infrawise 0.12.6 → 0.13.1

package/README.md

@@ -149,9 +149,9 @@ Add to your editor's MCP config:
 
 | Tool                         | What it provides                                                                                            |
 | ---------------------------- | ----------------------------------------------------------------------------------------------------------- |
-| `get_infra_overview`         | Complete snapshot — all services, counts, high-severity findings, and a `configured` flag                   |
+| `get_infra_overview`         | Complete snapshot — services, counts, high-severity findings, analysis `freshness` (age + stale flag), `configured` flag |
 | `get_graph_summary`          | Full infrastructure graph — all nodes, edges, and findings                                                  |
-| `analyze_function`           | Issues in a specific function — scans, missing indexes, N+1, trigger event shapes                           |
+| `analyze_function`           | Issues in a specific function — scans, missing indexes, N+1, trigger event shapes, missing IAM permissions  |
 | `suggest_gsi`                | Exact GSI config for a DynamoDB table + attribute                                                           |
 | `postgres_index_suggestions` | Exact `CREATE INDEX` SQL for your actual table                                                              |
 | `suggest_mongo_index`        | Exact `createIndex` command for a MongoDB collection + field                                                |
@@ -161,7 +161,7 @@ Add to your editor's MCP config:
 | `get_topic_details`          | SNS topics — subscription counts, protocols, and filter policies (required message attributes per subscription) |
 | `get_secrets_overview`       | Secrets Manager — names and rotation status (values never included)                                         |
 | `get_parameter_overview`     | SSM Parameter Store — names, types, tiers (values never included)                                           |
-| `get_lambda_overview`        | Lambda functions — runtime, memory, timeout, triggers (SQS/SNS/DynamoDB/Kinesis/MSK/EventBridge/S3), env var key names |
+| `get_lambda_overview`        | Lambda functions — runtime, memory, timeout, execution role ARN, triggers (SQS/SNS/DynamoDB/Kinesis/MSK/EventBridge/S3), env var key names |
 | `get_eventbridge_details`    | EventBridge rules — name, state, schedule/event pattern, target functions                                   |
 | `get_s3_overview`            | S3 buckets — versioning, encryption, public access, event notifications                                     |
 | `get_log_errors`             | CloudWatch error patterns and counts (no raw log messages)                                                  |

package/dist/adapters/aws/services.js

@@ -7,6 +7,7 @@ import { SecretsManagerClient, ListSecretsCommand } from '@aws-sdk/client-secret
 import { LambdaClient, ListFunctionsCommand, ListEventSourceMappingsCommand, } from '@aws-sdk/client-lambda';
 import { EventBridgeClient, ListRulesCommand, ListTargetsByRuleCommand, } from '@aws-sdk/client-eventbridge';
 import { RDSClient, DescribeDBInstancesCommand } from '@aws-sdk/client-rds';
+import { IAMClient, ListAttachedRolePoliciesCommand, GetPolicyCommand, GetPolicyVersionCommand, ListRolePoliciesCommand, GetRolePolicyCommand, } from '@aws-sdk/client-iam';
 import { fromIni } from '@aws-sdk/credential-providers';
 import { logger } from '../../core/index.js';
 function clientConfig(cfg) {
@@ -209,6 +210,77 @@ export async function extractSecretsMetadata(cfg = {}) {
 export async function validateSecretsAccess(cfg = {}) {
     await new SecretsManagerClient(clientConfig(cfg)).send(new ListSecretsCommand({ MaxResults: 1 }));
 }
+function servicesFromDoc(doc) {
+    const out = new Set();
+    for (const stmt of doc.Statement ?? []) {
+        if (stmt.Effect !== 'Allow')
+            continue;
+        const actions = Array.isArray(stmt.Action) ? stmt.Action : stmt.Action ? [stmt.Action] : [];
+        for (const a of actions) {
+            if (a === '*') {
+                out.add('*');
+                continue;
+            }
+            const prefix = a.split(':')[0].toLowerCase();
+            if (prefix)
+                out.add(prefix);
+        }
+    }
+    return [...out];
+}
+async function extractAllowedServices(roleArn, cfg) {
+    const client = new IAMClient(clientConfig(cfg));
+    const roleName = roleArn.split('/').pop();
+    const services = new Set();
+    try {
+        let marker;
+        do {
+            const res = await client.send(new ListAttachedRolePoliciesCommand({ RoleName: roleName, Marker: marker }));
+            for (const policy of res.AttachedPolicies ?? []) {
+                try {
+                    const meta = await client.send(new GetPolicyCommand({ PolicyArn: policy.PolicyArn }));
+                    const versionId = meta.Policy?.DefaultVersionId;
+                    if (!versionId)
+                        continue;
+                    const ver = await client.send(new GetPolicyVersionCommand({ PolicyArn: policy.PolicyArn, VersionId: versionId }));
+                    const doc = ver.PolicyVersion?.Document;
+                    if (doc) {
+                        const parsed = JSON.parse(decodeURIComponent(doc));
+                        for (const s of servicesFromDoc(parsed))
+                            services.add(s);
+                    }
+                }
+                catch {
+                    /* skip unparseable policy */
+                }
+            }
+            marker = res.Marker;
+        } while (marker);
+        let iMarker;
+        do {
+            const res = await client.send(new ListRolePoliciesCommand({ RoleName: roleName, Marker: iMarker }));
+            for (const name of res.PolicyNames ?? []) {
+                try {
+                    const inline = await client.send(new GetRolePolicyCommand({ RoleName: roleName, PolicyName: name }));
+                    if (inline.PolicyDocument) {
+                        const parsed = JSON.parse(decodeURIComponent(inline.PolicyDocument));
+                        for (const s of servicesFromDoc(parsed))
+                            services.add(s);
+                    }
+                }
+                catch {
+                    /* skip */
+                }
+            }
+            iMarker = res.Marker;
+        } while (iMarker);
+        return [...services];
+    }
+    catch (err) {
+        logger.debug(`IAM fetch skipped for ${roleName}: ${err instanceof Error ? err.message : String(err)}`);
+        return undefined;
+    }
+}
 // ─── Lambda ───────────────────────────────────────────────────────────────────
 const EVENT_SHAPES = {
     sqs: 'event.Records[0].body',
@@ -319,6 +391,7 @@ export async function extractLambdaMetadata(cfg = {}, includeFunctions) {
                     envVarKeys: Object.keys(fn.Environment?.Variables ?? {}),
                     layers: (fn.Layers ?? []).map((l) => l.Arn ?? '').filter(Boolean),
                     triggers: [],
+                    roleArn: fn.Role,
                 });
             }
             marker = res.NextMarker;
@@ -328,6 +401,16 @@ export async function extractLambdaMetadata(cfg = {}, includeFunctions) {
         for (const fn of functions) {
             fn.triggers = triggerMap.get(fn.arn) ?? [];
         }
+        // Batch IAM policy fetch per unique role ARN
+        const uniqueRoles = [...new Set(functions.map((f) => f.roleArn).filter(Boolean))];
+        const roleServices = new Map();
+        await Promise.all(uniqueRoles.map(async (arn) => {
+            roleServices.set(arn, await extractAllowedServices(arn, cfg));
+        }));
+        for (const fn of functions) {
+            if (fn.roleArn)
+                fn.allowedServices = roleServices.get(fn.roleArn);
+        }
     }
     catch (err) {
         logger.warn(`Lambda list failed: ${err instanceof Error ? err.message : String(err)}`);

package/dist/analyzers/aws-services.js

@@ -284,3 +284,67 @@ export class S3UnencryptedAnalyzer {
         return findings;
     }
 }
+// ─── IAM ─────────────────────────────────────────────────────────────────────
+const MINIMAL_ACTIONS = {
+    dynamodb: 'dynamodb:GetItem, dynamodb:PutItem, dynamodb:Query, dynamodb:UpdateItem, dynamodb:DeleteItem',
+    secretsmanager: 'secretsmanager:GetSecretValue',
+    ssm: 'ssm:GetParameter, ssm:GetParameters, ssm:GetParametersByPath',
+    sqs: 'sqs:SendMessage, sqs:ReceiveMessage, sqs:DeleteMessage, sqs:GetQueueAttributes',
+    sns: 'sns:Publish',
+    s3: 's3:GetObject, s3:PutObject, s3:DeleteObject',
+};
+export class LambdaMissingIAMPermissionsAnalyzer {
+    name = 'LambdaMissingIAMPermissionsAnalyzer';
+    async analyze(graph) {
+        const findings = [];
+        const nodeMap = new Map(graph.nodes.map((n) => [n.id, n]));
+        for (const lambda of graph.nodes) {
+            if (lambda.type !== 'lambda')
+                continue;
+            if (!lambda.allowedServices)
+                continue; // IAM data unavailable — skip
+            if (lambda.allowedServices.includes('*'))
+                continue; // AdministratorAccess
+            const funcNode = graph.nodes.find((n) => n.type === 'function' && n.name === lambda.name);
+            if (!funcNode)
+                continue;
+            const needed = new Set();
+            for (const edge of graph.edges) {
+                if (edge.from !== funcNode.id)
+                    continue;
+                const target = nodeMap.get(edge.to);
+                if (!target)
+                    continue;
+                if ((edge.type === 'query' || edge.type === 'scan') &&
+                    target.type === 'table' &&
+                    target.databaseType === 'dynamodb') {
+                    needed.add('dynamodb');
+                }
+                else if (edge.type === 'reads_secret') {
+                    needed.add('secretsmanager');
+                }
+                else if (edge.type === 'reads_parameter') {
+                    needed.add('ssm');
+                }
+                else if (edge.type === 'publishes_to' && target.type === 'queue') {
+                    needed.add('sqs');
+                }
+                else if (edge.type === 'publishes_to' && target.type === 'topic') {
+                    needed.add('sns');
+                }
+            }
+            for (const service of needed) {
+                if (lambda.allowedServices.includes(service))
+                    continue;
+                findings.push({
+                    severity: 'high',
+                    issue: `Lambda "${lambda.name}" accesses ${service} but execution role has no ${service} permissions`,
+                    description: `"${lambda.name}" calls ${service} in code but its IAM execution role (${lambda.roleArn ?? 'unknown'}) has no ${service}:* permissions. This will cause AccessDeniedException at runtime — code passes tests but fails in AWS.`,
+                    recommendation: `Add ${service} permissions to the execution role for "${lambda.name}". Minimum required: ${MINIMAL_ACTIONS[service] ?? `${service}:*`}.`,
+                    metadata: { functionName: lambda.name, missingService: service, roleArn: lambda.roleArn },
+                });
+            }
+        }
+        return findings;
+    }
+}

package/dist/analyzers/index.js

@@ -5,7 +5,7 @@ export { MissingMySQLIndexAnalyzer, MySQLFullTableScanAnalyzer } from './mysql.j
 export { MissingMongoIndexAnalyzer, MongoCollectionScanAnalyzer } from './mongodb.js';
 export { IaCDriftAnalyzer } from './terraform.js';
 export { PipelineAnalyzer } from './pipeline.js';
-export { MissingDLQAnalyzer, UnencryptedQueueAnalyzer, LargeQueueBacklogAnalyzer, VisibilityTimeoutMismatchAnalyzer, MissingSecretRotationAnalyzer, MissingLogRetentionAnalyzer, LambdaDefaultMemoryAnalyzer, LambdaHighTimeoutAnalyzer, LambdaMissingTriggerDLQAnalyzer, S3PublicAccessAnalyzer, S3MissingVersioningAnalyzer, S3UnencryptedAnalyzer, } from './aws-services.js';
+export { MissingDLQAnalyzer, UnencryptedQueueAnalyzer, LargeQueueBacklogAnalyzer, VisibilityTimeoutMismatchAnalyzer, MissingSecretRotationAnalyzer, MissingLogRetentionAnalyzer, LambdaDefaultMemoryAnalyzer, LambdaHighTimeoutAnalyzer, LambdaMissingTriggerDLQAnalyzer, LambdaMissingIAMPermissionsAnalyzer, S3PublicAccessAnalyzer, S3MissingVersioningAnalyzer, S3UnencryptedAnalyzer, } from './aws-services.js';
 export { RDSPubliclyAccessibleAnalyzer, RDSNoBackupAnalyzer, RDSUnencryptedAnalyzer, RDSNoDeletionProtectionAnalyzer, RDSNoMultiAZAnalyzer, } from './rds.js';
 export async function runAllAnalyzers(graph, analyzers) {
     const allFindings = [];

package/dist/cli/commands/analyze.js

@@ -13,7 +13,7 @@ import { extractLogsMetadata } from '../../adapters/aws/logs.js';
 import { extractS3Metadata } from '../../adapters/aws/s3.js';
 import { scanRepository } from '../../context/index.js';
 import { buildGraph } from '../../graph/index.js';
-import { runAllAnalyzers, IaCDriftAnalyzer, PipelineAnalyzer, FullTableScanAnalyzer, MissingGSIAnalyzer, HotPartitionAnalyzer, MissingIndexAnalyzer, NplusOneAnalyzer, LargeSelectAnalyzer, MissingMySQLIndexAnalyzer, MySQLFullTableScanAnalyzer, MissingMongoIndexAnalyzer, MongoCollectionScanAnalyzer, MissingDLQAnalyzer, UnencryptedQueueAnalyzer, LargeQueueBacklogAnalyzer, VisibilityTimeoutMismatchAnalyzer, MissingSecretRotationAnalyzer, MissingLogRetentionAnalyzer, LambdaDefaultMemoryAnalyzer, LambdaHighTimeoutAnalyzer, LambdaMissingTriggerDLQAnalyzer, RDSPubliclyAccessibleAnalyzer, RDSNoBackupAnalyzer, RDSUnencryptedAnalyzer, RDSNoDeletionProtectionAnalyzer, RDSNoMultiAZAnalyzer, S3PublicAccessAnalyzer, S3MissingVersioningAnalyzer, S3UnencryptedAnalyzer, } from '../../analyzers/index.js';
+import { runAllAnalyzers, IaCDriftAnalyzer, PipelineAnalyzer, FullTableScanAnalyzer, MissingGSIAnalyzer, HotPartitionAnalyzer, MissingIndexAnalyzer, NplusOneAnalyzer, LargeSelectAnalyzer, MissingMySQLIndexAnalyzer, MySQLFullTableScanAnalyzer, MissingMongoIndexAnalyzer, MongoCollectionScanAnalyzer, MissingDLQAnalyzer, UnencryptedQueueAnalyzer, LargeQueueBacklogAnalyzer, VisibilityTimeoutMismatchAnalyzer, MissingSecretRotationAnalyzer, MissingLogRetentionAnalyzer, LambdaDefaultMemoryAnalyzer, LambdaHighTimeoutAnalyzer, LambdaMissingTriggerDLQAnalyzer, LambdaMissingIAMPermissionsAnalyzer, RDSPubliclyAccessibleAnalyzer, RDSNoBackupAnalyzer, RDSUnencryptedAnalyzer, RDSNoDeletionProtectionAnalyzer, RDSNoMultiAZAnalyzer, S3PublicAccessAnalyzer, S3MissingVersioningAnalyzer, S3UnencryptedAnalyzer, } from '../../analyzers/index.js';
 import { printFinding, printSummaryBox, log, printHeader } from '../utils.js';
 const SEVERITY_ORDER = { high: 3, medium: 2, low: 1, verify: 0 };
 function buildMarkdownReport(findings, projectName) {
@@ -100,6 +100,7 @@ function buildAnalyzers(config, iacDriftAnalyzer, iacLambdas) {
                 new LambdaDefaultMemoryAnalyzer(),
                 new LambdaHighTimeoutAnalyzer(),
                 new LambdaMissingTriggerDLQAnalyzer(),
+                new LambdaMissingIAMPermissionsAnalyzer(),
             ]
             : []),
         ...(config.rds?.enabled === true

package/dist/cli/commands/serve.js

@@ -2,7 +2,7 @@ import * as fs from 'fs';
 import * as path from 'path';
 import chalk from 'chalk';
 import ora from 'ora';
-import { loadConfig, readCache, setCacheDir } from '../../core/index.js';
+import { loadConfig, readCache, readCacheTimestamp, setCacheDir } from '../../core/index.js';
 import { createServer, setGraphState, setConfigured } from '../../server/index.js';
 import { log, printHeader } from '../utils.js';
 import { runAnalyze, runCodeRefresh } from './analyze.js';
@@ -83,7 +83,7 @@ export async function runServe(options = {}) {
     const cachedFindings = readCache('findings');
     if (cachedGraph && cachedFindings) {
         log.success('Cached analysis loaded', `${cachedGraph.nodes.length} nodes · ${cachedGraph.edges.length} edges · ${cachedFindings.length} finding(s)`);
-        setGraphState(cachedGraph, cachedFindings);
+        setGraphState(cachedGraph, cachedFindings, readCacheTimestamp('graph'));
     }
     else if (config) {
         log.warn('No cache found — running analysis now...');
@@ -91,10 +91,10 @@ export async function runServe(options = {}) {
         await runAnalyze({ repo: repoPath, config: options.config });
         const freshGraph = readCache('graph') ?? { nodes: [], edges: [] };
         const freshFindings = readCache('findings') ?? [];
-        setGraphState(freshGraph, freshFindings);
+        setGraphState(freshGraph, freshFindings, readCacheTimestamp('graph'));
     }
     else {
-        setGraphState({ nodes: [], edges: [] }, []);
+        setGraphState({ nodes: [], edges: [] }, [], null);
     }
     console.log('');
     // Start server

package/dist/cli/commands/stdio.js

@@ -1,7 +1,7 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
-import { loadConfig, readCache, setCacheDir } from '../../core/index.js';
+import { loadConfig, readCache, readCacheTimestamp, setCacheDir } from '../../core/index.js';
 import { createMcpServer, setGraphState, setConfigured } from '../../server/index.js';
 import { runAnalyze, runCodeRefresh } from './analyze.js';
 const CACHE_TTL_MS = 24 * 60 * 60 * 1000;
@@ -22,16 +22,16 @@ export async function runStdio(configPath) {
     const cachedGraph = readCache('graph', CACHE_TTL_MS);
     const cachedFindings = readCache('findings', CACHE_TTL_MS);
     if (cachedGraph && cachedFindings) {
-        setGraphState(cachedGraph, cachedFindings);
+        setGraphState(cachedGraph, cachedFindings, readCacheTimestamp('graph'));
     }
     else if (config) {
         await runAnalyze({ config: configPath });
         const graph = readCache('graph', CACHE_TTL_MS) ?? { nodes: [], edges: [] };
         const findings = readCache('findings', CACHE_TTL_MS) ?? [];
-        setGraphState(graph, findings);
+        setGraphState(graph, findings, readCacheTimestamp('graph'));
     }
     else {
-        setGraphState({ nodes: [], edges: [] }, []);
+        setGraphState({ nodes: [], edges: [] }, [], null);
     }
     // File watching drives runCodeRefresh, which needs a config — skip it without one.
     // stderr is safe in stdio transport; stdout is reserved for MCP JSON-RPC.

package/dist/core/cache.js

@@ -37,6 +37,20 @@ export function readCache(key, maxAgeMs = 3600000) {
         return null;
     }
 }
+// Returns when the entry was written (ms epoch), ignoring TTL — used to surface
+// analysis freshness. null if the entry is missing or unreadable.
+export function readCacheTimestamp(key) {
+    const filePath = path.join(cacheDir, `${key}.json`);
+    if (!fs.existsSync(filePath))
+        return null;
+    try {
+        const entry = JSON.parse(fs.readFileSync(filePath, 'utf-8'));
+        return typeof entry.timestamp === 'number' ? entry.timestamp : null;
+    }
+    catch {
+        return null;
+    }
+}
 export function clearCache(key) {
     if (key) {
         const filePath = path.join(cacheDir, `${key}.json`);

package/dist/core/index.js

@@ -1,4 +1,4 @@
 export { loadConfig, generateDefaultConfig, InfrawiseConfigSchema, ConfigError } from './config.js';
 export { logger } from './logger.js';
 export { InfrawiseError, DynamoDBError, PostgresConnectionError, RepositoryScanError, formatError, } from './errors.js';
-export { writeCache, readCache, clearCache, setCacheDir } from './cache.js';
+export { writeCache, readCache, readCacheTimestamp, clearCache, setCacheDir } from './cache.js';

package/dist/graph/index.js

@@ -148,6 +148,8 @@ export function buildGraph(operations, dynamoMeta, postgresMeta, mysqlMeta = [],
             timeoutSec: fn.timeoutSec,
             envVarKeys: fn.envVarKeys,
             triggers: fn.triggers,
+            roleArn: fn.roleArn,
+            allowedServices: fn.allowedServices,
         });
         // Add trigger edges from source → lambda (only for enabled/active mappings)
         for (const trigger of fn.triggers ?? []) {

package/dist/server/index.js

@@ -12,12 +12,32 @@ import { getTableNodes, getFunctionNodes, getQueueNodes, getTopicNodes, getSecre
 // ── State ────────────────────────────────────────────────────────────────────
 let currentGraph = { nodes: [], edges: [] };
 let currentFindings = [];
+// When the loaded analysis was produced (ms epoch). null when serving an empty
+// graph with no analysis. Surfaced via get_infra_overview so assistants can
+// judge how stale the facts are and decide to refresh.
+let analyzedAt = null;
+// Analysis is considered stale past this age — matches the 24h cache TTL that
+// drives auto-refresh in stdio/start.
+const STALE_AGE_MS = 24 * 60 * 60 * 1000;
 // False when the server booted without an infrawise.yaml (e.g. a hosted MCP
 // runtime). Used to return a "run locally" hint instead of a bare empty graph.
 let configured = true;
-export function setGraphState(graph, findings) {
+export function setGraphState(graph, findings, analyzedAtMs = Date.now()) {
     currentGraph = graph;
     currentFindings = findings;
+    analyzedAt = analyzedAtMs;
+}
+function freshness() {
+    if (analyzedAt === null)
+        return { analyzedAt: null, ageSeconds: null, stale: false };
+    const ageMs = Date.now() - analyzedAt;
+    const stale = ageMs > STALE_AGE_MS;
+    return {
+        analyzedAt: new Date(analyzedAt).toISOString(),
+        ageSeconds: Math.round(ageMs / 1000),
+        stale,
+        ...(stale ? { hint: 'Analysis is stale — run `infrawise analyze` to refresh.' } : {}),
+    };
 }
 export function setConfigured(value) {
     configured = value;
@@ -38,7 +58,7 @@ function logged(name, fn) {
 export function createMcpServer() {
     const mcp = new McpServer({ name: 'infrawise', version });
     mcp.registerTool('get_infra_overview', {
-        description: 'Returns a compact infrastructure snapshot: service counts, all databases, queues, topics, secrets, lambdas, and high-severity findings. Call this first at the start of any database or infrastructure task to understand what services are in scope. Prefer this over get_graph_summary for quick orientation; use get_graph_summary only when you need every node, edge, and finding in full. Also returns a `configured` flag — when false, the server has no infrawise.yaml loaded (e.g. a remotely hosted instance) and all tools return empty results; a `setupHint` explains how to run infrawise locally.',
+        description: 'Returns a compact infrastructure snapshot: service counts, all databases, queues, topics, secrets, lambdas, and high-severity findings. Call this first at the start of any database or infrastructure task to understand what services are in scope. Prefer this over get_graph_summary for quick orientation; use get_graph_summary only when you need every node, edge, and finding in full. Also returns a `configured` flag — when false, the server has no infrawise.yaml loaded (e.g. a remotely hosted instance) and all tools return empty results; a `setupHint` explains how to run infrawise locally. The `freshness` field reports when the analysis ran (`analyzedAt`, `ageSeconds`) and a `stale` flag with a refresh hint once the data is older than 24h.',
         inputSchema: z.object({}),
     }, logged('get_infra_overview', async () => {
         const tables = getTableNodes(currentGraph);
@@ -53,6 +73,7 @@ export function createMcpServer() {
         return toText({
             configured,
             ...(configured ? {} : { setupHint: NOT_CONFIGURED_HINT }),
+            freshness: freshness(),
             summary: {
                 tables: tables.length,
                 functions: functions.length,
@@ -132,6 +153,31 @@ export function createMcpServer() {
                 String(meta?.callerFunctions ?? '').includes(functionName));
         });
         const allTriggers = lambdaNode?.type === 'lambda' ? (lambdaNode.triggers ?? []) : [];
+        // Compute missing IAM permissions inline from graph data
+        const allowedServices = lambdaNode?.type === 'lambda' ? lambdaNode.allowedServices : undefined;
+        let missingPermissions;
+        if (allowedServices && !allowedServices.includes('*') && funcNode) {
+            const nodeMap = new Map(currentGraph.nodes.map((n) => [n.id, n]));
+            const needed = new Set();
+            for (const edge of outEdges) {
+                const target = nodeMap.get(edge.to);
+                if (!target)
+                    continue;
+                if ((edge.type === 'query' || edge.type === 'scan') &&
+                    target.type === 'table' &&
+                    target.databaseType === 'dynamodb')
+                    needed.add('dynamodb');
+                else if (edge.type === 'reads_secret')
+                    needed.add('secretsmanager');
+                else if (edge.type === 'reads_parameter')
+                    needed.add('ssm');
+                else if (edge.type === 'publishes_to' && target.type === 'queue')
+                    needed.add('sqs');
+                else if (edge.type === 'publishes_to' && target.type === 'topic')
+                    needed.add('sns');
+            }
+            missingPermissions = [...needed].filter((s) => !allowedServices.includes(s));
+        }
         return toText({
             function: functionName,
             found: true,
@@ -151,6 +197,7 @@ export function createMcpServer() {
                     targetType: target?.type,
                 };
             }),
+            ...(missingPermissions !== undefined ? { missingPermissions } : {}),
             issues: relatedFindings.map((f) => ({
                 severity: f.severity,
                 issue: f.issue,
@@ -343,6 +390,7 @@ export function createMcpServer() {
                 timeoutSec: l.timeoutSec,
                 envVarCount: l.envVarKeys?.length ?? 0,
                 envVarKeys: l.envVarKeys,
+                roleArn: l.roleArn,
                 triggers: (l.triggers ?? []).map((t) => ({
                     type: t.type,
                     source: t.sourceName,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "infrawise",
-  "version": "0.12.6",
+  "version": "0.13.1",
   "mcpName": "io.github.Sidd27/infrawise",
   "description": "CLI-first infrastructure intelligence platform — analyzes DynamoDB, PostgreSQL, MySQL, MongoDB, SQS, SNS, SSM, Secrets Manager, Lambda, S3, API Gateway, CloudWatch Logs and exposes findings as an MCP server for Claude Code",
   "keywords": [
@@ -78,6 +78,7 @@
     "@aws-sdk/client-cloudwatch-logs": "^3.1048.0",
     "@aws-sdk/client-dynamodb": "^3.1048.0",
     "@aws-sdk/client-eventbridge": "^3.1051.0",
+    "@aws-sdk/client-iam": "^3.1073.0",
     "@aws-sdk/client-lambda": "^3.1048.0",
     "@aws-sdk/client-rds": "^3.1048.0",
     "@aws-sdk/client-s3": "^3.1048.0",