infrawise 0.12.4 → 0.12.6

package/README.md

@@ -149,7 +149,7 @@ Add to your editor's MCP config:
 
 | Tool                         | What it provides                                                                                            |
 | ---------------------------- | ----------------------------------------------------------------------------------------------------------- |
-| `get_infra_overview`         | Complete snapshot — all services, counts, and high-severity findings                                        |
+| `get_infra_overview`         | Complete snapshot — all services, counts, high-severity findings, and a `configured` flag                   |
 | `get_graph_summary`          | Full infrastructure graph — all nodes, edges, and findings                                                  |
 | `analyze_function`           | Issues in a specific function — scans, missing indexes, N+1, trigger event shapes                           |
 | `suggest_gsi`                | Exact GSI config for a DynamoDB table + attribute                                                           |

package/dist/cli/commands/analyze.js

@@ -46,6 +46,82 @@ function buildMarkdownReport(findings, projectName) {
 function mkSpinner(text) {
     return ora({ text: chalk.dim(text), color: 'cyan' }).start();
 }
+// Runs one extractor behind a spinner: succeeds with a count summary, or warns and
+// returns undefined on failure so a single service never aborts the whole analysis.
+async function extract(enabled, spinnerText, label, fn, summarize) {
+    if (!enabled)
+        return undefined;
+    const s = mkSpinner(spinnerText);
+    try {
+        const result = await fn();
+        s.succeed(chalk.green(label) + chalk.dim(`  ${summarize(result)}`));
+        return result;
+    }
+    catch (err) {
+        s.warn(chalk.yellow(`${label} skipped`) +
+            chalk.dim(`  ${err instanceof Error ? err.message : String(err)}`));
+        return undefined;
+    }
+}
+// Single source of truth for which analyzers run given the config. Used by both the
+// full `runAnalyze` and the cache-backed `runCodeRefresh` so the two never drift.
+function buildAnalyzers(config, iacDriftAnalyzer, iacLambdas) {
+    const pipelineAnalyzer = new PipelineAnalyzer();
+    pipelineAnalyzer.setIaCLambdas(iacLambdas);
+    return [
+        ...(config.dynamodb?.enabled === true
+            ? [
+                new FullTableScanAnalyzer(),
+                new MissingGSIAnalyzer(),
+                new HotPartitionAnalyzer(config.analysis?.hotPartitionThreshold, config.analysis?.hotPartitionThresholds),
+            ]
+            : []),
+        ...(config.postgres?.enabled
+            ? [new MissingIndexAnalyzer(), new NplusOneAnalyzer(), new LargeSelectAnalyzer()]
+            : []),
+        ...(config.mysql?.enabled
+            ? [new MissingMySQLIndexAnalyzer(), new MySQLFullTableScanAnalyzer()]
+            : []),
+        ...(config.mongodb?.enabled
+            ? [new MissingMongoIndexAnalyzer(), new MongoCollectionScanAnalyzer()]
+            : []),
+        ...(config.sqs?.enabled === true
+            ? [
+                new MissingDLQAnalyzer(),
+                new UnencryptedQueueAnalyzer(),
+                new LargeQueueBacklogAnalyzer(),
+                new VisibilityTimeoutMismatchAnalyzer(),
+            ]
+            : []),
+        ...(config.secretsManager?.enabled === true ? [new MissingSecretRotationAnalyzer()] : []),
+        ...(config.cloudwatchLogs?.enabled ? [new MissingLogRetentionAnalyzer()] : []),
+        ...(config.lambda?.enabled === true
+            ? [
+                new LambdaDefaultMemoryAnalyzer(),
+                new LambdaHighTimeoutAnalyzer(),
+                new LambdaMissingTriggerDLQAnalyzer(),
+            ]
+            : []),
+        ...(config.rds?.enabled === true
+            ? [
+                new RDSPubliclyAccessibleAnalyzer(),
+                new RDSNoBackupAnalyzer(),
+                new RDSUnencryptedAnalyzer(),
+                new RDSNoDeletionProtectionAnalyzer(),
+                new RDSNoMultiAZAnalyzer(),
+            ]
+            : []),
+        ...(config.s3?.enabled === true
+            ? [
+                new S3PublicAccessAnalyzer(),
+                new S3MissingVersioningAnalyzer(),
+                new S3UnencryptedAnalyzer(),
+            ]
+            : []),
+        ...(iacDriftAnalyzer ? [iacDriftAnalyzer] : []),
+        pipelineAnalyzer,
+    ];
+}
 export async function runAnalyze(options = {}) {
     printHeader('Running Analysis');
     let config;
@@ -64,204 +140,29 @@ export async function runAnalyze(options = {}) {
         region: config.aws?.region,
         profile: config.aws?.profile,
     };
-    const dynamoMeta = [];
-    const postgresMeta = [];
-    const mysqlMeta = [];
-    const mongoMeta = [];
     const servicesMeta = {};
-    // ── DynamoDB ────────────────────────────────────────────────────────────────
-    if (config.dynamodb?.enabled === true) {
-        const s = mkSpinner('Extracting DynamoDB tables...');
-        try {
-            const result = await extractDynamoMetadata(config);
-            dynamoMeta.push(...result);
-            s.succeed(chalk.green('DynamoDB') + chalk.dim(`  ${result.length} table(s)`));
-        }
-        catch (err) {
-            s.warn(chalk.yellow('DynamoDB skipped') +
-                chalk.dim(`  ${err instanceof Error ? err.message : String(err)}`));
-        }
-    }
-    // ── PostgreSQL ──────────────────────────────────────────────────────────────
-    if (config.postgres?.enabled && config.postgres.connectionString) {
-        const s = mkSpinner('Extracting PostgreSQL schema...');
-        try {
-            const result = await extractPostgresMetadata(config.postgres.connectionString);
-            postgresMeta.push(...result);
-            s.succeed(chalk.green('PostgreSQL') + chalk.dim(`  ${result.length} table(s)`));
-        }
-        catch (err) {
-            s.warn(chalk.yellow('PostgreSQL skipped') +
-                chalk.dim(`  ${err instanceof Error ? err.message : String(err)}`));
-        }
-    }
-    // ── MySQL ───────────────────────────────────────────────────────────────────
-    if (config.mysql?.enabled && config.mysql.connectionString) {
-        const s = mkSpinner('Extracting MySQL schema...');
-        try {
-            const result = await extractMySQLMetadata(config.mysql.connectionString);
-            mysqlMeta.push(...result);
-            s.succeed(chalk.green('MySQL') + chalk.dim(`  ${result.length} table(s)`));
-        }
-        catch (err) {
-            s.warn(chalk.yellow('MySQL skipped') +
-                chalk.dim(`  ${err instanceof Error ? err.message : String(err)}`));
-        }
-    }
-    // ── MongoDB ─────────────────────────────────────────────────────────────────
-    if (config.mongodb?.enabled && config.mongodb.connectionString) {
-        const s = mkSpinner('Extracting MongoDB schema...');
-        try {
-            const result = await extractMongoMetadata(config.mongodb.connectionString, config.mongodb.databases);
-            mongoMeta.push(...result);
-            s.succeed(chalk.green('MongoDB') + chalk.dim(`  ${result.length} collection(s)`));
-        }
-        catch (err) {
-            s.warn(chalk.yellow('MongoDB skipped') +
-                chalk.dim(`  ${err instanceof Error ? err.message : String(err)}`));
-        }
-    }
-    // ── SQS ─────────────────────────────────────────────────────────────────────
-    if (config.sqs?.enabled === true) {
-        const s = mkSpinner('Extracting SQS queues...');
-        try {
-            const result = await extractSQSMetadata(awsCfg);
-            servicesMeta.sqs = result;
-            s.succeed(chalk.green('SQS') + chalk.dim(`  ${result.length} queue(s)`));
-        }
-        catch (err) {
-            s.warn(chalk.yellow('SQS skipped') +
-                chalk.dim(`  ${err instanceof Error ? err.message : String(err)}`));
-        }
-    }
-    // ── SNS ─────────────────────────────────────────────────────────────────────
-    if (config.sns?.enabled === true) {
-        const s = mkSpinner('Extracting SNS topics...');
-        try {
-            const result = await extractSNSMetadata(awsCfg);
-            servicesMeta.sns = result;
-            s.succeed(chalk.green('SNS') + chalk.dim(`  ${result.length} topic(s)`));
-        }
-        catch (err) {
-            s.warn(chalk.yellow('SNS skipped') +
-                chalk.dim(`  ${err instanceof Error ? err.message : String(err)}`));
-        }
-    }
-    // ── SSM Parameter Store ──────────────────────────────────────────────────────
-    if (config.ssm?.enabled === true) {
-        const s = mkSpinner('Extracting SSM parameters...');
-        try {
-            const result = await extractSSMMetadata({ ...awsCfg, paths: config.ssm?.paths });
-            servicesMeta.ssm = result;
-            s.succeed(chalk.green('SSM') +
-                chalk.dim(`  ${result.length} parameter(s)  `) +
-                chalk.dim('(metadata only, no values)'));
-        }
-        catch (err) {
-            s.warn(chalk.yellow('SSM skipped') +
-                chalk.dim(`  ${err instanceof Error ? err.message : String(err)}`));
-        }
-    }
-    // ── Secrets Manager ──────────────────────────────────────────────────────────
-    if (config.secretsManager?.enabled === true) {
-        const s = mkSpinner('Extracting Secrets Manager metadata...');
-        try {
-            const result = await extractSecretsMetadata(awsCfg);
-            servicesMeta.secrets = result;
-            s.succeed(chalk.green('Secrets Manager') +
-                chalk.dim(`  ${result.length} secret(s)  `) +
-                chalk.dim('(names/rotation only, no values)'));
-        }
-        catch (err) {
-            s.warn(chalk.yellow('Secrets Manager skipped') +
-                chalk.dim(`  ${err instanceof Error ? err.message : String(err)}`));
-        }
-    }
-    // ── Lambda ───────────────────────────────────────────────────────────────────
-    if (config.lambda?.enabled === true) {
-        const s = mkSpinner('Extracting Lambda functions...');
-        try {
-            const result = await extractLambdaMetadata(awsCfg, config.lambda?.includeFunctions);
-            servicesMeta.lambda = result;
-            s.succeed(chalk.green('Lambda') + chalk.dim(`  ${result.length} function(s)`));
-        }
-        catch (err) {
-            s.warn(chalk.yellow('Lambda skipped') +
-                chalk.dim(`  ${err instanceof Error ? err.message : String(err)}`));
-        }
-    }
-    // ── EventBridge ──────────────────────────────────────────────────────────────
-    if (config.eventbridge?.enabled === true) {
-        const s = mkSpinner('Extracting EventBridge rules...');
-        try {
-            const result = await extractEventBridgeMetadata(awsCfg);
-            servicesMeta.eventbridge = result;
-            s.succeed(chalk.green('EventBridge') + chalk.dim(`  ${result.length} rule(s)`));
-        }
-        catch (err) {
-            s.warn(chalk.yellow('EventBridge skipped') +
-                chalk.dim(`  ${err instanceof Error ? err.message : String(err)}`));
-        }
-    }
-    // ── RDS ──────────────────────────────────────────────────────────────────────
-    if (config.rds?.enabled === true) {
-        const s = mkSpinner('Extracting RDS instances...');
-        try {
-            const result = await extractRDSMetadata(awsCfg);
-            servicesMeta.rds = result;
-            s.succeed(chalk.green('RDS') + chalk.dim(`  ${result.length} instance(s)`));
-        }
-        catch (err) {
-            s.warn(chalk.yellow('RDS skipped') +
-                chalk.dim(`  ${err instanceof Error ? err.message : String(err)}`));
-        }
-    }
-    // ── S3 ────────────────────────────────────────────────────────────────────────
-    if (config.s3?.enabled === true) {
-        const s = mkSpinner('Extracting S3 buckets...');
-        try {
-            const result = await extractS3Metadata(awsCfg);
-            servicesMeta.s3 = result;
-            s.succeed(chalk.green('S3') + chalk.dim(`  ${result.length} bucket(s)`));
-        }
-        catch (err) {
-            s.warn(chalk.yellow('S3 skipped') +
-                chalk.dim(`  ${err instanceof Error ? err.message : String(err)}`));
-        }
-    }
-    // ── API Gateway ───────────────────────────────────────────────────────────────
-    if (config.apiGateway?.enabled === true) {
-        const s = mkSpinner('Extracting API Gateway routes...');
-        try {
-            const result = await extractAPIGatewayMetadata(awsCfg);
-            servicesMeta.apiGateway = result;
-            const routeCount = result.reduce((sum, api) => sum + api.routes.length, 0);
-            s.succeed(chalk.green('API Gateway') + chalk.dim(`  ${result.length} API(s), ${routeCount} route(s)`));
-        }
-        catch (err) {
-            s.warn(chalk.yellow('API Gateway skipped') +
-                chalk.dim(`  ${err instanceof Error ? err.message : String(err)}`));
-        }
-    }
-    // ── CloudWatch Logs ──────────────────────────────────────────────────────────
-    if (config.cloudwatchLogs?.enabled) {
-        const s = mkSpinner('Sampling CloudWatch Logs (errors only, max 50 groups)...');
-        try {
-            const result = await extractLogsMetadata({
-                ...awsCfg,
-                logGroupPrefixes: config.cloudwatchLogs.logGroupPrefixes,
-                windowHours: config.cloudwatchLogs.windowHours,
-            });
-            servicesMeta.logs = result;
-            const errorGroups = result.filter((lg) => lg.errorCount > 0).length;
-            s.succeed(chalk.green('CloudWatch Logs') +
-                chalk.dim(`  ${result.length} group(s), ${errorGroups} with errors`));
-        }
-        catch (err) {
-            s.warn(chalk.yellow('CloudWatch Logs skipped') +
-                chalk.dim(`  ${err instanceof Error ? err.message : String(err)}`));
-        }
-    }
+    const dynamoMeta = (await extract(config.dynamodb?.enabled === true, 'Extracting DynamoDB tables...', 'DynamoDB', () => extractDynamoMetadata(config), (r) => `${r.length} table(s)`)) ?? [];
+    const pgConn = config.postgres?.enabled ? config.postgres.connectionString : undefined;
+    const postgresMeta = (await extract(!!pgConn, 'Extracting PostgreSQL schema...', 'PostgreSQL', () => extractPostgresMetadata(pgConn ?? ''), (r) => `${r.length} table(s)`)) ?? [];
+    const mysqlConn = config.mysql?.enabled ? config.mysql.connectionString : undefined;
+    const mysqlMeta = (await extract(!!mysqlConn, 'Extracting MySQL schema...', 'MySQL', () => extractMySQLMetadata(mysqlConn ?? ''), (r) => `${r.length} table(s)`)) ?? [];
+    const mongoConn = config.mongodb?.enabled ? config.mongodb.connectionString : undefined;
+    const mongoMeta = (await extract(!!mongoConn, 'Extracting MongoDB schema...', 'MongoDB', () => extractMongoMetadata(mongoConn ?? '', config.mongodb?.databases), (r) => `${r.length} collection(s)`)) ?? [];
+    servicesMeta.sqs = await extract(config.sqs?.enabled === true, 'Extracting SQS queues...', 'SQS', () => extractSQSMetadata(awsCfg), (r) => `${r.length} queue(s)`);
+    servicesMeta.sns = await extract(config.sns?.enabled === true, 'Extracting SNS topics...', 'SNS', () => extractSNSMetadata(awsCfg), (r) => `${r.length} topic(s)`);
+    servicesMeta.ssm = await extract(config.ssm?.enabled === true, 'Extracting SSM parameters...', 'SSM', () => extractSSMMetadata({ ...awsCfg, paths: config.ssm?.paths }), (r) => `${r.length} parameter(s)  (metadata only, no values)`);
+    servicesMeta.secrets = await extract(config.secretsManager?.enabled === true, 'Extracting Secrets Manager metadata...', 'Secrets Manager', () => extractSecretsMetadata(awsCfg), (r) => `${r.length} secret(s)  (names/rotation only, no values)`);
+    servicesMeta.lambda = await extract(config.lambda?.enabled === true, 'Extracting Lambda functions...', 'Lambda', () => extractLambdaMetadata(awsCfg, config.lambda?.includeFunctions), (r) => `${r.length} function(s)`);
+    servicesMeta.eventbridge = await extract(config.eventbridge?.enabled === true, 'Extracting EventBridge rules...', 'EventBridge', () => extractEventBridgeMetadata(awsCfg), (r) => `${r.length} rule(s)`);
+    servicesMeta.rds = await extract(config.rds?.enabled === true, 'Extracting RDS instances...', 'RDS', () => extractRDSMetadata(awsCfg), (r) => `${r.length} instance(s)`);
+    servicesMeta.s3 = await extract(config.s3?.enabled === true, 'Extracting S3 buckets...', 'S3', () => extractS3Metadata(awsCfg), (r) => `${r.length} bucket(s)`);
+    servicesMeta.apiGateway = await extract(config.apiGateway?.enabled === true, 'Extracting API Gateway routes...', 'API Gateway', () => extractAPIGatewayMetadata(awsCfg), (r) => `${r.length} API(s), ${r.reduce((sum, api) => sum + api.routes.length, 0)} route(s)`);
+    const cwLogs = config.cloudwatchLogs;
+    servicesMeta.logs = await extract(cwLogs?.enabled, 'Sampling CloudWatch Logs (errors only, max 50 groups)...', 'CloudWatch Logs', () => extractLogsMetadata({
+        ...awsCfg,
+        logGroupPrefixes: cwLogs?.logGroupPrefixes,
+        windowHours: cwLogs?.windowHours,
+    }), (r) => `${r.length} group(s), ${r.filter((lg) => lg.errorCount > 0).length} with errors`);
     // ── IaC schema (Terraform / CloudFormation / CDK) ────────────────────────────
     let iacDriftAnalyzer;
     let iacLambdas = [];
@@ -316,63 +217,7 @@ export async function runAnalyze(options = {}) {
     let findings;
     {
         const s = mkSpinner('Running analyzers...');
-        const hotPartitionThreshold = config.analysis?.hotPartitionThreshold;
-        const hotPartitionThresholds = config.analysis?.hotPartitionThresholds;
-        const pipelineAnalyzer = new PipelineAnalyzer();
-        pipelineAnalyzer.setIaCLambdas(iacLambdas);
-        const analyzers = [
-            ...(config.dynamodb?.enabled === true
-                ? [
-                    new FullTableScanAnalyzer(),
-                    new MissingGSIAnalyzer(),
-                    new HotPartitionAnalyzer(hotPartitionThreshold, hotPartitionThresholds),
-                ]
-                : []),
-            ...(config.postgres?.enabled
-                ? [new MissingIndexAnalyzer(), new NplusOneAnalyzer(), new LargeSelectAnalyzer()]
-                : []),
-            ...(config.mysql?.enabled
-                ? [new MissingMySQLIndexAnalyzer(), new MySQLFullTableScanAnalyzer()]
-                : []),
-            ...(config.mongodb?.enabled
-                ? [new MissingMongoIndexAnalyzer(), new MongoCollectionScanAnalyzer()]
-                : []),
-            ...(config.sqs?.enabled === true
-                ? [
-                    new MissingDLQAnalyzer(),
-                    new UnencryptedQueueAnalyzer(),
-                    new LargeQueueBacklogAnalyzer(),
-                    new VisibilityTimeoutMismatchAnalyzer(),
-                ]
-                : []),
-            ...(config.secretsManager?.enabled === true ? [new MissingSecretRotationAnalyzer()] : []),
-            ...(config.cloudwatchLogs?.enabled ? [new MissingLogRetentionAnalyzer()] : []),
-            ...(config.lambda?.enabled === true
-                ? [
-                    new LambdaDefaultMemoryAnalyzer(),
-                    new LambdaHighTimeoutAnalyzer(),
-                    new LambdaMissingTriggerDLQAnalyzer(),
-                ]
-                : []),
-            ...(config.rds?.enabled === true
-                ? [
-                    new RDSPubliclyAccessibleAnalyzer(),
-                    new RDSNoBackupAnalyzer(),
-                    new RDSUnencryptedAnalyzer(),
-                    new RDSNoDeletionProtectionAnalyzer(),
-                    new RDSNoMultiAZAnalyzer(),
-                ]
-                : []),
-            ...(config.s3?.enabled === true
-                ? [
-                    new S3PublicAccessAnalyzer(),
-                    new S3MissingVersioningAnalyzer(),
-                    new S3UnencryptedAnalyzer(),
-                ]
-                : []),
-            ...(iacDriftAnalyzer ? [iacDriftAnalyzer] : []),
-            pipelineAnalyzer,
-        ];
+        const analyzers = buildAnalyzers(config, iacDriftAnalyzer, iacLambdas);
         findings = await runAllAnalyzers(graph, analyzers);
         s.succeed(chalk.green('Analysis complete') + chalk.dim(`  ${findings.length} finding(s)`));
     }
@@ -450,63 +295,7 @@ export async function runCodeRefresh(repoPath, config) {
         operations = [];
     }
     const graph = buildGraph(operations, dynamoMeta, postgresMeta, mysqlMeta, mongoMeta, servicesMeta);
-    const hotPartitionThreshold = config.analysis?.hotPartitionThreshold;
-    const hotPartitionThresholds = config.analysis?.hotPartitionThresholds;
-    const pipelineAnalyzer = new PipelineAnalyzer();
-    pipelineAnalyzer.setIaCLambdas(iacLambdas);
-    const analyzers = [
-        ...(config.dynamodb?.enabled === true
-            ? [
-                new FullTableScanAnalyzer(),
-                new MissingGSIAnalyzer(),
-                new HotPartitionAnalyzer(hotPartitionThreshold, hotPartitionThresholds),
-            ]
-            : []),
-        ...(config.postgres?.enabled
-            ? [new MissingIndexAnalyzer(), new NplusOneAnalyzer(), new LargeSelectAnalyzer()]
-            : []),
-        ...(config.mysql?.enabled
-            ? [new MissingMySQLIndexAnalyzer(), new MySQLFullTableScanAnalyzer()]
-            : []),
-        ...(config.mongodb?.enabled
-            ? [new MissingMongoIndexAnalyzer(), new MongoCollectionScanAnalyzer()]
-            : []),
-        ...(config.sqs?.enabled === true
-            ? [
-                new MissingDLQAnalyzer(),
-                new UnencryptedQueueAnalyzer(),
-                new LargeQueueBacklogAnalyzer(),
-                new VisibilityTimeoutMismatchAnalyzer(),
-            ]
-            : []),
-        ...(config.secretsManager?.enabled === true ? [new MissingSecretRotationAnalyzer()] : []),
-        ...(config.cloudwatchLogs?.enabled ? [new MissingLogRetentionAnalyzer()] : []),
-        ...(config.lambda?.enabled === true
-            ? [
-                new LambdaDefaultMemoryAnalyzer(),
-                new LambdaHighTimeoutAnalyzer(),
-                new LambdaMissingTriggerDLQAnalyzer(),
-            ]
-            : []),
-        ...(config.rds?.enabled === true
-            ? [
-                new RDSPubliclyAccessibleAnalyzer(),
-                new RDSNoBackupAnalyzer(),
-                new RDSUnencryptedAnalyzer(),
-                new RDSNoDeletionProtectionAnalyzer(),
-                new RDSNoMultiAZAnalyzer(),
-            ]
-            : []),
-        ...(config.s3?.enabled === true
-            ? [
-                new S3PublicAccessAnalyzer(),
-                new S3MissingVersioningAnalyzer(),
-                new S3UnencryptedAnalyzer(),
-            ]
-            : []),
-        ...(iacDriftAnalyzer ? [iacDriftAnalyzer] : []),
-        pipelineAnalyzer,
-    ];
+    const analyzers = buildAnalyzers(config, iacDriftAnalyzer, iacLambdas);
     const findings = await runAllAnalyzers(graph, analyzers);
     writeCache('graph', graph);
     writeCache('findings', findings);

package/dist/cli/commands/serve.js

@@ -1,9 +1,192 @@
-import { runDev } from './dev.js';
+import * as fs from 'fs';
+import * as path from 'path';
+import chalk from 'chalk';
+import ora from 'ora';
+import { loadConfig, readCache, setCacheDir } from '../../core/index.js';
+import { createServer, setGraphState, setConfigured } from '../../server/index.js';
+import { log, printHeader } from '../utils.js';
+import { runAnalyze, runCodeRefresh } from './analyze.js';
 import { runStdio } from './stdio.js';
+const BOX_W = 52;
+const TOOL_MAP = [
+    { name: 'get_infra_overview' },
+    { name: 'get_graph_summary' },
+    { name: 'analyze_function' },
+    { name: 'suggest_gsi', service: 'dynamodb' },
+    { name: 'postgres_index_suggestions', service: 'postgres' },
+    { name: 'suggest_mongo_index', service: 'mongodb' },
+    { name: 'mysql_index_suggestions', service: 'mysql' },
+    { name: 'get_queue_details', service: 'sqs' },
+    { name: 'get_topic_details', service: 'sns' },
+    { name: 'get_secrets_overview', service: 'secretsManager' },
+    { name: 'get_parameter_overview', service: 'ssm' },
+    { name: 'get_lambda_overview', service: 'lambda' },
+    { name: 'get_eventbridge_details', service: 'eventbridge' },
+    { name: 'get_s3_overview', service: 's3' },
+    { name: 'get_api_routes', service: 'apiGateway' },
+    { name: 'get_log_errors', service: 'cloudwatchLogs' },
+];
+// With no config every registered tool is shown as active (the server exposes
+// all of them); a config narrows the list to its enabled services.
+function isEnabled(cfg, service) {
+    if (!service || !cfg)
+        return true;
+    const svc = cfg[service];
+    return svc?.enabled === true;
+}
+function boxLine(visibleContent, coloredContent) {
+    const padding = ' '.repeat(Math.max(0, BOX_W - visibleContent.length));
+    console.log(chalk.dim('  │') + coloredContent + padding + chalk.dim('│'));
+}
+function boxDivider() {
+    console.log(chalk.dim('  ├────────────────────────────────────────────────────┤'));
+}
+function groupTools(tools) {
+    const lines = [];
+    let i = 0;
+    while (i < tools.length) {
+        const a = tools[i];
+        const b = tools[i + 1];
+        if (b && `  ${a} · ${b}`.length <= BOX_W) {
+            lines.push(`${a} · ${b}`);
+            i += 2;
+        }
+        else {
+            lines.push(a);
+            i++;
+        }
+    }
+    return lines;
+}
 export async function runServe(options = {}) {
     if (options.stdio) {
         await runStdio(options.config);
         return;
     }
-    await runDev({ config: options.config, port: options.port });
+    const port = options.port ?? (process.env.PORT ? parseInt(process.env.PORT, 10) : 3000);
+    printHeader('MCP Server');
+    setCacheDir(path.dirname(path.resolve(options.config ?? 'infrawise.yaml')));
+    // A hosted MCP runtime may launch the server with no infrawise.yaml. Start
+    // anyway with an empty graph so the host can connect and list tools.
+    let config;
+    try {
+        config = loadConfig(options.config);
+        log.success('Config loaded', options.config ?? 'infrawise.yaml');
+    }
+    catch (err) {
+        log.warn(`Starting with empty graph (no config loaded): ${err instanceof Error ? err.message : String(err)}`);
+    }
+    setConfigured(config !== undefined);
+    const repoPath = process.cwd();
+    // Auto-analyze if no cache
+    const cachedGraph = readCache('graph');
+    const cachedFindings = readCache('findings');
+    if (cachedGraph && cachedFindings) {
+        log.success('Cached analysis loaded', `${cachedGraph.nodes.length} nodes · ${cachedGraph.edges.length} edges · ${cachedFindings.length} finding(s)`);
+        setGraphState(cachedGraph, cachedFindings);
+    }
+    else if (config) {
+        log.warn('No cache found — running analysis now...');
+        console.log('');
+        await runAnalyze({ repo: repoPath, config: options.config });
+        const freshGraph = readCache('graph') ?? { nodes: [], edges: [] };
+        const freshFindings = readCache('findings') ?? [];
+        setGraphState(freshGraph, freshFindings);
+    }
+    else {
+        setGraphState({ nodes: [], edges: [] }, []);
+    }
+    console.log('');
+    // Start server
+    const spin = ora({ text: chalk.dim('Starting server...'), color: 'cyan' }).start();
+    const { start } = createServer(port);
+    await start();
+    spin.succeed(chalk.green('Server running'));
+    // Compute active/inactive tools from config
+    const activeTools = TOOL_MAP.filter((t) => isEnabled(config, t.service)).map((t) => t.name);
+    const inactiveTools = TOOL_MAP.filter((t) => !isEnabled(config, t.service)).map((t) => t.name);
+    // URL rows
+    const mcpUrl = `http://localhost:${port}/mcp`;
+    const healthUrl = `http://localhost:${port}/health`;
+    // Print box
+    console.log('');
+    console.log(chalk.dim('  ┌────────────────────────────────────────────────────┐'));
+    boxLine('  MCP Server', chalk.bold('  MCP Server'));
+    boxDivider();
+    boxLine(`  POST ${mcpUrl}`, `  ${chalk.dim('POST')} ${chalk.cyan(mcpUrl)}`);
+    boxLine(`  GET  ${healthUrl}`, `  ${chalk.dim('GET')}  ${chalk.cyan(healthUrl)}`);
+    boxDivider();
+    const activeLabel = `  Tools (${activeTools.length} active${inactiveTools.length > 0 ? ` · ${inactiveTools.length} off` : ''})`;
+    boxLine(activeLabel, chalk.dim(activeLabel));
+    for (const line of groupTools(activeTools)) {
+        boxLine(`  ${line}`, `  ${line}`);
+    }
+    if (inactiveTools.length > 0) {
+        boxDivider();
+        boxLine('  Off (enable in infrawise.yaml):', chalk.dim('  Off (enable in infrawise.yaml):'));
+        for (const line of groupTools(inactiveTools)) {
+            boxLine(`  ${line}`, chalk.dim(`  ${line}`));
+        }
+    }
+    console.log(chalk.dim('  └────────────────────────────────────────────────────┘'));
+    console.log('');
+    console.log(chalk.dim('  Add via CLI:'));
+    console.log(chalk.dim(`  claude mcp add --transport http infrawise ${mcpUrl}`));
+    console.log('');
+    console.log(chalk.dim('  Watching for file changes... Press Ctrl+C to stop\n'));
+    // File watch — re-run code analysis on save (needs a config to drive analyzers)
+    if (config) {
+        const cfg = config;
+        let debounceTimer = null;
+        let refreshing = false;
+        const configFile = path.resolve(options.config ?? 'infrawise.yaml');
+        try {
+            fs.watch(repoPath, { recursive: true }, (_, filename) => {
+                if (!filename)
+                    return;
+                const abs = path.join(repoPath, filename);
+                if (abs === configFile) {
+                    console.log(chalk.dim('\n  infrawise.yaml changed — restart to apply config changes\n'));
+                    return;
+                }
+                const ext = path.extname(filename);
+                if (!['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs'].includes(ext))
+                    return;
+                if (filename.includes('node_modules') || filename.startsWith('.infrawise'))
+                    return;
+                if (debounceTimer)
+                    clearTimeout(debounceTimer);
+                debounceTimer = setTimeout(async () => {
+                    if (refreshing)
+                        return;
+                    refreshing = true;
+                    const spin = ora({
+                        text: chalk.dim('Refreshing code analysis...'),
+                        color: 'cyan',
+                    }).start();
+                    try {
+                        const { graph, findings } = await runCodeRefresh(repoPath, cfg);
+                        setGraphState(graph, findings);
+                        spin.succeed(chalk.green('Analysis refreshed') +
+                            chalk.dim(`  ${graph.nodes.length} nodes · ${findings.length} finding(s)`));
+                    }
+                    catch (err) {
+                        spin.warn(chalk.yellow('Refresh failed') +
+                            chalk.dim(`  ${err instanceof Error ? err.message : String(err)}`));
+                    }
+                    finally {
+                        refreshing = false;
+                    }
+                }, 2000);
+            });
+        }
+        catch {
+            // fs.watch may not support recursive on all platforms — silently skip
+        }
+    }
+    process.on('SIGINT', () => {
+        console.log(chalk.dim('\n  Shutting down...\n'));
+        process.exit(0);
+    });
+    await new Promise(() => { });
 }

package/dist/cli/commands/stdio.js

@@ -1,72 +1,81 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
-import { loadConfig, formatError, readCache, setCacheDir } from '../../core/index.js';
-import { createMcpServer, setGraphState } from '../../server/index.js';
+import { loadConfig, readCache, setCacheDir } from '../../core/index.js';
+import { createMcpServer, setGraphState, setConfigured } from '../../server/index.js';
 import { runAnalyze, runCodeRefresh } from './analyze.js';
 const CACHE_TTL_MS = 24 * 60 * 60 * 1000;
 export async function runStdio(configPath) {
+    const resolvedConfigPath = configPath ?? 'infrawise.yaml';
+    setCacheDir(path.dirname(path.resolve(resolvedConfigPath)));
+    // A hosted MCP runtime (e.g. Glama) launches the server with no infrawise.yaml.
+    // Start anyway with an empty graph so the host can connect and list tools;
+    // analysis populates once a config is present.
     let config;
     try {
         config = loadConfig(configPath);
     }
     catch (err) {
-        process.stderr.write(formatError(err) + '\n');
-        process.exit(1);
+        process.stderr.write(`infrawise: starting with empty graph (no config loaded: ${err instanceof Error ? err.message : String(err)})\n`);
     }
-    const resolvedConfigPath = configPath ?? 'infrawise.yaml';
-    setCacheDir(path.dirname(path.resolve(resolvedConfigPath)));
+    setConfigured(config !== undefined);
     const cachedGraph = readCache('graph', CACHE_TTL_MS);
     const cachedFindings = readCache('findings', CACHE_TTL_MS);
     if (cachedGraph && cachedFindings) {
-        setGraphState(cachedGraph, cachedFindings, config);
+        setGraphState(cachedGraph, cachedFindings);
     }
-    else {
+    else if (config) {
         await runAnalyze({ config: configPath });
         const graph = readCache('graph', CACHE_TTL_MS) ?? { nodes: [], edges: [] };
         const findings = readCache('findings', CACHE_TTL_MS) ?? [];
-        setGraphState(graph, findings, config);
+        setGraphState(graph, findings);
     }
-    // File watching — re-run code analysis on save (no AWS calls, instant)
-    // stderr is safe in stdio transport; stdout is reserved for MCP JSON-RPC
-    const repoPath = process.cwd();
-    const configFile = path.resolve(resolvedConfigPath);
-    let debounceTimer = null;
-    let refreshing = false;
-    try {
-        fs.watch(repoPath, { recursive: true }, (_, filename) => {
-            if (!filename)
-                return;
-            const abs = path.join(repoPath, filename);
-            if (abs === configFile)
-                return;
-            const ext = path.extname(filename);
-            if (!['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs'].includes(ext))
-                return;
-            if (filename.includes('node_modules') || filename.startsWith('.infrawise'))
-                return;
-            if (debounceTimer)
-                clearTimeout(debounceTimer);
-            debounceTimer = setTimeout(async () => {
-                if (refreshing)
-                    return;
-                refreshing = true;
-                try {
-                    const { graph, findings } = await runCodeRefresh(repoPath, config);
-                    setGraphState(graph, findings, config);
-                    process.stderr.write(`infrawise: code graph refreshed (${graph.nodes.length} nodes · ${findings.length} finding(s))\n`);
-                }
-                catch {
-                    // don't break the MCP connection on watcher errors
-                }
-                finally {
-                    refreshing = false;
-                }
-            }, 2000);
-        });
+    else {
+        setGraphState({ nodes: [], edges: [] }, []);
     }
-    catch {
-        // fs.watch recursive not supported on all platforms — silently skip
+    // File watching drives runCodeRefresh, which needs a config — skip it without one.
+    // stderr is safe in stdio transport; stdout is reserved for MCP JSON-RPC.
+    if (config) {
+        const cfg = config;
+        const repoPath = process.cwd();
+        const configFile = path.resolve(resolvedConfigPath);
+        let debounceTimer = null;
+        let refreshing = false;
+        try {
+            fs.watch(repoPath, { recursive: true }, (_, filename) => {
+                if (!filename)
+                    return;
+                const abs = path.join(repoPath, filename);
+                if (abs === configFile)
+                    return;
+                const ext = path.extname(filename);
+                if (!['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs'].includes(ext))
+                    return;
+                if (filename.includes('node_modules') || filename.startsWith('.infrawise'))
+                    return;
+                if (debounceTimer)
+                    clearTimeout(debounceTimer);
+                debounceTimer = setTimeout(async () => {
+                    if (refreshing)
+                        return;
+                    refreshing = true;
+                    try {
+                        const { graph, findings } = await runCodeRefresh(repoPath, cfg);
+                        setGraphState(graph, findings);
+                        process.stderr.write(`infrawise: code graph refreshed (${graph.nodes.length} nodes · ${findings.length} finding(s))\n`);
+                    }
+                    catch {
+                        // don't break the MCP connection on watcher errors
+                    }
+                    finally {
+                        refreshing = false;
+                    }
+                }, 2000);
+            });
+        }
+        catch {
+            // fs.watch recursive not supported on all platforms — silently skip
+        }
     }
     const mcp = createMcpServer();
     const transport = new StdioServerTransport();

package/dist/core/config.js

@@ -2,6 +2,7 @@ import { z } from 'zod';
 import * as fs from 'fs';
 import * as path from 'path';
 import * as yaml from 'js-yaml';
+import { InfrawiseError } from './errors.js';
 export const InfrawiseConfigSchema = z.object({
     project: z.string().min(1, 'Project name is required'),
     aws: z
@@ -74,11 +75,9 @@ export const InfrawiseConfigSchema = z.object({
     })
         .optional(),
 });
-export class ConfigError extends Error {
-    details;
+export class ConfigError extends InfrawiseError {
     constructor(message, details) {
-        super(message);
-        this.details = details;
+        super(message, details, 'infrawise start');
         this.name = 'ConfigError';
     }
 }
@@ -183,13 +182,18 @@ export function generateDefaultConfig(projectName, options) {
         secretsManager: { enabled: options?.secretsManager?.enabled ?? true },
         lambda: { enabled: options?.lambda?.enabled ?? true },
         eventbridge: { enabled: options?.eventbridge?.enabled ?? true },
-        rds: { enabled: options?.rds?.enabled ?? true },
+        rds: { enabled: options?.rds?.enabled ?? false },
+        s3: { enabled: options?.s3?.enabled ?? false },
+        apiGateway: { enabled: options?.apiGateway?.enabled ?? false },
         cloudwatchLogs: {
             enabled: options?.cloudwatchLogs?.enabled ?? false,
             logGroupPrefixes: options?.cloudwatchLogs?.logGroupPrefixes ?? [],
             windowHours: options?.cloudwatchLogs?.windowHours ?? 24,
         },
-        analysis: { sampleSize: options?.analysis?.sampleSize ?? 100 },
+        analysis: {
+            sampleSize: options?.analysis?.sampleSize ?? 100,
+            hotPartitionThreshold: options?.analysis?.hotPartitionThreshold ?? 5,
+        },
     };
     return yaml.dump(config, { lineWidth: 120 });
 }

package/dist/core/errors.js

@@ -22,17 +22,6 @@ export class InfrawiseError extends Error {
         return lines.join('\n');
     }
 }
-export class AWSConnectionError extends InfrawiseError {
-    constructor(details) {
-        super('Unable to connect to AWS.', [
-            'Invalid or missing AWS credentials',
-            'Incorrect AWS profile specified',
-            'Network connectivity issues',
-            details ?? 'Unexpected AWS error',
-        ], 'infrawise doctor');
-        this.name = 'AWSConnectionError';
-    }
-}
 export class DynamoDBError extends InfrawiseError {
     constructor(details) {
         super('Unable to access DynamoDB.', [
@@ -66,16 +55,6 @@ export class RepositoryScanError extends InfrawiseError {
         this.name = 'RepositoryScanError';
     }
 }
-export class ConfigError extends InfrawiseError {
-    constructor(details) {
-        super('Invalid or missing configuration.', [
-            'infrawise.yaml not found in current directory',
-            'Missing required fields in configuration',
-            details ?? 'Unexpected config error',
-        ], 'infrawise start');
-        this.name = 'ConfigError';
-    }
-}
 export function formatError(err) {
     if (err instanceof InfrawiseError) {
         return err.format();

package/dist/core/index.js

@@ -1,4 +1,4 @@
-export { loadConfig, generateDefaultConfig, InfrawiseConfigSchema, ConfigError as ConfigValidationError, } from './config.js';
+export { loadConfig, generateDefaultConfig, InfrawiseConfigSchema, ConfigError } from './config.js';
 export { logger } from './logger.js';
-export { InfrawiseError, AWSConnectionError, DynamoDBError, PostgresConnectionError, RepositoryScanError, ConfigError, formatError, } from './errors.js';
+export { InfrawiseError, DynamoDBError, PostgresConnectionError, RepositoryScanError, formatError, } from './errors.js';
 export { writeCache, readCache, clearCache, setCacheDir } from './cache.js';

package/dist/server/index.js

@@ -12,10 +12,17 @@ import { getTableNodes, getFunctionNodes, getQueueNodes, getTopicNodes, getSecre
 // ── State ────────────────────────────────────────────────────────────────────
 let currentGraph = { nodes: [], edges: [] };
 let currentFindings = [];
-export function setGraphState(graph, findings, _config) {
+// False when the server booted without an infrawise.yaml (e.g. a hosted MCP
+// runtime). Used to return a "run locally" hint instead of a bare empty graph.
+let configured = true;
+export function setGraphState(graph, findings) {
     currentGraph = graph;
     currentFindings = findings;
 }
+export function setConfigured(value) {
+    configured = value;
+}
+const NOT_CONFIGURED_HINT = 'No infrastructure loaded. infrawise reads your live infra locally — run `npx infrawise start` in your project (with AWS credentials and an infrawise.yaml) so these tools return your real DynamoDB/RDS/SQS/Lambda/etc. context. A remotely hosted instance has no access to your cloud account or code, so it returns empty results by design.';
 // ── Helpers ──────────────────────────────────────────────────────────────────
 function toText(data) {
     return { content: [{ type: 'text', text: JSON.stringify(data, null, 2) }] };
@@ -31,7 +38,7 @@ function logged(name, fn) {
 export function createMcpServer() {
     const mcp = new McpServer({ name: 'infrawise', version });
     mcp.registerTool('get_infra_overview', {
-        description: 'Returns a compact infrastructure snapshot: service counts, all databases, queues, topics, secrets, lambdas, and high-severity findings. Call this first at the start of any database or infrastructure task to understand what services are in scope. Prefer this over get_graph_summary for quick orientation; use get_graph_summary only when you need every node, edge, and finding in full.',
+        description: 'Returns a compact infrastructure snapshot: service counts, all databases, queues, topics, secrets, lambdas, and high-severity findings. Call this first at the start of any database or infrastructure task to understand what services are in scope. Prefer this over get_graph_summary for quick orientation; use get_graph_summary only when you need every node, edge, and finding in full. Also returns a `configured` flag — when false, the server has no infrawise.yaml loaded (e.g. a remotely hosted instance) and all tools return empty results; a `setupHint` explains how to run infrawise locally.',
         inputSchema: z.object({}),
     }, logged('get_infra_overview', async () => {
         const tables = getTableNodes(currentGraph);
@@ -44,6 +51,8 @@ export function createMcpServer() {
         const functions = getFunctionNodes(currentGraph);
         const buckets = getBucketNodes(currentGraph);
         return toText({
+            configured,
+            ...(configured ? {} : { setupHint: NOT_CONFIGURED_HINT }),
             summary: {
                 tables: tables.length,
                 functions: functions.length,
@@ -460,6 +469,7 @@ export function createServer(port = 3000) {
             'get_lambda_overview',
             'get_eventbridge_details',
             'get_s3_overview',
+            'get_api_routes',
             'get_log_errors',
         ],
     }));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "infrawise",
-  "version": "0.12.4",
+  "version": "0.12.6",
   "mcpName": "io.github.Sidd27/infrawise",
   "description": "CLI-first infrastructure intelligence platform — analyzes DynamoDB, PostgreSQL, MySQL, MongoDB, SQS, SNS, SSM, Secrets Manager, Lambda, S3, API Gateway, CloudWatch Logs and exposes findings as an MCP server for Claude Code",
   "keywords": [

package/dist/cli/commands/dev.js

@@ -1,172 +0,0 @@
-import * as fs from 'fs';
-import * as path from 'path';
-import chalk from 'chalk';
-import ora from 'ora';
-import { loadConfig, formatError, readCache, setCacheDir } from '../../core/index.js';
-import { createServer, setGraphState } from '../../server/index.js';
-import { log, printHeader } from '../utils.js';
-import { runAnalyze, runCodeRefresh } from './analyze.js';
-const BOX_W = 52;
-const TOOL_MAP = [
-    { name: 'get_infra_overview' },
-    { name: 'get_graph_summary' },
-    { name: 'analyze_function' },
-    { name: 'suggest_gsi', service: 'dynamodb' },
-    { name: 'postgres_index_suggestions', service: 'postgres' },
-    { name: 'suggest_mongo_index', service: 'mongodb' },
-    { name: 'mysql_index_suggestions', service: 'mysql' },
-    { name: 'get_queue_details', service: 'sqs' },
-    { name: 'get_topic_details', service: 'sns' },
-    { name: 'get_secrets_overview', service: 'secretsManager' },
-    { name: 'get_parameter_overview', service: 'ssm' },
-    { name: 'get_lambda_overview', service: 'lambda' },
-    { name: 'get_eventbridge_details', service: 'eventbridge' },
-    { name: 'get_log_errors', service: 'cloudwatchLogs' },
-];
-function isEnabled(cfg, service) {
-    if (!service)
-        return true;
-    const svc = cfg[service];
-    return svc?.enabled === true;
-}
-function boxLine(visibleContent, coloredContent) {
-    const padding = ' '.repeat(Math.max(0, BOX_W - visibleContent.length));
-    console.log(chalk.dim('  │') + coloredContent + padding + chalk.dim('│'));
-}
-function boxDivider() {
-    console.log(chalk.dim('  ├────────────────────────────────────────────────────┤'));
-}
-function groupTools(tools) {
-    const lines = [];
-    let i = 0;
-    while (i < tools.length) {
-        const a = tools[i];
-        const b = tools[i + 1];
-        if (b && `  ${a} · ${b}`.length <= BOX_W) {
-            lines.push(`${a} · ${b}`);
-            i += 2;
-        }
-        else {
-            lines.push(a);
-            i++;
-        }
-    }
-    return lines;
-}
-export async function runDev(options = {}) {
-    const port = options.port ?? (process.env.PORT ? parseInt(process.env.PORT, 10) : 3000);
-    printHeader('MCP Server');
-    let config;
-    try {
-        config = loadConfig(options.config);
-        setCacheDir(path.dirname(path.resolve(options.config ?? 'infrawise.yaml')));
-        log.success('Config loaded', options.config ?? 'infrawise.yaml');
-    }
-    catch (err) {
-        console.error(formatError(err));
-        process.exit(1);
-    }
-    const repoPath = process.cwd();
-    // Auto-analyze if no cache
-    const cachedGraph = readCache('graph');
-    const cachedFindings = readCache('findings');
-    if (cachedGraph && cachedFindings) {
-        log.success('Cached analysis loaded', `${cachedGraph.nodes.length} nodes · ${cachedGraph.edges.length} edges · ${cachedFindings.length} finding(s)`);
-        setGraphState(cachedGraph, cachedFindings, config);
-    }
-    else {
-        log.warn('No cache found — running analysis now...');
-        console.log('');
-        await runAnalyze({ repo: repoPath, config: options.config });
-        const freshGraph = readCache('graph') ?? { nodes: [], edges: [] };
-        const freshFindings = readCache('findings') ?? [];
-        setGraphState(freshGraph, freshFindings, config);
-    }
-    console.log('');
-    // Start server
-    const spin = ora({ text: chalk.dim('Starting server...'), color: 'cyan' }).start();
-    const { start } = createServer(port);
-    await start();
-    spin.succeed(chalk.green('Server running'));
-    // Compute active/inactive tools from config
-    const activeTools = TOOL_MAP.filter((t) => isEnabled(config, t.service)).map((t) => t.name);
-    const inactiveTools = TOOL_MAP.filter((t) => !isEnabled(config, t.service)).map((t) => t.name);
-    // URL rows
-    const mcpUrl = `http://localhost:${port}/mcp`;
-    const healthUrl = `http://localhost:${port}/health`;
-    // Print box
-    console.log('');
-    console.log(chalk.dim('  ┌────────────────────────────────────────────────────┐'));
-    boxLine('  MCP Server', chalk.bold('  MCP Server'));
-    boxDivider();
-    boxLine(`  POST ${mcpUrl}`, `  ${chalk.dim('POST')} ${chalk.cyan(mcpUrl)}`);
-    boxLine(`  GET  ${healthUrl}`, `  ${chalk.dim('GET')}  ${chalk.cyan(healthUrl)}`);
-    boxDivider();
-    const activeLabel = `  Tools (${activeTools.length} active${inactiveTools.length > 0 ? ` · ${inactiveTools.length} off` : ''})`;
-    boxLine(activeLabel, chalk.dim(activeLabel));
-    for (const line of groupTools(activeTools)) {
-        boxLine(`  ${line}`, `  ${line}`);
-    }
-    if (inactiveTools.length > 0) {
-        boxDivider();
-        boxLine('  Off (enable in infrawise.yaml):', chalk.dim('  Off (enable in infrawise.yaml):'));
-        for (const line of groupTools(inactiveTools)) {
-            boxLine(`  ${line}`, chalk.dim(`  ${line}`));
-        }
-    }
-    console.log(chalk.dim('  └────────────────────────────────────────────────────┘'));
-    console.log('');
-    console.log(chalk.dim('  Add via CLI:'));
-    console.log(chalk.dim(`  claude mcp add --transport http infrawise ${mcpUrl}`));
-    console.log('');
-    console.log(chalk.dim('  Watching for file changes... Press Ctrl+C to stop\n'));
-    // File watch — re-run code analysis on save, skip slow AWS/DB extraction
-    let debounceTimer = null;
-    let refreshing = false;
-    const configFile = path.resolve(options.config ?? 'infrawise.yaml');
-    try {
-        fs.watch(repoPath, { recursive: true }, (_, filename) => {
-            if (!filename)
-                return;
-            const abs = path.join(repoPath, filename);
-            if (abs === configFile) {
-                console.log(chalk.dim('\n  infrawise.yaml changed — restart to apply config changes\n'));
-                return;
-            }
-            const ext = path.extname(filename);
-            if (!['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs'].includes(ext))
-                return;
-            if (filename.includes('node_modules') || filename.startsWith('.infrawise'))
-                return;
-            if (debounceTimer)
-                clearTimeout(debounceTimer);
-            debounceTimer = setTimeout(async () => {
-                if (refreshing)
-                    return;
-                refreshing = true;
-                const spin = ora({ text: chalk.dim('Refreshing code analysis...'), color: 'cyan' }).start();
-                try {
-                    const { graph, findings } = await runCodeRefresh(repoPath, config);
-                    setGraphState(graph, findings, config);
-                    spin.succeed(chalk.green('Analysis refreshed') +
-                        chalk.dim(`  ${graph.nodes.length} nodes · ${findings.length} finding(s)`));
-                }
-                catch (err) {
-                    spin.warn(chalk.yellow('Refresh failed') +
-                        chalk.dim(`  ${err instanceof Error ? err.message : String(err)}`));
-                }
-                finally {
-                    refreshing = false;
-                }
-            }, 2000);
-        });
-    }
-    catch {
-        // fs.watch may not support recursive on all platforms — silently skip
-    }
-    process.on('SIGINT', () => {
-        console.log(chalk.dim('\n  Shutting down...\n'));
-        process.exit(0);
-    });
-    await new Promise(() => { });
-}