infrawise 0.12.5 → 0.13.0

package/README.md

@@ -149,9 +149,9 @@ Add to your editor's MCP config:
 
 | Tool                         | What it provides                                                                                            |
 | ---------------------------- | ----------------------------------------------------------------------------------------------------------- |
-| `get_infra_overview`         | Complete snapshot — all services, counts, and high-severity findings                                        |
+| `get_infra_overview`         | Complete snapshot — all services, counts, high-severity findings, and a `configured` flag                   |
 | `get_graph_summary`          | Full infrastructure graph — all nodes, edges, and findings                                                  |
-| `analyze_function`           | Issues in a specific function — scans, missing indexes, N+1, trigger event shapes                           |
+| `analyze_function`           | Issues in a specific function — scans, missing indexes, N+1, trigger event shapes, missing IAM permissions  |
 | `suggest_gsi`                | Exact GSI config for a DynamoDB table + attribute                                                           |
 | `postgres_index_suggestions` | Exact `CREATE INDEX` SQL for your actual table                                                              |
 | `suggest_mongo_index`        | Exact `createIndex` command for a MongoDB collection + field                                                |
@@ -161,7 +161,7 @@ Add to your editor's MCP config:
 | `get_topic_details`          | SNS topics — subscription counts, protocols, and filter policies (required message attributes per subscription) |
 | `get_secrets_overview`       | Secrets Manager — names and rotation status (values never included)                                         |
 | `get_parameter_overview`     | SSM Parameter Store — names, types, tiers (values never included)                                           |
-| `get_lambda_overview`        | Lambda functions — runtime, memory, timeout, triggers (SQS/SNS/DynamoDB/Kinesis/MSK/EventBridge/S3), env var key names |
+| `get_lambda_overview`        | Lambda functions — runtime, memory, timeout, execution role ARN, triggers (SQS/SNS/DynamoDB/Kinesis/MSK/EventBridge/S3), env var key names |
 | `get_eventbridge_details`    | EventBridge rules — name, state, schedule/event pattern, target functions                                   |
 | `get_s3_overview`            | S3 buckets — versioning, encryption, public access, event notifications                                     |
 | `get_log_errors`             | CloudWatch error patterns and counts (no raw log messages)                                                  |

package/dist/adapters/aws/services.js

@@ -7,6 +7,7 @@ import { SecretsManagerClient, ListSecretsCommand } from '@aws-sdk/client-secret
 import { LambdaClient, ListFunctionsCommand, ListEventSourceMappingsCommand, } from '@aws-sdk/client-lambda';
 import { EventBridgeClient, ListRulesCommand, ListTargetsByRuleCommand, } from '@aws-sdk/client-eventbridge';
 import { RDSClient, DescribeDBInstancesCommand } from '@aws-sdk/client-rds';
+import { IAMClient, ListAttachedRolePoliciesCommand, GetPolicyCommand, GetPolicyVersionCommand, ListRolePoliciesCommand, GetRolePolicyCommand, } from '@aws-sdk/client-iam';
 import { fromIni } from '@aws-sdk/credential-providers';
 import { logger } from '../../core/index.js';
 function clientConfig(cfg) {
@@ -209,6 +210,77 @@ export async function extractSecretsMetadata(cfg = {}) {
 export async function validateSecretsAccess(cfg = {}) {
     await new SecretsManagerClient(clientConfig(cfg)).send(new ListSecretsCommand({ MaxResults: 1 }));
 }
+function servicesFromDoc(doc) {
+    const out = new Set();
+    for (const stmt of doc.Statement ?? []) {
+        if (stmt.Effect !== 'Allow')
+            continue;
+        const actions = Array.isArray(stmt.Action) ? stmt.Action : stmt.Action ? [stmt.Action] : [];
+        for (const a of actions) {
+            if (a === '*') {
+                out.add('*');
+                continue;
+            }
+            const prefix = a.split(':')[0].toLowerCase();
+            if (prefix)
+                out.add(prefix);
+        }
+    }
+    return [...out];
+}
+async function extractAllowedServices(roleArn, cfg) {
+    const client = new IAMClient(clientConfig(cfg));
+    const roleName = roleArn.split('/').pop();
+    const services = new Set();
+    try {
+        let marker;
+        do {
+            const res = await client.send(new ListAttachedRolePoliciesCommand({ RoleName: roleName, Marker: marker }));
+            for (const policy of res.AttachedPolicies ?? []) {
+                try {
+                    const meta = await client.send(new GetPolicyCommand({ PolicyArn: policy.PolicyArn }));
+                    const versionId = meta.Policy?.DefaultVersionId;
+                    if (!versionId)
+                        continue;
+                    const ver = await client.send(new GetPolicyVersionCommand({ PolicyArn: policy.PolicyArn, VersionId: versionId }));
+                    const doc = ver.PolicyVersion?.Document;
+                    if (doc) {
+                        const parsed = JSON.parse(decodeURIComponent(doc));
+                        for (const s of servicesFromDoc(parsed))
+                            services.add(s);
+                    }
+                }
+                catch {
+                    /* skip unparseable policy */
+                }
+            }
+            marker = res.Marker;
+        } while (marker);
+        let iMarker;
+        do {
+            const res = await client.send(new ListRolePoliciesCommand({ RoleName: roleName, Marker: iMarker }));
+            for (const name of res.PolicyNames ?? []) {
+                try {
+                    const inline = await client.send(new GetRolePolicyCommand({ RoleName: roleName, PolicyName: name }));
+                    if (inline.PolicyDocument) {
+                        const parsed = JSON.parse(decodeURIComponent(inline.PolicyDocument));
+                        for (const s of servicesFromDoc(parsed))
+                            services.add(s);
+                    }
+                }
+                catch {
+                    /* skip */
+                }
+            }
+            iMarker = res.Marker;
+        } while (iMarker);
+        return [...services];
+    }
+    catch (err) {
+        logger.debug(`IAM fetch skipped for ${roleName}: ${err instanceof Error ? err.message : String(err)}`);
+        return undefined;
+    }
+}
 // ─── Lambda ───────────────────────────────────────────────────────────────────
 const EVENT_SHAPES = {
     sqs: 'event.Records[0].body',
@@ -319,6 +391,7 @@ export async function extractLambdaMetadata(cfg = {}, includeFunctions) {
                     envVarKeys: Object.keys(fn.Environment?.Variables ?? {}),
                     layers: (fn.Layers ?? []).map((l) => l.Arn ?? '').filter(Boolean),
                     triggers: [],
+                    roleArn: fn.Role,
                 });
             }
             marker = res.NextMarker;
@@ -328,6 +401,16 @@ export async function extractLambdaMetadata(cfg = {}, includeFunctions) {
         for (const fn of functions) {
             fn.triggers = triggerMap.get(fn.arn) ?? [];
         }
+        // Batch IAM policy fetch per unique role ARN
+        const uniqueRoles = [...new Set(functions.map((f) => f.roleArn).filter(Boolean))];
+        const roleServices = new Map();
+        await Promise.all(uniqueRoles.map(async (arn) => {
+            roleServices.set(arn, await extractAllowedServices(arn, cfg));
+        }));
+        for (const fn of functions) {
+            if (fn.roleArn)
+                fn.allowedServices = roleServices.get(fn.roleArn);
+        }
     }
     catch (err) {
         logger.warn(`Lambda list failed: ${err instanceof Error ? err.message : String(err)}`);

package/dist/analyzers/aws-services.js

@@ -284,3 +284,67 @@ export class S3UnencryptedAnalyzer {
         return findings;
     }
 }
+// ─── IAM ─────────────────────────────────────────────────────────────────────
+const MINIMAL_ACTIONS = {
+    dynamodb: 'dynamodb:GetItem, dynamodb:PutItem, dynamodb:Query, dynamodb:UpdateItem, dynamodb:DeleteItem',
+    secretsmanager: 'secretsmanager:GetSecretValue',
+    ssm: 'ssm:GetParameter, ssm:GetParameters, ssm:GetParametersByPath',
+    sqs: 'sqs:SendMessage, sqs:ReceiveMessage, sqs:DeleteMessage, sqs:GetQueueAttributes',
+    sns: 'sns:Publish',
+    s3: 's3:GetObject, s3:PutObject, s3:DeleteObject',
+};
+export class LambdaMissingIAMPermissionsAnalyzer {
+    name = 'LambdaMissingIAMPermissionsAnalyzer';
+    async analyze(graph) {
+        const findings = [];
+        const nodeMap = new Map(graph.nodes.map((n) => [n.id, n]));
+        for (const lambda of graph.nodes) {
+            if (lambda.type !== 'lambda')
+                continue;
+            if (!lambda.allowedServices)
+                continue; // IAM data unavailable — skip
+            if (lambda.allowedServices.includes('*'))
+                continue; // AdministratorAccess
+            const funcNode = graph.nodes.find((n) => n.type === 'function' && n.name === lambda.name);
+            if (!funcNode)
+                continue;
+            const needed = new Set();
+            for (const edge of graph.edges) {
+                if (edge.from !== funcNode.id)
+                    continue;
+                const target = nodeMap.get(edge.to);
+                if (!target)
+                    continue;
+                if ((edge.type === 'query' || edge.type === 'scan') &&
+                    target.type === 'table' &&
+                    target.databaseType === 'dynamodb') {
+                    needed.add('dynamodb');
+                }
+                else if (edge.type === 'reads_secret') {
+                    needed.add('secretsmanager');
+                }
+                else if (edge.type === 'reads_parameter') {
+                    needed.add('ssm');
+                }
+                else if (edge.type === 'publishes_to' && target.type === 'queue') {
+                    needed.add('sqs');
+                }
+                else if (edge.type === 'publishes_to' && target.type === 'topic') {
+                    needed.add('sns');
+                }
+            }
+            for (const service of needed) {
+                if (lambda.allowedServices.includes(service))
+                    continue;
+                findings.push({
+                    severity: 'high',
+                    issue: `Lambda "${lambda.name}" accesses ${service} but execution role has no ${service} permissions`,
+                    description: `"${lambda.name}" calls ${service} in code but its IAM execution role (${lambda.roleArn ?? 'unknown'}) has no ${service}:* permissions. This will cause AccessDeniedException at runtime — code passes tests but fails in AWS.`,
+                    recommendation: `Add ${service} permissions to the execution role for "${lambda.name}". Minimum required: ${MINIMAL_ACTIONS[service] ?? `${service}:*`}.`,
+                    metadata: { functionName: lambda.name, missingService: service, roleArn: lambda.roleArn },
+                });
+            }
+        }
+        return findings;
+    }
+}

package/dist/analyzers/index.js

@@ -5,7 +5,7 @@ export { MissingMySQLIndexAnalyzer, MySQLFullTableScanAnalyzer } from './mysql.j
 export { MissingMongoIndexAnalyzer, MongoCollectionScanAnalyzer } from './mongodb.js';
 export { IaCDriftAnalyzer } from './terraform.js';
 export { PipelineAnalyzer } from './pipeline.js';
-export { MissingDLQAnalyzer, UnencryptedQueueAnalyzer, LargeQueueBacklogAnalyzer, VisibilityTimeoutMismatchAnalyzer, MissingSecretRotationAnalyzer, MissingLogRetentionAnalyzer, LambdaDefaultMemoryAnalyzer, LambdaHighTimeoutAnalyzer, LambdaMissingTriggerDLQAnalyzer, S3PublicAccessAnalyzer, S3MissingVersioningAnalyzer, S3UnencryptedAnalyzer, } from './aws-services.js';
+export { MissingDLQAnalyzer, UnencryptedQueueAnalyzer, LargeQueueBacklogAnalyzer, VisibilityTimeoutMismatchAnalyzer, MissingSecretRotationAnalyzer, MissingLogRetentionAnalyzer, LambdaDefaultMemoryAnalyzer, LambdaHighTimeoutAnalyzer, LambdaMissingTriggerDLQAnalyzer, LambdaMissingIAMPermissionsAnalyzer, S3PublicAccessAnalyzer, S3MissingVersioningAnalyzer, S3UnencryptedAnalyzer, } from './aws-services.js';
 export { RDSPubliclyAccessibleAnalyzer, RDSNoBackupAnalyzer, RDSUnencryptedAnalyzer, RDSNoDeletionProtectionAnalyzer, RDSNoMultiAZAnalyzer, } from './rds.js';
 export async function runAllAnalyzers(graph, analyzers) {
     const allFindings = [];

package/dist/cli/commands/analyze.js

@@ -13,7 +13,7 @@ import { extractLogsMetadata } from '../../adapters/aws/logs.js';
 import { extractS3Metadata } from '../../adapters/aws/s3.js';
 import { scanRepository } from '../../context/index.js';
 import { buildGraph } from '../../graph/index.js';
-import { runAllAnalyzers, IaCDriftAnalyzer, PipelineAnalyzer, FullTableScanAnalyzer, MissingGSIAnalyzer, HotPartitionAnalyzer, MissingIndexAnalyzer, NplusOneAnalyzer, LargeSelectAnalyzer, MissingMySQLIndexAnalyzer, MySQLFullTableScanAnalyzer, MissingMongoIndexAnalyzer, MongoCollectionScanAnalyzer, MissingDLQAnalyzer, UnencryptedQueueAnalyzer, LargeQueueBacklogAnalyzer, VisibilityTimeoutMismatchAnalyzer, MissingSecretRotationAnalyzer, MissingLogRetentionAnalyzer, LambdaDefaultMemoryAnalyzer, LambdaHighTimeoutAnalyzer, LambdaMissingTriggerDLQAnalyzer, RDSPubliclyAccessibleAnalyzer, RDSNoBackupAnalyzer, RDSUnencryptedAnalyzer, RDSNoDeletionProtectionAnalyzer, RDSNoMultiAZAnalyzer, S3PublicAccessAnalyzer, S3MissingVersioningAnalyzer, S3UnencryptedAnalyzer, } from '../../analyzers/index.js';
+import { runAllAnalyzers, IaCDriftAnalyzer, PipelineAnalyzer, FullTableScanAnalyzer, MissingGSIAnalyzer, HotPartitionAnalyzer, MissingIndexAnalyzer, NplusOneAnalyzer, LargeSelectAnalyzer, MissingMySQLIndexAnalyzer, MySQLFullTableScanAnalyzer, MissingMongoIndexAnalyzer, MongoCollectionScanAnalyzer, MissingDLQAnalyzer, UnencryptedQueueAnalyzer, LargeQueueBacklogAnalyzer, VisibilityTimeoutMismatchAnalyzer, MissingSecretRotationAnalyzer, MissingLogRetentionAnalyzer, LambdaDefaultMemoryAnalyzer, LambdaHighTimeoutAnalyzer, LambdaMissingTriggerDLQAnalyzer, LambdaMissingIAMPermissionsAnalyzer, RDSPubliclyAccessibleAnalyzer, RDSNoBackupAnalyzer, RDSUnencryptedAnalyzer, RDSNoDeletionProtectionAnalyzer, RDSNoMultiAZAnalyzer, S3PublicAccessAnalyzer, S3MissingVersioningAnalyzer, S3UnencryptedAnalyzer, } from '../../analyzers/index.js';
 import { printFinding, printSummaryBox, log, printHeader } from '../utils.js';
 const SEVERITY_ORDER = { high: 3, medium: 2, low: 1, verify: 0 };
 function buildMarkdownReport(findings, projectName) {
@@ -100,6 +100,7 @@ function buildAnalyzers(config, iacDriftAnalyzer, iacLambdas) {
                 new LambdaDefaultMemoryAnalyzer(),
                 new LambdaHighTimeoutAnalyzer(),
                 new LambdaMissingTriggerDLQAnalyzer(),
+                new LambdaMissingIAMPermissionsAnalyzer(),
             ]
             : []),
         ...(config.rds?.enabled === true

package/dist/cli/commands/serve.js

@@ -2,8 +2,8 @@ import * as fs from 'fs';
 import * as path from 'path';
 import chalk from 'chalk';
 import ora from 'ora';
-import { loadConfig, formatError, readCache, setCacheDir } from '../../core/index.js';
-import { createServer, setGraphState } from '../../server/index.js';
+import { loadConfig, readCache, setCacheDir } from '../../core/index.js';
+import { createServer, setGraphState, setConfigured } from '../../server/index.js';
 import { log, printHeader } from '../utils.js';
 import { runAnalyze, runCodeRefresh } from './analyze.js';
 import { runStdio } from './stdio.js';
@@ -26,8 +26,10 @@ const TOOL_MAP = [
     { name: 'get_api_routes', service: 'apiGateway' },
     { name: 'get_log_errors', service: 'cloudwatchLogs' },
 ];
+// With no config every registered tool is shown as active (the server exposes
+// all of them); a config narrows the list to its enabled services.
 function isEnabled(cfg, service) {
-    if (!service)
+    if (!service || !cfg)
         return true;
     const svc = cfg[service];
     return svc?.enabled === true;
@@ -63,16 +65,18 @@ export async function runServe(options = {}) {
     }
     const port = options.port ?? (process.env.PORT ? parseInt(process.env.PORT, 10) : 3000);
     printHeader('MCP Server');
+    setCacheDir(path.dirname(path.resolve(options.config ?? 'infrawise.yaml')));
+    // A hosted MCP runtime may launch the server with no infrawise.yaml. Start
+    // anyway with an empty graph so the host can connect and list tools.
     let config;
     try {
         config = loadConfig(options.config);
-        setCacheDir(path.dirname(path.resolve(options.config ?? 'infrawise.yaml')));
         log.success('Config loaded', options.config ?? 'infrawise.yaml');
     }
     catch (err) {
-        console.error(formatError(err));
-        process.exit(1);
+        log.warn(`Starting with empty graph (no config loaded): ${err instanceof Error ? err.message : String(err)}`);
     }
+    setConfigured(config !== undefined);
     const repoPath = process.cwd();
     // Auto-analyze if no cache
     const cachedGraph = readCache('graph');
@@ -81,7 +85,7 @@ export async function runServe(options = {}) {
         log.success('Cached analysis loaded', `${cachedGraph.nodes.length} nodes · ${cachedGraph.edges.length} edges · ${cachedFindings.length} finding(s)`);
         setGraphState(cachedGraph, cachedFindings);
     }
-    else {
+    else if (config) {
         log.warn('No cache found — running analysis now...');
         console.log('');
         await runAnalyze({ repo: repoPath, config: options.config });
@@ -89,6 +93,9 @@ export async function runServe(options = {}) {
         const freshFindings = readCache('findings') ?? [];
         setGraphState(freshGraph, freshFindings);
     }
+    else {
+        setGraphState({ nodes: [], edges: [] }, []);
+    }
     console.log('');
     // Start server
     const spin = ora({ text: chalk.dim('Starting server...'), color: 'cyan' }).start();
@@ -127,49 +134,55 @@ export async function runServe(options = {}) {
     console.log(chalk.dim(`  claude mcp add --transport http infrawise ${mcpUrl}`));
     console.log('');
     console.log(chalk.dim('  Watching for file changes... Press Ctrl+C to stop\n'));
-    // File watch — re-run code analysis on save, skip slow AWS/DB extraction
-    let debounceTimer = null;
-    let refreshing = false;
-    const configFile = path.resolve(options.config ?? 'infrawise.yaml');
-    try {
-        fs.watch(repoPath, { recursive: true }, (_, filename) => {
-            if (!filename)
-                return;
-            const abs = path.join(repoPath, filename);
-            if (abs === configFile) {
-                console.log(chalk.dim('\n  infrawise.yaml changed — restart to apply config changes\n'));
-                return;
-            }
-            const ext = path.extname(filename);
-            if (!['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs'].includes(ext))
-                return;
-            if (filename.includes('node_modules') || filename.startsWith('.infrawise'))
-                return;
-            if (debounceTimer)
-                clearTimeout(debounceTimer);
-            debounceTimer = setTimeout(async () => {
-                if (refreshing)
+    // File watch — re-run code analysis on save (needs a config to drive analyzers)
+    if (config) {
+        const cfg = config;
+        let debounceTimer = null;
+        let refreshing = false;
+        const configFile = path.resolve(options.config ?? 'infrawise.yaml');
+        try {
+            fs.watch(repoPath, { recursive: true }, (_, filename) => {
+                if (!filename)
+                    return;
+                const abs = path.join(repoPath, filename);
+                if (abs === configFile) {
+                    console.log(chalk.dim('\n  infrawise.yaml changed — restart to apply config changes\n'));
                     return;
-                refreshing = true;
-                const spin = ora({ text: chalk.dim('Refreshing code analysis...'), color: 'cyan' }).start();
-                try {
-                    const { graph, findings } = await runCodeRefresh(repoPath, config);
-                    setGraphState(graph, findings);
-                    spin.succeed(chalk.green('Analysis refreshed') +
-                        chalk.dim(`  ${graph.nodes.length} nodes · ${findings.length} finding(s)`));
-                }
-                catch (err) {
-                    spin.warn(chalk.yellow('Refresh failed') +
-                        chalk.dim(`  ${err instanceof Error ? err.message : String(err)}`));
-                }
-                finally {
-                    refreshing = false;
                 }
-            }, 2000);
-        });
-    }
-    catch {
-        // fs.watch may not support recursive on all platforms — silently skip
+                const ext = path.extname(filename);
+                if (!['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs'].includes(ext))
+                    return;
+                if (filename.includes('node_modules') || filename.startsWith('.infrawise'))
+                    return;
+                if (debounceTimer)
+                    clearTimeout(debounceTimer);
+                debounceTimer = setTimeout(async () => {
+                    if (refreshing)
+                        return;
+                    refreshing = true;
+                    const spin = ora({
+                        text: chalk.dim('Refreshing code analysis...'),
+                        color: 'cyan',
+                    }).start();
+                    try {
+                        const { graph, findings } = await runCodeRefresh(repoPath, cfg);
+                        setGraphState(graph, findings);
+                        spin.succeed(chalk.green('Analysis refreshed') +
+                            chalk.dim(`  ${graph.nodes.length} nodes · ${findings.length} finding(s)`));
+                    }
+                    catch (err) {
+                        spin.warn(chalk.yellow('Refresh failed') +
+                            chalk.dim(`  ${err instanceof Error ? err.message : String(err)}`));
+                    }
+                    finally {
+                        refreshing = false;
+                    }
+                }, 2000);
+            });
+        }
+        catch {
+            // fs.watch may not support recursive on all platforms — silently skip
+        }
     }
     process.on('SIGINT', () => {
         console.log(chalk.dim('\n  Shutting down...\n'));

package/dist/cli/commands/stdio.js

@@ -1,72 +1,81 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
-import { loadConfig, formatError, readCache, setCacheDir } from '../../core/index.js';
-import { createMcpServer, setGraphState } from '../../server/index.js';
+import { loadConfig, readCache, setCacheDir } from '../../core/index.js';
+import { createMcpServer, setGraphState, setConfigured } from '../../server/index.js';
 import { runAnalyze, runCodeRefresh } from './analyze.js';
 const CACHE_TTL_MS = 24 * 60 * 60 * 1000;
 export async function runStdio(configPath) {
+    const resolvedConfigPath = configPath ?? 'infrawise.yaml';
+    setCacheDir(path.dirname(path.resolve(resolvedConfigPath)));
+    // A hosted MCP runtime (e.g. Glama) launches the server with no infrawise.yaml.
+    // Start anyway with an empty graph so the host can connect and list tools;
+    // analysis populates once a config is present.
     let config;
     try {
         config = loadConfig(configPath);
     }
     catch (err) {
-        process.stderr.write(formatError(err) + '\n');
-        process.exit(1);
+        process.stderr.write(`infrawise: starting with empty graph (no config loaded: ${err instanceof Error ? err.message : String(err)})\n`);
     }
-    const resolvedConfigPath = configPath ?? 'infrawise.yaml';
-    setCacheDir(path.dirname(path.resolve(resolvedConfigPath)));
+    setConfigured(config !== undefined);
     const cachedGraph = readCache('graph', CACHE_TTL_MS);
     const cachedFindings = readCache('findings', CACHE_TTL_MS);
     if (cachedGraph && cachedFindings) {
         setGraphState(cachedGraph, cachedFindings);
     }
-    else {
+    else if (config) {
         await runAnalyze({ config: configPath });
         const graph = readCache('graph', CACHE_TTL_MS) ?? { nodes: [], edges: [] };
         const findings = readCache('findings', CACHE_TTL_MS) ?? [];
         setGraphState(graph, findings);
     }
-    // File watching — re-run code analysis on save (no AWS calls, instant)
-    // stderr is safe in stdio transport; stdout is reserved for MCP JSON-RPC
-    const repoPath = process.cwd();
-    const configFile = path.resolve(resolvedConfigPath);
-    let debounceTimer = null;
-    let refreshing = false;
-    try {
-        fs.watch(repoPath, { recursive: true }, (_, filename) => {
-            if (!filename)
-                return;
-            const abs = path.join(repoPath, filename);
-            if (abs === configFile)
-                return;
-            const ext = path.extname(filename);
-            if (!['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs'].includes(ext))
-                return;
-            if (filename.includes('node_modules') || filename.startsWith('.infrawise'))
-                return;
-            if (debounceTimer)
-                clearTimeout(debounceTimer);
-            debounceTimer = setTimeout(async () => {
-                if (refreshing)
-                    return;
-                refreshing = true;
-                try {
-                    const { graph, findings } = await runCodeRefresh(repoPath, config);
-                    setGraphState(graph, findings);
-                    process.stderr.write(`infrawise: code graph refreshed (${graph.nodes.length} nodes · ${findings.length} finding(s))\n`);
-                }
-                catch {
-                    // don't break the MCP connection on watcher errors
-                }
-                finally {
-                    refreshing = false;
-                }
-            }, 2000);
-        });
+    else {
+        setGraphState({ nodes: [], edges: [] }, []);
     }
-    catch {
-        // fs.watch recursive not supported on all platforms — silently skip
+    // File watching drives runCodeRefresh, which needs a config — skip it without one.
+    // stderr is safe in stdio transport; stdout is reserved for MCP JSON-RPC.
+    if (config) {
+        const cfg = config;
+        const repoPath = process.cwd();
+        const configFile = path.resolve(resolvedConfigPath);
+        let debounceTimer = null;
+        let refreshing = false;
+        try {
+            fs.watch(repoPath, { recursive: true }, (_, filename) => {
+                if (!filename)
+                    return;
+                const abs = path.join(repoPath, filename);
+                if (abs === configFile)
+                    return;
+                const ext = path.extname(filename);
+                if (!['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs'].includes(ext))
+                    return;
+                if (filename.includes('node_modules') || filename.startsWith('.infrawise'))
+                    return;
+                if (debounceTimer)
+                    clearTimeout(debounceTimer);
+                debounceTimer = setTimeout(async () => {
+                    if (refreshing)
+                        return;
+                    refreshing = true;
+                    try {
+                        const { graph, findings } = await runCodeRefresh(repoPath, cfg);
+                        setGraphState(graph, findings);
+                        process.stderr.write(`infrawise: code graph refreshed (${graph.nodes.length} nodes · ${findings.length} finding(s))\n`);
+                    }
+                    catch {
+                        // don't break the MCP connection on watcher errors
+                    }
+                    finally {
+                        refreshing = false;
+                    }
+                }, 2000);
+            });
+        }
+        catch {
+            // fs.watch recursive not supported on all platforms — silently skip
+        }
     }
     const mcp = createMcpServer();
     const transport = new StdioServerTransport();

package/dist/graph/index.js

@@ -148,6 +148,8 @@ export function buildGraph(operations, dynamoMeta, postgresMeta, mysqlMeta = [],
             timeoutSec: fn.timeoutSec,
             envVarKeys: fn.envVarKeys,
             triggers: fn.triggers,
+            roleArn: fn.roleArn,
+            allowedServices: fn.allowedServices,
         });
         // Add trigger edges from source → lambda (only for enabled/active mappings)
         for (const trigger of fn.triggers ?? []) {

package/dist/server/index.js

@@ -12,10 +12,17 @@ import { getTableNodes, getFunctionNodes, getQueueNodes, getTopicNodes, getSecre
 // ── State ────────────────────────────────────────────────────────────────────
 let currentGraph = { nodes: [], edges: [] };
 let currentFindings = [];
+// False when the server booted without an infrawise.yaml (e.g. a hosted MCP
+// runtime). Used to return a "run locally" hint instead of a bare empty graph.
+let configured = true;
 export function setGraphState(graph, findings) {
     currentGraph = graph;
     currentFindings = findings;
 }
+export function setConfigured(value) {
+    configured = value;
+}
+const NOT_CONFIGURED_HINT = 'No infrastructure loaded. infrawise reads your live infra locally — run `npx infrawise start` in your project (with AWS credentials and an infrawise.yaml) so these tools return your real DynamoDB/RDS/SQS/Lambda/etc. context. A remotely hosted instance has no access to your cloud account or code, so it returns empty results by design.';
 // ── Helpers ──────────────────────────────────────────────────────────────────
 function toText(data) {
     return { content: [{ type: 'text', text: JSON.stringify(data, null, 2) }] };
@@ -31,7 +38,7 @@ function logged(name, fn) {
 export function createMcpServer() {
     const mcp = new McpServer({ name: 'infrawise', version });
     mcp.registerTool('get_infra_overview', {
-        description: 'Returns a compact infrastructure snapshot: service counts, all databases, queues, topics, secrets, lambdas, and high-severity findings. Call this first at the start of any database or infrastructure task to understand what services are in scope. Prefer this over get_graph_summary for quick orientation; use get_graph_summary only when you need every node, edge, and finding in full.',
+        description: 'Returns a compact infrastructure snapshot: service counts, all databases, queues, topics, secrets, lambdas, and high-severity findings. Call this first at the start of any database or infrastructure task to understand what services are in scope. Prefer this over get_graph_summary for quick orientation; use get_graph_summary only when you need every node, edge, and finding in full. Also returns a `configured` flag — when false, the server has no infrawise.yaml loaded (e.g. a remotely hosted instance) and all tools return empty results; a `setupHint` explains how to run infrawise locally.',
         inputSchema: z.object({}),
     }, logged('get_infra_overview', async () => {
         const tables = getTableNodes(currentGraph);
@@ -44,6 +51,8 @@ export function createMcpServer() {
         const functions = getFunctionNodes(currentGraph);
         const buckets = getBucketNodes(currentGraph);
         return toText({
+            configured,
+            ...(configured ? {} : { setupHint: NOT_CONFIGURED_HINT }),
             summary: {
                 tables: tables.length,
                 functions: functions.length,
@@ -123,6 +132,31 @@ export function createMcpServer() {
                 String(meta?.callerFunctions ?? '').includes(functionName));
         });
         const allTriggers = lambdaNode?.type === 'lambda' ? (lambdaNode.triggers ?? []) : [];
+        // Compute missing IAM permissions inline from graph data
+        const allowedServices = lambdaNode?.type === 'lambda' ? lambdaNode.allowedServices : undefined;
+        let missingPermissions;
+        if (allowedServices && !allowedServices.includes('*') && funcNode) {
+            const nodeMap = new Map(currentGraph.nodes.map((n) => [n.id, n]));
+            const needed = new Set();
+            for (const edge of outEdges) {
+                const target = nodeMap.get(edge.to);
+                if (!target)
+                    continue;
+                if ((edge.type === 'query' || edge.type === 'scan') &&
+                    target.type === 'table' &&
+                    target.databaseType === 'dynamodb')
+                    needed.add('dynamodb');
+                else if (edge.type === 'reads_secret')
+                    needed.add('secretsmanager');
+                else if (edge.type === 'reads_parameter')
+                    needed.add('ssm');
+                else if (edge.type === 'publishes_to' && target.type === 'queue')
+                    needed.add('sqs');
+                else if (edge.type === 'publishes_to' && target.type === 'topic')
+                    needed.add('sns');
+            }
+            missingPermissions = [...needed].filter((s) => !allowedServices.includes(s));
+        }
         return toText({
             function: functionName,
             found: true,
@@ -142,6 +176,7 @@ export function createMcpServer() {
                     targetType: target?.type,
                 };
             }),
+            ...(missingPermissions !== undefined ? { missingPermissions } : {}),
             issues: relatedFindings.map((f) => ({
                 severity: f.severity,
                 issue: f.issue,
@@ -334,6 +369,7 @@ export function createMcpServer() {
                 timeoutSec: l.timeoutSec,
                 envVarCount: l.envVarKeys?.length ?? 0,
                 envVarKeys: l.envVarKeys,
+                roleArn: l.roleArn,
                 triggers: (l.triggers ?? []).map((t) => ({
                     type: t.type,
                     source: t.sourceName,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "infrawise",
-  "version": "0.12.5",
+  "version": "0.13.0",
   "mcpName": "io.github.Sidd27/infrawise",
   "description": "CLI-first infrastructure intelligence platform — analyzes DynamoDB, PostgreSQL, MySQL, MongoDB, SQS, SNS, SSM, Secrets Manager, Lambda, S3, API Gateway, CloudWatch Logs and exposes findings as an MCP server for Claude Code",
   "keywords": [
@@ -78,6 +78,7 @@
     "@aws-sdk/client-cloudwatch-logs": "^3.1048.0",
     "@aws-sdk/client-dynamodb": "^3.1048.0",
     "@aws-sdk/client-eventbridge": "^3.1051.0",
+    "@aws-sdk/client-iam": "^3.1073.0",
     "@aws-sdk/client-lambda": "^3.1048.0",
     "@aws-sdk/client-rds": "^3.1048.0",
     "@aws-sdk/client-s3": "^3.1048.0",