) {
+            const target = normalizeName(lam.name);
+            if (!target)
+                continue;
+            const matches = fns.filter((f) => {
+                const byName = normalizeName(f.name);
+                const byFile = normalizeName(f.file);
+                return (byName !== '' && byName === target) || (byFile !== '' && byFile === target);
+            });
+            if (matches.length !== 1)
+                continue;
+            const [only] = matches;
+            if (!only)
+                continue;
+            links.push({ lambdaId: lam.id, functionId: only.id, confidence: 'inferred' });
+        }
+        return links;
+    }
+}
+function parseHandler(handler) {
+    const lastDot = handler.lastIndexOf('.');
+    if (lastDot < 0)
+        return { fileBase: '', exportName: '' };
+    const exportName = handler.slice(lastDot + 1);
+    const filePart = handler.slice(0, lastDot);
+    const fileBase = filePart.split('/').pop() ?? filePart;
+    return { fileBase, exportName };
+}
+function fileBaseNoExt(file) {
+    const base = file.split('/').pop() ?? file;
+    return base.replace(/\.(ts|js|mjs|cjs)$/, '');
+}
+export class IaCHandlerLinker {
+    iacLambdas;
+    constructor(iacLambdas) {
+        this.iacLambdas = iacLambdas;
+    }
+    link(graph) {
+        const lambdaIds = new Set(lambdaNodes(graph).map((n) => n.id));
+        const fns = functionNodes(graph);
+        const links = [];
+        for (const il of this.iacLambdas) {
+            if (!il.handler)
+                continue;
+            const lambdaId = `lambda:aws:${il.name}`;
+            if (!lambdaIds.has(lambdaId))
+                continue;
+            const { fileBase, exportName } = parseHandler(il.handler);
+            if (!exportName || !fileBase)
+                continue;
+            const matches = fns.filter((f) => f.name === exportName && fileBaseNoExt(f.file) === fileBase);
+            if (matches.length !== 1)
+                continue;
+            const [only] = matches;
+            if (!only)
+                continue;
+            links.push({ lambdaId, functionId: only.id, confidence: 'proven' });
+        }
+        return links;
+    }
+}
+export class CompositeLinker {
+    proven;
+    heuristic;
+    constructor(proven, heuristic) {
+        this.proven = proven;
+        this.heuristic = heuristic;
+    }
+    link(graph) {
+        const provenLinks = this.proven.link(graph);
+        const covered = new Set(provenLinks.map((l) => l.lambdaId));
+        const heur = this.heuristic.link(graph).filter((l) => !covered.has(l.lambdaId));
+        return [...provenLinks, ...heur];
+    }
+}

package/dist/analyzers/pipeline.js

@@ -0,0 +1,166 @@
+import { HeuristicLinker, IaCHandlerLinker, CompositeLinker, } from './linkers.js';
+const TRANSPORT_EDGES = new Set(['publishes_to', 'triggers']);
+export class PipelineAnalyzer {
+    name = 'PipelineAnalyzer';
+    iacLambdas = [];
+    setIaCLambdas(lambdas) {
+        this.iacLambdas = lambdas;
+    }
+    async analyze(graph) {
+        const links = new CompositeLinker(new IaCHandlerLinker(this.iacLambdas), new HeuristicLinker()).link(graph);
+        const nodeById = new Map(graph.nodes.map((n) => [n.id, n]));
+        return [
+            ...detectMissingDlqHop(graph),
+            ...detectScanInPipeline(graph, links, nodeById),
+            ...detectRepeatedTableAccess(graph, links, nodeById),
+        ];
+    }
+}
+class UnionFind {
+    parent = new Map();
+    find(x) {
+        const p = this.parent.get(x);
+        if (p === undefined) {
+            this.parent.set(x, x);
+            return x;
+        }
+        if (p === x)
+            return x;
+        const root = this.find(p);
+        this.parent.set(x, root);
+        return root;
+    }
+    union(a, b) {
+        const ra = this.find(a);
+        const rb = this.find(b);
+        if (ra !== rb)
+            this.parent.set(ra, rb);
+    }
+}
+function buildComponents(graph, links) {
+    const uf = new UnionFind();
+    for (const e of graph.edges) {
+        if (TRANSPORT_EDGES.has(e.type))
+            uf.union(e.from, e.to);
+    }
+    for (const l of links)
+        uf.union(l.lambdaId, l.functionId);
+    const inferredRoots = new Set();
+    for (const l of links) {
+        if (l.confidence === 'inferred')
+            inferredRoots.add(uf.find(l.lambdaId));
+    }
+    return { uf, inferredRoots };
+}
+function detectMissingDlqHop(graph) {
+    const hasProducer = new Set();
+    const hasConsumer = new Set();
+    for (const e of graph.edges) {
+        if (e.type === 'publishes_to')
+            hasProducer.add(e.to);
+        if (e.type === 'triggers')
+            hasConsumer.add(e.from);
+    }
+    const findings = [];
+    for (const node of graph.nodes) {
+        if (node.type !== 'queue' || node.hasDLQ)
+            continue;
+        if (!hasProducer.has(node.id) || !hasConsumer.has(node.id))
+            continue;
+        findings.push({
+            severity: 'medium',
+            issue: `Queue "${node.name}" sits mid-pipeline without a Dead Letter Queue`,
+            description: `Queue "${node.name}" has both a producer and a downstream consumer but no DLQ. A failure in the consumer drops the message silently, breaking the pipeline with no recovery path.`,
+            recommendation: `Add a Dead Letter Queue to "${node.name}" with maxReceiveCount 3-5, and alert on DLQ depth so mid-pipeline failures are visible.`,
+            metadata: { queueName: node.name, pipelineHop: true },
+        });
+    }
+    return findings;
+}
+function detectScanInPipeline(graph, links, nodeById) {
+    const triggeredLambdas = new Set();
+    for (const e of graph.edges) {
+        if (e.type === 'triggers')
+            triggeredLambdas.add(e.to);
+    }
+    const triggeredFunctionLinks = new Map();
+    for (const l of links) {
+        if (triggeredLambdas.has(l.lambdaId))
+            triggeredFunctionLinks.set(l.functionId, l);
+    }
+    const findings = [];
+    const seen = new Set();
+    for (const e of graph.edges) {
+        if (e.type !== 'scan')
+            continue;
+        const link = triggeredFunctionLinks.get(e.from);
+        if (!link)
+            continue;
+        const fn = nodeById.get(e.from);
+        const table = nodeById.get(e.to);
+        const lambda = nodeById.get(link.lambdaId);
+        if (!fn || fn.type !== 'function' || !table || table.type !== 'table')
+            continue;
+        const dedupe = `${e.from}\0${e.to}`;
+        if (seen.has(dedupe))
+            continue;
+        seen.add(dedupe);
+        const inferred = link.confidence === 'inferred';
+        const lambdaName = lambda && lambda.type === 'lambda' ? lambda.name : link.lambdaId;
+        findings.push({
+            severity: inferred ? 'verify' : 'high',
+            issue: `Full scan runs inside event-triggered Lambda "${lambdaName}"`,
+            description: `Function "${fn.name}" (${fn.file}) performs a full scan on table "${table.name}" and runs as the handler for event-triggered Lambda "${lambdaName}". A scan inside an event-driven consumer executes on every invocation, multiplying read cost with traffic.` +
+                (inferred
+                    ? ` The Lambda-to-code link is inferred by name match (not proven from IaC), so verify it before acting.`
+                    : ` The Lambda-to-code link is proven from IaC handler configuration.`),
+            recommendation: `Replace the scan with a Query using a partition key, or add a GSI for the access pattern. Scans in per-event handlers are the highest-leverage place to fix.`,
+            metadata: { function: fn.name, table: table.name, lambda: lambdaName, inferred },
+        });
+    }
+    return findings;
+}
+function detectRepeatedTableAccess(graph, links, nodeById) {
+    const { uf, inferredRoots } = buildComponents(graph, links);
+    const access = new Map();
+    for (const e of graph.edges) {
+        if (e.type !== 'query' && e.type !== 'scan')
+            continue;
+        const fromNode = nodeById.get(e.from);
+        const toNode = nodeById.get(e.to);
+        if (!fromNode || fromNode.type !== 'function')
+            continue;
+        if (!toNode || toNode.type !== 'table')
+            continue;
+        const key = `${uf.find(e.from)}\0${e.to}`;
+        const set = access.get(key) ?? new Set();
+        set.add(e.from);
+        access.set(key, set);
+    }
+    const findings = [];
+    for (const [key, fns] of access) {
+        if (fns.size < 2)
+            continue;
+        const [root, tableId] = key.split('\0');
+        const table = nodeById.get(tableId);
+        if (!table || table.type !== 'table')
+            continue;
+        const fnNames = [...fns]
+            .map((id) => nodeById.get(id))
+            .filter((n) => !!n && n.type === 'function')
+            .map((n) => `${n.name} (${n.file})`)
+            .sort();
+        const inferred = inferredRoots.has(root);
+        findings.push({
+            severity: inferred ? 'verify' : 'medium',
+            issue: `Table "${table.name}" is accessed at multiple stages of one pipeline`,
+            description: `Table "${table.name}" is read by ${fns.size} functions linked in the same service pipeline: ${fnNames.join(', ')}. Re-reading the same table across pipeline stages often signals redundant work that could be passed forward in the message payload.` +
+                (inferred
+                    ? ` One or more Lambda-to-code links on this pipeline are inferred by name match (not proven from IaC), so verify the chain before acting.`
+                    : ''),
+            recommendation: `Confirm each access is necessary. Consider carrying the needed fields in the event payload, caching the first read, or consolidating the reads. If the duplication is intentional, no action needed.`,
+            metadata: { tableName: table.name, functions: fnNames, inferred },
+        });
+    }
+    return findings;
+}

package/dist/cli/commands/analyze.js

@@ -8,12 +8,12 @@ import { extractPostgresMetadata } from '../../adapters/db/postgres.js';
 import { extractMySQLMetadata } from '../../adapters/db/mysql.js';
 import { extractMongoMetadata } from '../../adapters/db/mongodb.js';
 import { extractIaCSchema } from '../../adapters/iac/terraform.js';
-import { extractSQSMetadata, extractSNSMetadata, extractSSMMetadata, extractSecretsMetadata, extractLambdaMetadata, extractEventBridgeMetadata, extractRDSMetadata, } from '../../adapters/aws/services.js';
+import { extractSQSMetadata, extractSNSMetadata, extractSSMMetadata, extractSecretsMetadata, extractLambdaMetadata, extractEventBridgeMetadata, extractRDSMetadata, extractAPIGatewayMetadata, } from '../../adapters/aws/services.js';
 import { extractLogsMetadata } from '../../adapters/aws/logs.js';
 import { extractS3Metadata } from '../../adapters/aws/s3.js';
 import { scanRepository } from '../../context/index.js';
 import { buildGraph } from '../../graph/index.js';
-import { runAllAnalyzers, IaCDriftAnalyzer, FullTableScanAnalyzer, MissingGSIAnalyzer, HotPartitionAnalyzer, MissingIndexAnalyzer, NplusOneAnalyzer, LargeSelectAnalyzer, MissingMySQLIndexAnalyzer, MySQLFullTableScanAnalyzer, MissingMongoIndexAnalyzer, MongoCollectionScanAnalyzer, MissingDLQAnalyzer, UnencryptedQueueAnalyzer, LargeQueueBacklogAnalyzer, MissingSecretRotationAnalyzer, MissingLogRetentionAnalyzer, LambdaDefaultMemoryAnalyzer, LambdaHighTimeoutAnalyzer, LambdaMissingTriggerDLQAnalyzer, RDSPubliclyAccessibleAnalyzer, RDSNoBackupAnalyzer, RDSUnencryptedAnalyzer, RDSNoDeletionProtectionAnalyzer, RDSNoMultiAZAnalyzer, S3PublicAccessAnalyzer, S3MissingVersioningAnalyzer, S3UnencryptedAnalyzer, } from '../../analyzers/index.js';
+import { runAllAnalyzers, IaCDriftAnalyzer, PipelineAnalyzer, FullTableScanAnalyzer, MissingGSIAnalyzer, HotPartitionAnalyzer, MissingIndexAnalyzer, NplusOneAnalyzer, LargeSelectAnalyzer, MissingMySQLIndexAnalyzer, MySQLFullTableScanAnalyzer, MissingMongoIndexAnalyzer, MongoCollectionScanAnalyzer, MissingDLQAnalyzer, UnencryptedQueueAnalyzer, LargeQueueBacklogAnalyzer, VisibilityTimeoutMismatchAnalyzer, MissingSecretRotationAnalyzer, MissingLogRetentionAnalyzer, LambdaDefaultMemoryAnalyzer, LambdaHighTimeoutAnalyzer, LambdaMissingTriggerDLQAnalyzer, RDSPubliclyAccessibleAnalyzer, RDSNoBackupAnalyzer, RDSUnencryptedAnalyzer, RDSNoDeletionProtectionAnalyzer, RDSNoMultiAZAnalyzer, S3PublicAccessAnalyzer, S3MissingVersioningAnalyzer, S3UnencryptedAnalyzer, } from '../../analyzers/index.js';
 import { printFinding, printSummaryBox, log, printHeader } from '../utils.js';
 const SEVERITY_ORDER = { high: 3, medium: 2, low: 1, verify: 0 };
 function buildMarkdownReport(findings, projectName) {
@@ -230,6 +230,20 @@ export async function runAnalyze(options = {}) {
                 chalk.dim(`  ${err instanceof Error ? err.message : String(err)}`));
         }
     }
+    // ── API Gateway ───────────────────────────────────────────────────────────────
+    if (config.apiGateway?.enabled === true) {
+        const s = mkSpinner('Extracting API Gateway routes...');
+        try {
+            const result = await extractAPIGatewayMetadata(awsCfg);
+            servicesMeta.apiGateway = result;
+            const routeCount = result.reduce((sum, api) => sum + api.routes.length, 0);
+            s.succeed(chalk.green('API Gateway') + chalk.dim(`  ${result.length} API(s), ${routeCount} route(s)`));
+        }
+        catch (err) {
+            s.warn(chalk.yellow('API Gateway skipped') +
+                chalk.dim(`  ${err instanceof Error ? err.message : String(err)}`));
+        }
+    }
     // ── CloudWatch Logs ──────────────────────────────────────────────────────────
     if (config.cloudwatchLogs?.enabled) {
         const s = mkSpinner('Sampling CloudWatch Logs (errors only, max 50 groups)...');
@@ -251,6 +265,7 @@ export async function runAnalyze(options = {}) {
     }
     // ── IaC schema (Terraform / CloudFormation / CDK) ────────────────────────────
     let iacDriftAnalyzer;
+    let iacLambdas = [];
     {
         const s = mkSpinner('Extracting IaC schema (Terraform / CloudFormation / CDK)...');
         try {
@@ -267,6 +282,7 @@ export async function runAnalyze(options = {}) {
                 iacSchema.apiGateways.length;
             iacDriftAnalyzer = new IaCDriftAnalyzer();
             iacDriftAnalyzer.setIaCSchema(iacSchema);
+            iacLambdas = iacSchema.lambdas;
             s.succeed(chalk.green('IaC schema') + chalk.dim(`  ${total} resource(s) across TF/CFN/CDK`));
         }
         catch (err) {
@@ -301,9 +317,17 @@ export async function runAnalyze(options = {}) {
     let findings;
     {
         const s = mkSpinner('Running analyzers...');
+        const hotPartitionThreshold = config.analysis?.hotPartitionThreshold;
+        const hotPartitionThresholds = config.analysis?.hotPartitionThresholds;
+        const pipelineAnalyzer = new PipelineAnalyzer();
+        pipelineAnalyzer.setIaCLambdas(iacLambdas);
         const analyzers = [
             ...(config.dynamodb?.enabled === true
-                ? [new FullTableScanAnalyzer(), new MissingGSIAnalyzer(), new HotPartitionAnalyzer()]
+                ? [
+                    new FullTableScanAnalyzer(),
+                    new MissingGSIAnalyzer(),
+                    new HotPartitionAnalyzer(hotPartitionThreshold, hotPartitionThresholds),
+                ]
                 : []),
             ...(config.postgres?.enabled
                 ? [new MissingIndexAnalyzer(), new NplusOneAnalyzer(), new LargeSelectAnalyzer()]
@@ -319,6 +343,7 @@ export async function runAnalyze(options = {}) {
                     new MissingDLQAnalyzer(),
                     new UnencryptedQueueAnalyzer(),
                     new LargeQueueBacklogAnalyzer(),
+                    new VisibilityTimeoutMismatchAnalyzer(),
                 ]
                 : []),
             ...(config.secretsManager?.enabled === true ? [new MissingSecretRotationAnalyzer()] : []),
@@ -347,6 +372,7 @@ export async function runAnalyze(options = {}) {
                 ]
                 : []),
             ...(iacDriftAnalyzer ? [iacDriftAnalyzer] : []),
+            pipelineAnalyzer,
         ];
         findings = await runAllAnalyzers(graph, analyzers);
         s.succeed(chalk.green('Analysis complete') + chalk.dim(`  ${findings.length} finding(s)`));
@@ -406,10 +432,12 @@ export async function runCodeRefresh(repoPath, config) {
     const servicesMeta = cached?.servicesMeta ?? {};
     // Re-run IaC schema (pure file scan, no AWS calls)
     let iacDriftAnalyzer;
+    let iacLambdas = [];
     try {
         const iacSchema = await extractIaCSchema(repoPath);
         iacDriftAnalyzer = new IaCDriftAnalyzer();
         iacDriftAnalyzer.setIaCSchema(iacSchema);
+        iacLambdas = iacSchema.lambdas;
     }
     catch {
         // IaC scan is best-effort
@@ -423,9 +451,17 @@ export async function runCodeRefresh(repoPath, config) {
         operations = [];
     }
     const graph = buildGraph(operations, dynamoMeta, postgresMeta, mysqlMeta, mongoMeta, servicesMeta);
+    const hotPartitionThreshold = config.analysis?.hotPartitionThreshold;
+    const hotPartitionThresholds = config.analysis?.hotPartitionThresholds;
+    const pipelineAnalyzer = new PipelineAnalyzer();
+    pipelineAnalyzer.setIaCLambdas(iacLambdas);
     const analyzers = [
         ...(config.dynamodb?.enabled === true
-            ? [new FullTableScanAnalyzer(), new MissingGSIAnalyzer(), new HotPartitionAnalyzer()]
+            ? [
+                new FullTableScanAnalyzer(),
+                new MissingGSIAnalyzer(),
+                new HotPartitionAnalyzer(hotPartitionThreshold, hotPartitionThresholds),
+            ]
             : []),
         ...(config.postgres?.enabled
             ? [new MissingIndexAnalyzer(), new NplusOneAnalyzer(), new LargeSelectAnalyzer()]
@@ -437,7 +473,12 @@ export async function runCodeRefresh(repoPath, config) {
             ? [new MissingMongoIndexAnalyzer(), new MongoCollectionScanAnalyzer()]
             : []),
         ...(config.sqs?.enabled === true
-            ? [new MissingDLQAnalyzer(), new UnencryptedQueueAnalyzer(), new LargeQueueBacklogAnalyzer()]
+            ? [
+                new MissingDLQAnalyzer(),
+                new UnencryptedQueueAnalyzer(),
+                new LargeQueueBacklogAnalyzer(),
+                new VisibilityTimeoutMismatchAnalyzer(),
+            ]
             : []),
         ...(config.secretsManager?.enabled === true ? [new MissingSecretRotationAnalyzer()] : []),
         ...(config.cloudwatchLogs?.enabled ? [new MissingLogRetentionAnalyzer()] : []),
@@ -465,6 +506,7 @@ export async function runCodeRefresh(repoPath, config) {
             ]
             : []),
         ...(iacDriftAnalyzer ? [iacDriftAnalyzer] : []),
+        pipelineAnalyzer,
     ];
     const findings = await runAllAnalyzers(graph, analyzers);
     writeCache('graph', graph);

package/dist/core/config.js

@@ -57,6 +57,7 @@ export const InfrawiseConfigSchema = z.object({
     rds: z.object({ enabled: z.boolean().optional().default(false) }).optional(),
     s3: z.object({ enabled: z.boolean().optional().default(false) }).optional(),
     kafka: z.object({ enabled: z.boolean().optional().default(false) }).optional(),
+    apiGateway: z.object({ enabled: z.boolean().optional().default(false) }).optional(),
     cloudwatchLogs: z
         .object({
         enabled: z.boolean().optional().default(false),
@@ -67,6 +68,11 @@ export const InfrawiseConfigSchema = z.object({
     analysis: z
         .object({
         sampleSize: z.number().int().positive().optional().default(100),
+        hotPartitionThreshold: z.number().int().positive().optional().default(5),
+        hotPartitionThresholds: z
+            .record(z.string(), z.number().int().positive())
+            .optional()
+            .default({}),
     })
         .optional(),
 });

package/dist/graph/index.js

@@ -73,10 +73,28 @@ export function buildGraph(operations, dynamoMeta, postgresMeta, mysqlMeta = [],
             provider: 'aws',
             hasDLQ: q.hasDLQ,
             encrypted: q.encrypted,
+            isFifo: q.isFifo,
+            visibilityTimeoutSec: q.visibilityTimeoutSec,
             approximateMessages: q.approximateMessages,
             retentionDays: q.retentionDays,
         });
     }
+    for (const api of servicesMeta.apiGateway ?? []) {
+        addNode({
+            id: `api:aws:${api.id}`,
+            type: 'api',
+            name: api.name,
+            provider: 'aws',
+            apiType: api.type,
+            routes: api.routes,
+        });
+        for (const route of api.routes) {
+            if (route.lambdaName) {
+                const lambdaId = `lambda:aws:${route.lambdaName}`;
+                edges.push({ from: `api:aws:${api.id}`, to: lambdaId, type: 'triggers' });
+            }
+        }
+    }
     for (const t of servicesMeta.sns ?? []) {
         addNode({
             id: `topic:aws:${t.name}`,
@@ -402,3 +420,6 @@ export function getEdgeFrequency(graph) {
     }
     return freq;
 }
+export function getAPINodes(graph) {
+    return graph.nodes.filter((n) => n.type === 'api');
+}

package/dist/server/index.js

@@ -8,7 +8,7 @@ import { z } from 'zod';
 import { logger } from '../core/index.js';
 const { version } = JSON.parse(readFileSync(join(import.meta.dirname, '../../package.json'), 'utf8'));
 import { summarizeFindings } from '../analyzers/index.js';
-import { getTableNodes, getFunctionNodes, getQueueNodes, getTopicNodes, getSecretNodes, getParameterNodes, getLogGroupNodes, getLambdaNodes, getEventBridgeRuleNodes, getBucketNodes, getScanEdges, getOutgoingEdges, } from '../graph/index.js';
+import { getTableNodes, getFunctionNodes, getQueueNodes, getTopicNodes, getSecretNodes, getParameterNodes, getLogGroupNodes, getLambdaNodes, getEventBridgeRuleNodes, getBucketNodes, getAPINodes, getScanEdges, getOutgoingEdges, } from '../graph/index.js';
 // ── State ────────────────────────────────────────────────────────────────────
 let currentGraph = { nodes: [], edges: [] };
 let currentFindings = [];
@@ -244,7 +244,7 @@ export function createMcpServer() {
         });
     }));
     mcp.registerTool('get_queue_details', {
-        description: 'Returns all SQS queues with DLQ presence, encryption status, approximate message count, and retention days. Call this when reviewing messaging architecture, investigating a message backlog, or checking DLQ coverage before adding a new consumer. Use get_infra_overview for a quick queue count only.',
+        description: 'Returns all SQS queues with DLQ presence, encryption status, FIFO type (isFifo), visibility timeout, approximate message count, and retention days. When isFifo is true, all SendMessage calls must include a MessageGroupId. Call this when reviewing messaging architecture, investigating a message backlog, checking DLQ coverage, or verifying visibility timeout is set correctly relative to Lambda timeout (should be 6× the Lambda timeout). Use get_infra_overview for a quick queue count only.',
         inputSchema: z.object({}),
     }, logged('get_queue_details', async () => {
         const queues = getQueueNodes(currentGraph);
@@ -256,6 +256,8 @@ export function createMcpServer() {
                 provider: q.provider,
                 hasDLQ: q.hasDLQ,
                 encrypted: q.encrypted,
+                isFifo: q.isFifo ?? false,
+                visibilityTimeoutSec: q.visibilityTimeoutSec,
                 approximateMessages: q.approximateMessages,
                 retentionDays: q.retentionDays,
                 findings: queueFindings
@@ -385,6 +387,24 @@ export function createMcpServer() {
             })),
         });
     }));
+    mcp.registerTool('get_api_routes', {
+        description: 'Returns all API Gateway APIs (REST, HTTP, WebSocket) with their routes, HTTP methods, paths, and the Lambda function each route invokes. Call this before writing any API handler to understand which Lambda handles a route, or when reviewing API surface area and Lambda integration coverage.',
+        inputSchema: z.object({}),
+    }, logged('get_api_routes', async () => {
+        const apis = getAPINodes(currentGraph);
+        return toText({
+            total: apis.length,
+            apis: apis.map((api) => ({
+                name: api.name,
+                type: api.apiType,
+                routes: (api.routes ?? []).map((r) => ({
+                    method: r.method,
+                    path: r.path,
+                    lambda: r.lambdaName ?? null,
+                })),
+            })),
+        });
+    }));
     mcp.registerTool('get_log_errors', {
         description: 'Returns recent error pattern summaries from CloudWatch log groups: pattern counts and frequencies grouped by log group. Raw log messages are never returned. Use the optional logGroup filter to scope to one group by name substring. Call this when investigating errors or identifying log groups with no retention policy.',
         inputSchema: z.object({

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "infrawise",
-  "version": "0.10.3",
+  "version": "0.11.0",
   "mcpName": "io.github.Sidd27/infrawise",
-  "description": "CLI-first infrastructure intelligence platform — analyzes DynamoDB, PostgreSQL, MySQL, MongoDB, SQS, SNS, SSM, Secrets Manager, Lambda, S3, CloudWatch Logs and exposes findings as an MCP server for Claude Code",
+  "description": "CLI-first infrastructure intelligence platform — analyzes DynamoDB, PostgreSQL, MySQL, MongoDB, SQS, SNS, SSM, Secrets Manager, Lambda, S3, API Gateway, CloudWatch Logs and exposes findings as an MCP server for Claude Code",
   "keywords": [
     "mcp",
     "mcp-server",
@@ -32,7 +32,9 @@
     "cli",
     "terraform",
     "cloudformation",
-    "cdk"
+    "cdk",
+    "api-gateway",
+    "sqs-fifo"
   ],
   "agentskills": {
     "infrawise": "./AGENTS.md"
@@ -52,7 +54,7 @@
     "node": ">=24.0.0",
     "pnpm": ">=9.0.0"
   },
-  "packageManager": "pnpm@10.11.0",
+  "packageManager": "pnpm@11.6.0",
   "scripts": {
     "build": "tsc --noEmit false --outDir dist",
     "test": "vitest run --passWithNoTests",
@@ -71,6 +73,8 @@
     "pre-commit": "pnpm format && git add src/ && pnpm lint && pnpm typecheck && pnpm test"
   },
   "dependencies": {
+    "@aws-sdk/client-api-gateway": "^3.1068.0",
+    "@aws-sdk/client-apigatewayv2": "^3.1068.0",
     "@aws-sdk/client-cloudwatch-logs": "^3.1048.0",
     "@aws-sdk/client-dynamodb": "^3.1048.0",
     "@aws-sdk/client-eventbridge": "^3.1051.0",
@@ -121,15 +125,5 @@
   ],
   "publishConfig": {
     "access": "public"
-  },
-  "pnpm": {
-    "overrides": {
-      "qs": ">=6.15.2",
-      "vite": "^7"
-    },
-    "allowedBuildScripts": [
-      "puppeteer",
-      "simple-git-hooks"
-    ]
   }
 }