infrawise 0.13.2 → 0.14.0

package/README.md

@@ -12,6 +12,8 @@ Infrawise gives AI coding assistants deterministic infrastructure awareness.
 
 It statically analyzes your codebase, cloud infrastructure, and database schemas, then exposes that context through MCP so tools like Claude Code can understand your actual tables, indexes, query patterns, and service relationships instead of guessing from source files alone.
 
+![infrawise start --claude, then Claude Code answers an SQS handler question with the exact event shape and queue risks pulled live from infrawise](https://raw.githubusercontent.com/Sidd27/infrawise/main/docs/demo/gifs/mcp.gif)
+
 ---
 
 ## Why this exists
@@ -72,7 +74,7 @@ That's it. Infrawise will:
 1. Probe your environment and generate `infrawise.yaml` (first time only — asks which AWS profile to use only if you have several)
 2. Scan your AWS services, databases, and codebase
 3. Write `.mcp.json` so your editor auto-connects on every future launch
-4. Open Claude Code with all 16 MCP tools ready
+4. Open Claude Code with all 20 MCP tools ready
 
 **Every time after:**
 
@@ -115,7 +117,7 @@ Writes `.mcp.json` to your project root and opens Claude Code. Claude Code reads
 infrawise start --cursor
 ```
 
-Writes `.cursor/mcp.json` and opens Cursor. All 16 infrawise tools are available in Cursor's MCP panel.
+Writes `.cursor/mcp.json` and opens Cursor. All 20 infrawise tools are available in Cursor's MCP panel.
 
 ### Any editor (no flag)
 
@@ -165,6 +167,10 @@ Add to your editor's MCP config:
 | `get_eventbridge_details`    | EventBridge rules — name, state, schedule/event pattern, target functions                                   |
 | `get_s3_overview`            | S3 buckets — versioning, encryption, public access, event notifications                                     |
 | `get_log_errors`             | CloudWatch error patterns and counts (no raw log messages)                                                  |
+| `get_stack_outputs`          | Stack outputs and cross-stack exports parsed from local IaC files (Terraform outputs, CFN/CDK Outputs)      |
+| `get_cognito_overview`       | Cognito user pools — MFA config, app client auth flows, OAuth settings, token validity (secrets never included) |
+| `get_stream_details`         | Kinesis streams (shards, retention, capacity mode) and MSK clusters (state, Kafka version, brokers)          |
+| `get_cache_overview`         | ElastiCache clusters — engine, encryption in transit/at rest, replication group, failover (data never read)  |
 
 ---
 
@@ -301,6 +307,22 @@ s3:
 apiGateway:
   enabled: false
 
+cognito:
+  enabled: false
+
+kinesis:
+  enabled: false
+
+msk:
+  enabled: false
+
+elasticache:
+  enabled: false
+
+runtimeSignals:
+  enabled: false # Lambda throttles/errors + queue age via CloudWatch metrics
+  windowHours: 24
+
 cloudwatchLogs:
   enabled: false
   logGroupPrefixes: []
@@ -374,7 +396,11 @@ Works from AWS APIs, database schema introspection, and IaC files — no depende
 | API Gateway                      | REST, HTTP, and WebSocket APIs — routes, methods, Lambda integrations                                             |
 | RDS                              | Publicly accessible, no backups, unencrypted, no deletion protection, single-AZ                                    |
 | CloudWatch Logs                  | Log groups with no retention policy                                                                                |
-| Terraform / CloudFormation / CDK | IaC drift vs deployed state                                                                                        |
+| Cognito                          | User pools and app client config — auth flows, OAuth settings, token validity, client secret presence              |
+| Kinesis / MSK                    | Streams (shards, retention, capacity mode) and MSK clusters (state, Kafka version, brokers)                        |
+| ElastiCache                      | Missing in-transit encryption, single-node clusters with no replication                                            |
+| Runtime signals (opt-in)         | Lambda throttling/errors and stale queue messages from CloudWatch metrics                                          |
+| Terraform / CloudFormation / CDK | IaC drift vs deployed state; stack outputs and cross-stack exports                                                 |
 
 ### Code correlation analysis (TypeScript / JavaScript)
 
@@ -446,7 +472,7 @@ src/
     aws/        DynamoDB, S3, Lambda, SQS/SNS/SSM/Secrets/EventBridge/RDS/APIGateway, CloudWatch
     db/         PostgreSQL, MySQL, MongoDB
     iac/        Terraform, CDK, CloudFormation (local file parsing)
-  analyzers/    29 rule-based analyzers
+  analyzers/    34 rule-based analyzers
   context/      Repository scanner (ts-morph AST)
   server/       Fastify MCP server (@modelcontextprotocol/sdk, Streamable HTTP)
   cli/          CLI commands (Commander.js)
@@ -473,6 +499,8 @@ Feature roadmap is tracked in the [GitHub Project](https://github.com/users/Sidd
 
 The `demo/localstack/` directory runs infrawise against real AWS APIs emulated locally via [LocalStack](https://localstack.cloud) — an open-source tool that spins up a full AWS environment in Docker so you can test AWS integrations at zero cost, with no real AWS account needed. See [`demo/localstack/README.md`](demo/localstack/README.md) for setup instructions.
 
+![infrawise analyze running against the LocalStack demo and reporting the high-severity findings](https://raw.githubusercontent.com/Sidd27/infrawise/main/docs/demo/gifs/analyze.gif)
+
 ---
 
 ## Contributing

package/dist/adapters/aws/index.js

@@ -2,3 +2,4 @@ export * from './services.js';
 export * from './dynamodb.js';
 export * from './logs.js';
 export * from './s3.js';
+export * from './metrics.js';

package/dist/adapters/aws/metrics.js

@@ -0,0 +1,94 @@
+import { CloudWatchClient, GetMetricDataCommand } from '@aws-sdk/client-cloudwatch';
+import { clientConfig } from './services.js';
+import { logger } from '../../core/index.js';
+export async function extractRuntimeSignals(cfg, lambdaNames, queueNames, windowHours = 24) {
+    const lambdas = new Map();
+    const queues = new Map();
+    if (lambdaNames.length === 0 && queueNames.length === 0)
+        return { lambdas, queues };
+    const client = new CloudWatchClient(clientConfig(cfg));
+    const end = new Date();
+    const start = new Date(end.getTime() - windowHours * 3600 * 1000);
+    const period = windowHours * 3600;
+    // Metric names live in Dimensions; query Ids are positional because function/queue
+    // names may contain characters GetMetricData Ids do not allow.
+    const queries = [];
+    lambdaNames.forEach((name, i) => {
+        queries.push({
+            Id: `lt${i}`,
+            MetricStat: {
+                Metric: {
+                    Namespace: 'AWS/Lambda',
+                    MetricName: 'Throttles',
+                    Dimensions: [{ Name: 'FunctionName', Value: name }],
+                },
+                Period: period,
+                Stat: 'Sum',
+            },
+        }, {
+            Id: `le${i}`,
+            MetricStat: {
+                Metric: {
+                    Namespace: 'AWS/Lambda',
+                    MetricName: 'Errors',
+                    Dimensions: [{ Name: 'FunctionName', Value: name }],
+                },
+                Period: period,
+                Stat: 'Sum',
+            },
+        });
+    });
+    queueNames.forEach((name, i) => {
+        queries.push({
+            Id: `qa${i}`,
+            MetricStat: {
+                Metric: {
+                    Namespace: 'AWS/SQS',
+                    MetricName: 'ApproximateAgeOfOldestMessage',
+                    Dimensions: [{ Name: 'QueueName', Value: name }],
+                },
+                Period: period,
+                Stat: 'Maximum',
+            },
+        });
+    });
+    try {
+        for (let i = 0; i < queries.length; i += 500) {
+            const chunk = queries.slice(i, i + 500);
+            let nextToken;
+            do {
+                const res = await client.send(new GetMetricDataCommand({
+                    StartTime: start,
+                    EndTime: end,
+                    MetricDataQueries: chunk,
+                    NextToken: nextToken,
+                }));
+                for (const r of res.MetricDataResults ?? []) {
+                    const id = r.Id ?? '';
+                    const value = r.Values?.[0] ?? 0;
+                    const idx = parseInt(id.slice(2), 10);
+                    if (Number.isNaN(idx))
+                        continue;
+                    if (id.startsWith('lt')) {
+                        const e = lambdas.get(lambdaNames[idx]) ?? { throttles: 0, errors: 0 };
+                        e.throttles = value;
+                        lambdas.set(lambdaNames[idx], e);
+                    }
+                    else if (id.startsWith('le')) {
+                        const e = lambdas.get(lambdaNames[idx]) ?? { throttles: 0, errors: 0 };
+                        e.errors = value;
+                        lambdas.set(lambdaNames[idx], e);
+                    }
+                    else if (id.startsWith('qa')) {
+                        queues.set(queueNames[idx], { oldestMessageAgeSec: value });
+                    }
+                }
+                nextToken = res.NextToken;
+            } while (nextToken);
+        }
+    }
+    catch (err) {
+        logger.warn(`Runtime signals fetch failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    return { lambdas, queues };
+}

package/dist/adapters/aws/services.js

@@ -7,10 +7,14 @@ import { SecretsManagerClient, ListSecretsCommand } from '@aws-sdk/client-secret
 import { LambdaClient, ListFunctionsCommand, ListEventSourceMappingsCommand, } from '@aws-sdk/client-lambda';
 import { EventBridgeClient, ListRulesCommand, ListTargetsByRuleCommand, } from '@aws-sdk/client-eventbridge';
 import { RDSClient, DescribeDBInstancesCommand } from '@aws-sdk/client-rds';
+import { KinesisClient, ListStreamsCommand, DescribeStreamSummaryCommand, } from '@aws-sdk/client-kinesis';
+import { KafkaClient, ListClustersV2Command } from '@aws-sdk/client-kafka';
+import { ElastiCacheClient, DescribeCacheClustersCommand, DescribeReplicationGroupsCommand, } from '@aws-sdk/client-elasticache';
+import { CognitoIdentityProviderClient, ListUserPoolsCommand, ListUserPoolClientsCommand, DescribeUserPoolClientCommand, DescribeUserPoolCommand, } from '@aws-sdk/client-cognito-identity-provider';
 import { IAMClient, ListAttachedRolePoliciesCommand, GetPolicyCommand, GetPolicyVersionCommand, ListRolePoliciesCommand, GetRolePolicyCommand, } from '@aws-sdk/client-iam';
 import { fromIni } from '@aws-sdk/credential-providers';
 import { logger } from '../../core/index.js';
-function clientConfig(cfg) {
+export function clientConfig(cfg) {
     const region = cfg.region ?? 'us-east-1';
     const base = { region };
     if (cfg.profile)
@@ -420,6 +424,198 @@ export async function extractLambdaMetadata(cfg = {}, includeFunctions) {
 export async function validateLambdaAccess(cfg = {}) {
     await new LambdaClient(clientConfig(cfg)).send(new ListFunctionsCommand({ MaxItems: 1 }));
 }
+// ─── Kinesis ─────────────────────────────────────────────────────────────────
+export async function extractKinesisMetadata(cfg = {}) {
+    const client = new KinesisClient(clientConfig(cfg));
+    const streams = [];
+    try {
+        let nextToken;
+        const names = [];
+        do {
+            const res = await client.send(new ListStreamsCommand({ NextToken: nextToken }));
+            names.push(...(res.StreamNames ?? []));
+            nextToken = res.NextToken;
+        } while (nextToken);
+        for (const name of names) {
+            try {
+                const res = await client.send(new DescribeStreamSummaryCommand({ StreamName: name }));
+                const d = res.StreamDescriptionSummary;
+                if (!d)
+                    continue;
+                streams.push({
+                    name,
+                    arn: d.StreamARN ?? '',
+                    status: d.StreamStatus ?? 'UNKNOWN',
+                    shardCount: d.OpenShardCount,
+                    retentionHours: d.RetentionPeriodHours,
+                    encrypted: d.EncryptionType === 'KMS',
+                    mode: d.StreamModeDetails?.StreamMode ?? 'PROVISIONED',
+                });
+            }
+            catch (err) {
+                logger.warn(`Kinesis describe failed for ${name}: ${err instanceof Error ? err.message : String(err)}`);
+            }
+        }
+    }
+    catch (err) {
+        logger.warn(`Kinesis list failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    return streams;
+}
+// ─── MSK ─────────────────────────────────────────────────────────────────────
+export async function extractMSKMetadata(cfg = {}) {
+    const client = new KafkaClient(clientConfig(cfg));
+    const clusters = [];
+    try {
+        let nextToken;
+        do {
+            const res = await client.send(new ListClustersV2Command({ NextToken: nextToken }));
+            for (const c of res.ClusterInfoList ?? []) {
+                if (!c.ClusterName)
+                    continue;
+                clusters.push({
+                    name: c.ClusterName,
+                    arn: c.ClusterArn ?? '',
+                    state: c.State ?? 'UNKNOWN',
+                    clusterType: c.ClusterType ?? 'PROVISIONED',
+                    kafkaVersion: c.Provisioned?.CurrentBrokerSoftwareInfo?.KafkaVersion,
+                    brokerNodes: c.Provisioned?.NumberOfBrokerNodes,
+                });
+            }
+            nextToken = res.NextToken;
+        } while (nextToken);
+    }
+    catch (err) {
+        logger.warn(`MSK list failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    return clusters;
+}
+// ─── ElastiCache ─────────────────────────────────────────────────────────────
+export async function extractElastiCacheMetadata(cfg = {}) {
+    const client = new ElastiCacheClient(clientConfig(cfg));
+    const clusters = [];
+    try {
+        const failoverByGroup = new Map();
+        try {
+            let marker;
+            do {
+                const res = await client.send(new DescribeReplicationGroupsCommand({ Marker: marker }));
+                for (const g of res.ReplicationGroups ?? []) {
+                    if (g.ReplicationGroupId) {
+                        failoverByGroup.set(g.ReplicationGroupId, g.AutomaticFailover ?? 'disabled');
+                    }
+                }
+                marker = res.Marker;
+            } while (marker);
+        }
+        catch {
+            /* replication groups are optional context */
+        }
+        let marker;
+        do {
+            const res = await client.send(new DescribeCacheClustersCommand({ Marker: marker }));
+            for (const c of res.CacheClusters ?? []) {
+                if (!c.CacheClusterId)
+                    continue;
+                clusters.push({
+                    id: c.CacheClusterId,
+                    engine: c.Engine ?? 'unknown',
+                    engineVersion: c.EngineVersion ?? '',
+                    nodeType: c.CacheNodeType ?? '',
+                    numNodes: c.NumCacheNodes ?? 0,
+                    transitEncryption: c.TransitEncryptionEnabled ?? false,
+                    atRestEncryption: c.AtRestEncryptionEnabled ?? false,
+                    replicationGroupId: c.ReplicationGroupId,
+                    automaticFailover: c.ReplicationGroupId
+                        ? failoverByGroup.get(c.ReplicationGroupId)
+                        : undefined,
+                });
+            }
+            marker = res.Marker;
+        } while (marker);
+    }
+    catch (err) {
+        logger.warn(`ElastiCache list failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    return clusters;
+}
+// ─── Cognito ─────────────────────────────────────────────────────────────────
+export async function extractCognitoMetadata(cfg = {}) {
+    const client = new CognitoIdentityProviderClient(clientConfig(cfg));
+    const pools = [];
+    try {
+        let nextToken;
+        const poolRefs = [];
+        do {
+            const res = await client.send(new ListUserPoolsCommand({ MaxResults: 60, NextToken: nextToken }));
+            for (const p of res.UserPools ?? []) {
+                if (p.Id && p.Name)
+                    poolRefs.push({ id: p.Id, name: p.Name });
+            }
+            nextToken = res.NextToken;
+        } while (nextToken);
+        for (const ref of poolRefs) {
+            try {
+                const poolRes = await client.send(new DescribeUserPoolCommand({ UserPoolId: ref.id }));
+                const clients = [];
+                let clientToken;
+                do {
+                    const clientsRes = await client.send(new ListUserPoolClientsCommand({
+                        UserPoolId: ref.id,
+                        MaxResults: 60,
+                        NextToken: clientToken,
+                    }));
+                    for (const c of clientsRes.UserPoolClients ?? []) {
+                        if (!c.ClientId)
+                            continue;
+                        try {
+                            const detail = await client.send(new DescribeUserPoolClientCommand({ UserPoolId: ref.id, ClientId: c.ClientId }));
+                            const d = detail.UserPoolClient;
+                            if (!d)
+                                continue;
+                            clients.push({
+                                clientName: d.ClientName ?? c.ClientName ?? '',
+                                clientId: c.ClientId,
+                                authFlows: d.ExplicitAuthFlows ?? [],
+                                oauthFlows: d.AllowedOAuthFlows ?? [],
+                                oauthScopes: d.AllowedOAuthScopes ?? [],
+                                callbackUrls: d.CallbackURLs ?? [],
+                                generatesSecret: !!d.ClientSecret,
+                                accessTokenValidity: d.AccessTokenValidity,
+                                idTokenValidity: d.IdTokenValidity,
+                                refreshTokenValidity: d.RefreshTokenValidity,
+                                tokenValidityUnits: d.TokenValidityUnits
+                                    ? {
+                                        accessToken: d.TokenValidityUnits.AccessToken,
+                                        idToken: d.TokenValidityUnits.IdToken,
+                                        refreshToken: d.TokenValidityUnits.RefreshToken,
+                                    }
+                                    : undefined,
+                            });
+                        }
+                        catch {
+                            /* skip client on describe failure */
+                        }
+                    }
+                    clientToken = clientsRes.NextToken;
+                } while (clientToken);
+                pools.push({
+                    name: ref.name,
+                    id: ref.id,
+                    mfaConfiguration: poolRes.UserPool?.MfaConfiguration,
+                    clients,
+                });
+            }
+            catch (err) {
+                logger.warn(`Cognito describe failed for ${ref.name}: ${err instanceof Error ? err.message : String(err)}`);
+            }
+        }
+    }
+    catch (err) {
+        logger.warn(`Cognito list failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    return pools;
+}
 // ─── RDS ─────────────────────────────────────────────────────────────────────
 export async function extractRDSMetadata(cfg = {}) {
     const client = new RDSClient(clientConfig(cfg));

package/dist/adapters/iac/terraform.js

@@ -14,6 +14,7 @@ function emptySchema() {
         parameters: [],
         secrets: [],
         apiGateways: [],
+        outputs: [],
     };
 }
 // ─── File discovery ───────────────────────────────────────────────────────────
@@ -76,6 +77,25 @@ function tfGSINames(body) {
     }
     return names;
 }
+function extractTerraformOutputBlocks(content) {
+    const results = [];
+    const pat = /output\s+"([^"]+)"\s*\{/g;
+    let match;
+    while ((match = pat.exec(content)) !== null) {
+        const startBrace = match.index + match[0].length - 1;
+        let depth = 1;
+        let i = startBrace + 1;
+        while (i < content.length && depth > 0) {
+            if (content[i] === '{')
+                depth++;
+            else if (content[i] === '}')
+                depth--;
+            i++;
+        }
+        results.push({ name: match[1] ?? '', body: content.slice(startBrace + 1, i - 1) });
+    }
+    return results;
+}
 export async function extractTerraformSchema(repoPath) {
     const schema = emptySchema();
     const tfFiles = findFilesRecursively(repoPath, ['.tf']);
@@ -173,6 +193,16 @@ export async function extractTerraformSchema(repoPath) {
                     break;
             }
         }
+        for (const { name, body } of extractTerraformOutputBlocks(content)) {
+            const valueMatch = body.match(/value\s*=\s*(.+)/);
+            schema.outputs.push({
+                name,
+                description: tfStr(body, 'description'),
+                value: valueMatch?.[1]?.trim(),
+                source: 'terraform',
+                filePath,
+            });
+        }
     }
     return schema;
 }
@@ -341,6 +371,30 @@ function processCFNResources(resources, schema, filePath, source) {
         }
     }
 }
+function processCFNOutputs(template, schema, filePath, source) {
+    const outputs = template['Outputs'];
+    if (typeof outputs !== 'object' || outputs === null)
+        return;
+    for (const [name, raw] of Object.entries(outputs)) {
+        if (typeof raw !== 'object' || raw === null)
+            continue;
+        const out = raw;
+        const exp = out['Export'];
+        const expName = exp?.['Name'];
+        schema.outputs.push({
+            name,
+            description: typeof out['Description'] === 'string' ? out['Description'] : undefined,
+            exportName: expName === undefined
+                ? undefined
+                : typeof expName === 'string'
+                    ? expName
+                    : JSON.stringify(expName),
+            value: typeof out['Value'] === 'string' ? out['Value'] : JSON.stringify(out['Value']),
+            source,
+            filePath,
+        });
+    }
+}
 export async function extractCloudFormationSchema(repoPath) {
     const schema = emptySchema();
     const cfnFiles = findFilesRecursively(repoPath, ['.yaml', '.yml', '.json']);
@@ -353,6 +407,7 @@ export async function extractCloudFormationSchema(repoPath) {
         if (!resources)
             continue;
         processCFNResources(resources, schema, filePath, 'cloudformation');
+        processCFNOutputs(parsed, schema, filePath, 'cloudformation');
     }
     return schema;
 }
@@ -375,6 +430,7 @@ export async function extractCDKSchema(repoPath) {
             if (!resources)
                 continue;
             processCFNResources(resources, schema, filePath, 'cdk');
+            processCFNOutputs(parsed, schema, filePath, 'cdk');
         }
     }
     // Strategy 2: Detect CDK TypeScript construct patterns if no cdk.out exists
@@ -400,6 +456,7 @@ function mergeSchemas(...schemas) {
         param: new Set(),
         secret: new Set(),
         api: new Set(),
+        output: new Set(),
     };
     for (const schema of schemas) {
         for (const t of schema.dynamoTables) {
@@ -472,6 +529,13 @@ function mergeSchemas(...schemas) {
                 merged.apiGateways.push(a);
             }
         }
+        for (const o of schema.outputs) {
+            const k = `${o.source}::${o.filePath}::${o.name}`;
+            if (!seen.output.has(k)) {
+                seen.output.add(k);
+                merged.outputs.push(o);
+            }
+        }
     }
     return merged;
 }
@@ -491,7 +555,8 @@ export async function extractIaCSchema(repoPath) {
         merged.buckets.length +
         merged.parameters.length +
         merged.secrets.length +
-        merged.apiGateways.length;
+        merged.apiGateways.length +
+        merged.outputs.length;
     logger.debug(`IaC schema total: ${total} resource(s) across TF/CFN/CDK`);
     return merged;
 }

package/dist/analyzers/aws-services.js

@@ -284,6 +284,93 @@ export class S3UnencryptedAnalyzer {
         return findings;
     }
 }
+// ─── ElastiCache ─────────────────────────────────────────────────────────────
+export class CacheTransitEncryptionAnalyzer {
+    name = 'CacheTransitEncryptionAnalyzer';
+    async analyze(graph) {
+        const findings = [];
+        for (const node of graph.nodes) {
+            if (node.type !== 'cache_cluster')
+                continue;
+            if (node.transitEncryption === false) {
+                findings.push({
+                    severity: 'medium',
+                    issue: `Cache cluster "${node.name}" has no in-transit encryption`,
+                    description: `ElastiCache cluster "${node.name}" (${node.engine}) does not have TLS in-transit encryption enabled. Credentials and cached data cross the network in plaintext.`,
+                    recommendation: `Enable transit encryption on "${node.name}". Note this requires clients to connect with TLS (rediss:// for Redis).`,
+                    metadata: { cacheClusterId: node.name, provider: node.provider },
+                });
+            }
+        }
+        return findings;
+    }
+}
+export class CacheSingleNodeAnalyzer {
+    name = 'CacheSingleNodeAnalyzer';
+    async analyze(graph) {
+        const findings = [];
+        for (const node of graph.nodes) {
+            if (node.type !== 'cache_cluster')
+                continue;
+            if (node.numNodes === 1 && !node.replicationGroupId) {
+                findings.push({
+                    severity: 'low',
+                    issue: `Cache cluster "${node.name}" is a single node with no replication`,
+                    description: `"${node.name}" runs one cache node outside a replication group. A node failure loses all cached data and takes the cache offline until replaced.`,
+                    recommendation: `Move "${node.name}" into a replication group with at least one replica and automatic failover if cache availability matters for this workload.`,
+                    metadata: { cacheClusterId: node.name },
+                });
+            }
+        }
+        return findings;
+    }
+}
+// ─── Runtime signals ─────────────────────────────────────────────────────────
+export class LambdaThrottlingAnalyzer {
+    name = 'LambdaThrottlingAnalyzer';
+    async analyze(graph) {
+        const findings = [];
+        for (const node of graph.nodes) {
+            if (node.type !== 'lambda')
+                continue;
+            if ((node.recentThrottles ?? 0) > 0) {
+                findings.push({
+                    severity: 'high',
+                    issue: `Lambda "${node.name}" was throttled ${node.recentThrottles} time(s) recently`,
+                    description: `"${node.name}" hit concurrency throttling in the analysis window. Throttled invocations are rejected or delayed; for sync callers this surfaces as errors, for event sources as retries and growing backlogs.`,
+                    recommendation: `Check reserved/account concurrency for "${node.name}". Raise reserved concurrency, request an account limit increase, or smooth the invoke rate (SQS between producer and Lambda).`,
+                    metadata: { functionName: node.name, recentThrottles: node.recentThrottles },
+                });
+            }
+        }
+        return findings;
+    }
+}
+export class StaleQueueMessagesAnalyzer {
+    name = 'StaleQueueMessagesAnalyzer';
+    thresholdSec;
+    constructor(thresholdSec = 3600) {
+        this.thresholdSec = thresholdSec;
+    }
+    async analyze(graph) {
+        const findings = [];
+        for (const node of graph.nodes) {
+            if (node.type !== 'queue')
+                continue;
+            const age = node.oldestMessageAgeSec ?? 0;
+            if (age > this.thresholdSec) {
+                findings.push({
+                    severity: 'medium',
+                    issue: `Queue "${node.name}" has messages older than ${Math.round(age / 3600)} hour(s)`,
+                    description: `The oldest message in "${node.name}" is ${Math.round(age / 60)} minutes old. Consumers are not keeping up, are failing, or are not running.`,
+                    recommendation: `Check consumer health for "${node.name}". If a Lambda consumes it, look at its error and throttle counts; if messages are near the retention limit they will be silently dropped.`,
+                    metadata: { queueName: node.name, oldestMessageAgeSec: age },
+                });
+            }
+        }
+        return findings;
+    }
+}
 // ─── IAM ─────────────────────────────────────────────────────────────────────
 const MINIMAL_ACTIONS = {
     dynamodb: 'dynamodb:GetItem, dynamodb:PutItem, dynamodb:Query, dynamodb:UpdateItem, dynamodb:DeleteItem',

package/dist/analyzers/index.js

@@ -5,7 +5,7 @@ export { MissingMySQLIndexAnalyzer, MySQLFullTableScanAnalyzer } from './mysql.j
 export { MissingMongoIndexAnalyzer, MongoCollectionScanAnalyzer } from './mongodb.js';
 export { IaCDriftAnalyzer } from './terraform.js';
 export { PipelineAnalyzer } from './pipeline.js';
-export { MissingDLQAnalyzer, UnencryptedQueueAnalyzer, LargeQueueBacklogAnalyzer, VisibilityTimeoutMismatchAnalyzer, MissingSecretRotationAnalyzer, MissingLogRetentionAnalyzer, LambdaDefaultMemoryAnalyzer, LambdaHighTimeoutAnalyzer, LambdaMissingTriggerDLQAnalyzer, LambdaMissingIAMPermissionsAnalyzer, S3PublicAccessAnalyzer, S3MissingVersioningAnalyzer, S3UnencryptedAnalyzer, } from './aws-services.js';
+export { MissingDLQAnalyzer, UnencryptedQueueAnalyzer, LargeQueueBacklogAnalyzer, VisibilityTimeoutMismatchAnalyzer, MissingSecretRotationAnalyzer, MissingLogRetentionAnalyzer, LambdaDefaultMemoryAnalyzer, LambdaHighTimeoutAnalyzer, LambdaMissingTriggerDLQAnalyzer, LambdaMissingIAMPermissionsAnalyzer, S3PublicAccessAnalyzer, S3MissingVersioningAnalyzer, S3UnencryptedAnalyzer, CacheTransitEncryptionAnalyzer, CacheSingleNodeAnalyzer, LambdaThrottlingAnalyzer, StaleQueueMessagesAnalyzer, } from './aws-services.js';
 export { RDSPubliclyAccessibleAnalyzer, RDSNoBackupAnalyzer, RDSUnencryptedAnalyzer, RDSNoDeletionProtectionAnalyzer, RDSNoMultiAZAnalyzer, } from './rds.js';
 export async function runAllAnalyzers(graph, analyzers) {
     const allFindings = [];

package/dist/cli/commands/analyze.js

@@ -8,12 +8,13 @@ import { extractPostgresMetadata } from '../../adapters/db/postgres.js';
 import { extractMySQLMetadata } from '../../adapters/db/mysql.js';
 import { extractMongoMetadata } from '../../adapters/db/mongodb.js';
 import { extractIaCSchema } from '../../adapters/iac/terraform.js';
-import { extractSQSMetadata, extractSNSMetadata, extractSSMMetadata, extractSecretsMetadata, extractLambdaMetadata, extractEventBridgeMetadata, extractRDSMetadata, extractAPIGatewayMetadata, } from '../../adapters/aws/services.js';
+import { extractSQSMetadata, extractSNSMetadata, extractSSMMetadata, extractSecretsMetadata, extractLambdaMetadata, extractEventBridgeMetadata, extractRDSMetadata, extractAPIGatewayMetadata, extractCognitoMetadata, extractKinesisMetadata, extractMSKMetadata, extractElastiCacheMetadata, } from '../../adapters/aws/services.js';
 import { extractLogsMetadata } from '../../adapters/aws/logs.js';
+import { extractRuntimeSignals } from '../../adapters/aws/metrics.js';
 import { extractS3Metadata } from '../../adapters/aws/s3.js';
 import { scanRepository } from '../../context/index.js';
-import { buildGraph } from '../../graph/index.js';
-import { runAllAnalyzers, IaCDriftAnalyzer, PipelineAnalyzer, FullTableScanAnalyzer, MissingGSIAnalyzer, HotPartitionAnalyzer, MissingIndexAnalyzer, NplusOneAnalyzer, LargeSelectAnalyzer, MissingMySQLIndexAnalyzer, MySQLFullTableScanAnalyzer, MissingMongoIndexAnalyzer, MongoCollectionScanAnalyzer, MissingDLQAnalyzer, UnencryptedQueueAnalyzer, LargeQueueBacklogAnalyzer, VisibilityTimeoutMismatchAnalyzer, MissingSecretRotationAnalyzer, MissingLogRetentionAnalyzer, LambdaDefaultMemoryAnalyzer, LambdaHighTimeoutAnalyzer, LambdaMissingTriggerDLQAnalyzer, LambdaMissingIAMPermissionsAnalyzer, RDSPubliclyAccessibleAnalyzer, RDSNoBackupAnalyzer, RDSUnencryptedAnalyzer, RDSNoDeletionProtectionAnalyzer, RDSNoMultiAZAnalyzer, S3PublicAccessAnalyzer, S3MissingVersioningAnalyzer, S3UnencryptedAnalyzer, } from '../../analyzers/index.js';
+import { buildGraph, addStackOutputNodes } from '../../graph/index.js';
+import { runAllAnalyzers, IaCDriftAnalyzer, PipelineAnalyzer, FullTableScanAnalyzer, MissingGSIAnalyzer, HotPartitionAnalyzer, MissingIndexAnalyzer, NplusOneAnalyzer, LargeSelectAnalyzer, MissingMySQLIndexAnalyzer, MySQLFullTableScanAnalyzer, MissingMongoIndexAnalyzer, MongoCollectionScanAnalyzer, MissingDLQAnalyzer, UnencryptedQueueAnalyzer, LargeQueueBacklogAnalyzer, VisibilityTimeoutMismatchAnalyzer, MissingSecretRotationAnalyzer, MissingLogRetentionAnalyzer, LambdaDefaultMemoryAnalyzer, LambdaHighTimeoutAnalyzer, LambdaMissingTriggerDLQAnalyzer, LambdaMissingIAMPermissionsAnalyzer, RDSPubliclyAccessibleAnalyzer, RDSNoBackupAnalyzer, RDSUnencryptedAnalyzer, RDSNoDeletionProtectionAnalyzer, RDSNoMultiAZAnalyzer, S3PublicAccessAnalyzer, S3MissingVersioningAnalyzer, S3UnencryptedAnalyzer, CacheTransitEncryptionAnalyzer, CacheSingleNodeAnalyzer, LambdaThrottlingAnalyzer, StaleQueueMessagesAnalyzer, } from '../../analyzers/index.js';
 import { printFinding, printSummaryBox, log, printHeader } from '../utils.js';
 const SEVERITY_ORDER = { high: 3, medium: 2, low: 1, verify: 0 };
 function buildMarkdownReport(findings, projectName) {
@@ -119,6 +120,12 @@ function buildAnalyzers(config, iacDriftAnalyzer, iacLambdas) {
                 new S3UnencryptedAnalyzer(),
             ]
             : []),
+        ...(config.elasticache?.enabled === true
+            ? [new CacheTransitEncryptionAnalyzer(), new CacheSingleNodeAnalyzer()]
+            : []),
+        ...(config.runtimeSignals?.enabled === true
+            ? [new LambdaThrottlingAnalyzer(), new StaleQueueMessagesAnalyzer()]
+            : []),
         ...(iacDriftAnalyzer ? [iacDriftAnalyzer] : []),
         pipelineAnalyzer,
     ];
@@ -158,15 +165,44 @@ export async function runAnalyze(options = {}) {
     servicesMeta.rds = await extract(config.rds?.enabled === true, 'Extracting RDS instances...', 'RDS', () => extractRDSMetadata(awsCfg), (r) => `${r.length} instance(s)`);
     servicesMeta.s3 = await extract(config.s3?.enabled === true, 'Extracting S3 buckets...', 'S3', () => extractS3Metadata(awsCfg), (r) => `${r.length} bucket(s)`);
     servicesMeta.apiGateway = await extract(config.apiGateway?.enabled === true, 'Extracting API Gateway routes...', 'API Gateway', () => extractAPIGatewayMetadata(awsCfg), (r) => `${r.length} API(s), ${r.reduce((sum, api) => sum + api.routes.length, 0)} route(s)`);
+    servicesMeta.cognito = await extract(config.cognito?.enabled === true, 'Extracting Cognito user pools...', 'Cognito', () => extractCognitoMetadata(awsCfg), (r) => `${r.length} user pool(s)`);
+    servicesMeta.kinesis = await extract(config.kinesis?.enabled === true, 'Extracting Kinesis streams...', 'Kinesis', () => extractKinesisMetadata(awsCfg), (r) => `${r.length} stream(s)`);
+    servicesMeta.msk = await extract(config.msk?.enabled === true, 'Extracting MSK clusters...', 'MSK', () => extractMSKMetadata(awsCfg), (r) => `${r.length} cluster(s)`);
+    servicesMeta.elasticache = await extract(config.elasticache?.enabled === true, 'Extracting ElastiCache clusters...', 'ElastiCache', () => extractElastiCacheMetadata(awsCfg), (r) => `${r.length} cluster(s)`);
     const cwLogs = config.cloudwatchLogs;
     servicesMeta.logs = await extract(cwLogs?.enabled, 'Sampling CloudWatch Logs (errors only, max 50 groups)...', 'CloudWatch Logs', () => extractLogsMetadata({
         ...awsCfg,
         logGroupPrefixes: cwLogs?.logGroupPrefixes,
         windowHours: cwLogs?.windowHours,
     }), (r) => `${r.length} group(s), ${r.filter((lg) => lg.errorCount > 0).length} with errors`);
+    if (config.runtimeSignals?.enabled && (servicesMeta.lambda?.length || servicesMeta.sqs?.length)) {
+        const s = mkSpinner('Fetching runtime signals (CloudWatch metrics)...');
+        try {
+            const signals = await extractRuntimeSignals(awsCfg, (servicesMeta.lambda ?? []).map((f) => f.name), (servicesMeta.sqs ?? []).map((q) => q.name), config.runtimeSignals.windowHours);
+            for (const fn of servicesMeta.lambda ?? []) {
+                const sig = signals.lambdas.get(fn.name);
+                if (sig) {
+                    fn.recentThrottles = sig.throttles;
+                    fn.recentErrors = sig.errors;
+                }
+            }
+            for (const q of servicesMeta.sqs ?? []) {
+                const sig = signals.queues.get(q.name);
+                if (sig)
+                    q.oldestMessageAgeSec = sig.oldestMessageAgeSec;
+            }
+            s.succeed(chalk.green('Runtime signals') +
+                chalk.dim(`  ${signals.lambdas.size} function(s), ${signals.queues.size} queue(s)`));
+        }
+        catch (err) {
+            s.warn(chalk.yellow('Runtime signals skipped') +
+                chalk.dim(`  ${err instanceof Error ? err.message : String(err)}`));
+        }
+    }
     // ── IaC schema (Terraform / CloudFormation / CDK) ────────────────────────────
     let iacDriftAnalyzer;
     let iacLambdas = [];
+    let iacOutputs = [];
     {
         const s = mkSpinner('Extracting IaC schema (Terraform / CloudFormation / CDK)...');
         try {
@@ -180,10 +216,12 @@ export async function runAnalyze(options = {}) {
                 iacSchema.buckets.length +
                 iacSchema.parameters.length +
                 iacSchema.secrets.length +
-                iacSchema.apiGateways.length;
+                iacSchema.apiGateways.length +
+                iacSchema.outputs.length;
             iacDriftAnalyzer = new IaCDriftAnalyzer();
             iacDriftAnalyzer.setIaCSchema(iacSchema);
             iacLambdas = iacSchema.lambdas;
+            iacOutputs = iacSchema.outputs;
             s.succeed(chalk.green('IaC schema') + chalk.dim(`  ${total} resource(s) across TF/CFN/CDK`));
         }
         catch (err) {
@@ -211,6 +249,7 @@ export async function runAnalyze(options = {}) {
     {
         const s = mkSpinner('Building infrastructure graph...');
         graph = buildGraph(operations, dynamoMeta, postgresMeta, mysqlMeta, mongoMeta, servicesMeta);
+        addStackOutputNodes(graph, iacOutputs);
         s.succeed(chalk.green('Graph built') +
             chalk.dim(`  ${graph.nodes.length} nodes, ${graph.edges.length} edges`));
     }
@@ -278,11 +317,13 @@ export async function runCodeRefresh(repoPath, config) {
     // Re-run IaC schema (pure file scan, no AWS calls)
     let iacDriftAnalyzer;
     let iacLambdas = [];
+    let iacOutputs = [];
     try {
         const iacSchema = await extractIaCSchema(repoPath);
         iacDriftAnalyzer = new IaCDriftAnalyzer();
         iacDriftAnalyzer.setIaCSchema(iacSchema);
         iacLambdas = iacSchema.lambdas;
+        iacOutputs = iacSchema.outputs;
     }
     catch {
         // IaC scan is best-effort
@@ -296,6 +337,7 @@ export async function runCodeRefresh(repoPath, config) {
         operations = [];
     }
     const graph = buildGraph(operations, dynamoMeta, postgresMeta, mysqlMeta, mongoMeta, servicesMeta);
+    addStackOutputNodes(graph, iacOutputs);
     const analyzers = buildAnalyzers(config, iacDriftAnalyzer, iacLambdas);
     const findings = await runAllAnalyzers(graph, analyzers);
     writeCache('graph', graph);

package/dist/cli/commands/discover.js

@@ -186,6 +186,11 @@ function writeYaml(cwd, opts) {
         rds: { enabled: false },
         s3: { enabled: true },
         apiGateway: { enabled: true },
+        cognito: { enabled: false },
+        kinesis: { enabled: false },
+        msk: { enabled: false },
+        elasticache: { enabled: false },
+        runtimeSignals: { enabled: false, windowHours: 24 },
         cloudwatchLogs: { enabled: false, logGroupPrefixes: [], windowHours: 24 },
         analysis: { sampleSize: 100 },
     };

package/dist/cli/commands/serve.js

@@ -25,6 +25,10 @@ const TOOL_MAP = [
     { name: 'get_s3_overview', service: 's3' },
     { name: 'get_api_routes', service: 'apiGateway' },
     { name: 'get_log_errors', service: 'cloudwatchLogs' },
+    { name: 'get_stack_outputs', service: 'terraform' },
+    { name: 'get_cognito_overview', service: 'cognito' },
+    { name: 'get_stream_details', service: 'kinesis' },
+    { name: 'get_cache_overview', service: 'elasticache' },
 ];
 // With no config every registered tool is shown as active (the server exposes
 // all of them); a config narrows the list to its enabled services.

package/dist/core/config.js

@@ -57,6 +57,16 @@ export const InfrawiseConfigSchema = z.object({
     rds: z.object({ enabled: z.boolean().optional().default(false) }).optional(),
     s3: z.object({ enabled: z.boolean().optional().default(false) }).optional(),
     apiGateway: z.object({ enabled: z.boolean().optional().default(false) }).optional(),
+    cognito: z.object({ enabled: z.boolean().optional().default(false) }).optional(),
+    kinesis: z.object({ enabled: z.boolean().optional().default(false) }).optional(),
+    msk: z.object({ enabled: z.boolean().optional().default(false) }).optional(),
+    elasticache: z.object({ enabled: z.boolean().optional().default(false) }).optional(),
+    runtimeSignals: z
+        .object({
+        enabled: z.boolean().optional().default(false),
+        windowHours: z.number().int().positive().optional().default(24),
+    })
+        .optional(),
     cloudwatchLogs: z
         .object({
         enabled: z.boolean().optional().default(false),
@@ -185,6 +195,14 @@ export function generateDefaultConfig(projectName, options) {
         rds: { enabled: options?.rds?.enabled ?? false },
         s3: { enabled: options?.s3?.enabled ?? false },
         apiGateway: { enabled: options?.apiGateway?.enabled ?? false },
+        cognito: { enabled: options?.cognito?.enabled ?? false },
+        kinesis: { enabled: options?.kinesis?.enabled ?? false },
+        msk: { enabled: options?.msk?.enabled ?? false },
+        elasticache: { enabled: options?.elasticache?.enabled ?? false },
+        runtimeSignals: {
+            enabled: options?.runtimeSignals?.enabled ?? false,
+            windowHours: options?.runtimeSignals?.windowHours ?? 24,
+        },
         cloudwatchLogs: {
             enabled: options?.cloudwatchLogs?.enabled ?? false,
             logGroupPrefixes: options?.cloudwatchLogs?.logGroupPrefixes ?? [],

package/dist/graph/index.js

@@ -77,6 +77,32 @@ export function buildGraph(operations, dynamoMeta, postgresMeta, mysqlMeta = [],
             visibilityTimeoutSec: q.visibilityTimeoutSec,
             approximateMessages: q.approximateMessages,
             retentionDays: q.retentionDays,
+            oldestMessageAgeSec: q.oldestMessageAgeSec,
+        });
+    }
+    for (const s of servicesMeta.kinesis ?? []) {
+        addNode({
+            id: `stream:aws:${s.name}`,
+            type: 'stream',
+            name: s.name,
+            provider: 'aws',
+            status: s.status,
+            shardCount: s.shardCount,
+            retentionHours: s.retentionHours,
+            encrypted: s.encrypted,
+            mode: s.mode,
+        });
+    }
+    for (const c of servicesMeta.msk ?? []) {
+        addNode({
+            id: `kafka_cluster:aws:${c.name}`,
+            type: 'kafka_cluster',
+            name: c.name,
+            provider: 'aws',
+            state: c.state,
+            clusterType: c.clusterType,
+            kafkaVersion: c.kafkaVersion,
+            brokerNodes: c.brokerNodes,
         });
     }
     for (const api of servicesMeta.apiGateway ?? []) {
@@ -150,6 +176,8 @@ export function buildGraph(operations, dynamoMeta, postgresMeta, mysqlMeta = [],
             triggers: fn.triggers,
             roleArn: fn.roleArn,
             allowedServices: fn.allowedServices,
+            recentThrottles: fn.recentThrottles,
+            recentErrors: fn.recentErrors,
         });
         // Add trigger edges from source → lambda (only for enabled/active mappings)
         for (const trigger of fn.triggers ?? []) {
@@ -177,15 +205,8 @@ export function buildGraph(operations, dynamoMeta, postgresMeta, mysqlMeta = [],
                 });
             }
             else if (trigger.type === 'kinesis') {
-                sourceId = `queue:aws:${trigger.sourceName}`;
-                addNode({
-                    id: sourceId,
-                    type: 'queue',
-                    name: trigger.sourceName,
-                    provider: 'aws',
-                    hasDLQ: false,
-                    encrypted: false,
-                });
+                sourceId = `stream:aws:${trigger.sourceName}`;
+                addNode({ id: sourceId, type: 'stream', name: trigger.sourceName, provider: 'aws' });
             }
             else {
                 continue;
@@ -271,6 +292,33 @@ export function buildGraph(operations, dynamoMeta, postgresMeta, mysqlMeta = [],
             }
         }
     }
+    for (const c of servicesMeta.elasticache ?? []) {
+        addNode({
+            id: `cache_cluster:aws:${c.id}`,
+            type: 'cache_cluster',
+            name: c.id,
+            provider: 'aws',
+            engine: c.engine,
+            engineVersion: c.engineVersion,
+            nodeType: c.nodeType,
+            numNodes: c.numNodes,
+            transitEncryption: c.transitEncryption,
+            atRestEncryption: c.atRestEncryption,
+            replicationGroupId: c.replicationGroupId,
+            automaticFailover: c.automaticFailover,
+        });
+    }
+    for (const pool of servicesMeta.cognito ?? []) {
+        addNode({
+            id: `user_pool:aws:${pool.id}`,
+            type: 'user_pool',
+            name: pool.name,
+            provider: 'aws',
+            poolId: pool.id,
+            mfaConfiguration: pool.mfaConfiguration,
+            clients: pool.clients,
+        });
+    }
     // ── Code operations (functions + edges) ───────────────────────────────────
     for (const op of operations) {
         const funcNodeId = `function:${op.filePath}:${op.functionName}`;
@@ -360,6 +408,25 @@ export function buildGraph(operations, dynamoMeta, postgresMeta, mysqlMeta = [],
     }
     return { nodes, edges };
 }
+export function addStackOutputNodes(graph, outputs) {
+    const ids = new Set(graph.nodes.map((n) => n.id));
+    for (const o of outputs) {
+        const id = `stack_output:${o.source}:${o.filePath}:${o.name}`;
+        if (ids.has(id))
+            continue;
+        ids.add(id);
+        graph.nodes.push({
+            id,
+            type: 'stack_output',
+            name: o.name,
+            description: o.description,
+            exportName: o.exportName,
+            value: o.value,
+            iacSource: o.source,
+            file: o.filePath,
+        });
+    }
+}
 function resolveEdgeType(operationType) {
     const op = operationType.toLowerCase();
     if (op === 'scan' || op === 'scancommand')
@@ -385,6 +452,11 @@ export const getLambdaNodes = (g) => getNodes(g, 'lambda');
 export const getEventBridgeRuleNodes = (g) => getNodes(g, 'eventbridge_rule');
 export const getBucketNodes = (g) => getNodes(g, 'bucket');
 export const getAPINodes = (g) => getNodes(g, 'api');
+export const getStackOutputNodes = (g) => getNodes(g, 'stack_output');
+export const getUserPoolNodes = (g) => getNodes(g, 'user_pool');
+export const getStreamNodes = (g) => getNodes(g, 'stream');
+export const getKafkaClusterNodes = (g) => getNodes(g, 'kafka_cluster');
+export const getCacheClusterNodes = (g) => getNodes(g, 'cache_cluster');
 export function getEdgesForNode(graph, nodeId) {
     return graph.edges.filter((e) => e.from === nodeId || e.to === nodeId);
 }

package/dist/server/index.js

@@ -8,7 +8,7 @@ import { z } from 'zod';
 import { logger } from '../core/index.js';
 const { version } = JSON.parse(readFileSync(join(import.meta.dirname, '../../package.json'), 'utf8'));
 import { summarizeFindings } from '../analyzers/index.js';
-import { getTableNodes, getFunctionNodes, getQueueNodes, getTopicNodes, getSecretNodes, getParameterNodes, getLogGroupNodes, getLambdaNodes, getEventBridgeRuleNodes, getBucketNodes, getAPINodes, getScanEdges, getOutgoingEdges, } from '../graph/index.js';
+import { getTableNodes, getFunctionNodes, getQueueNodes, getTopicNodes, getSecretNodes, getParameterNodes, getLogGroupNodes, getLambdaNodes, getEventBridgeRuleNodes, getBucketNodes, getAPINodes, getStackOutputNodes, getUserPoolNodes, getStreamNodes, getKafkaClusterNodes, getCacheClusterNodes, getScanEdges, getOutgoingEdges, } from '../graph/index.js';
 // ── State ────────────────────────────────────────────────────────────────────
 let currentGraph = { nodes: [], edges: [] };
 let currentFindings = [];
@@ -70,6 +70,7 @@ export function createMcpServer() {
         const lambdas = getLambdaNodes(currentGraph);
         const functions = getFunctionNodes(currentGraph);
         const buckets = getBucketNodes(currentGraph);
+        const userPools = getUserPoolNodes(currentGraph);
         return toText({
             configured,
             ...(configured ? {} : { setupHint: NOT_CONFIGURED_HINT }),
@@ -84,6 +85,9 @@ export function createMcpServer() {
                 logGroups: logGroups.length,
                 lambdas: lambdas.length,
                 buckets: buckets.length,
+                userPools: userPools.length,
+                streams: getStreamNodes(currentGraph).length,
+                cacheClusters: getCacheClusterNodes(currentGraph).length,
                 totalNodes: currentGraph.nodes.length,
                 totalEdges: currentGraph.edges.length,
                 findings: summarizeFindings(currentFindings),
@@ -300,7 +304,7 @@ export function createMcpServer() {
         });
     }));
     mcp.registerTool('get_queue_details', {
-        description: 'Returns all SQS queues with DLQ presence, encryption status, FIFO type (isFifo), visibility timeout, approximate message count, and retention days. When isFifo is true, all SendMessage calls must include a MessageGroupId. Call this when reviewing messaging architecture, investigating a message backlog, checking DLQ coverage, or verifying visibility timeout is set correctly relative to Lambda timeout (should be 6× the Lambda timeout). Use get_infra_overview for a quick queue count only.',
+        description: 'Returns all SQS queues with DLQ presence, encryption status, FIFO type (isFifo), visibility timeout, approximate message count, and retention days. When isFifo is true, all SendMessage calls must include a MessageGroupId. Call this when reviewing messaging architecture, investigating a message backlog, checking DLQ coverage, or verifying visibility timeout is set correctly relative to Lambda timeout (should be 6× the Lambda timeout). Use get_infra_overview for a quick queue count only. When runtime signals are enabled, oldestMessageAgeSec reports the age of the oldest message from CloudWatch.',
         inputSchema: z.object({}),
     }, logged('get_queue_details', async () => {
         const queues = getQueueNodes(currentGraph);
@@ -316,6 +320,7 @@ export function createMcpServer() {
                 visibilityTimeoutSec: q.visibilityTimeoutSec,
                 approximateMessages: q.approximateMessages,
                 retentionDays: q.retentionDays,
+                oldestMessageAgeSec: q.oldestMessageAgeSec,
                 findings: queueFindings
                     .filter((f) => f.metadata.queueName === q.name)
                     .map((f) => ({ severity: f.severity, issue: f.issue })),
@@ -375,7 +380,7 @@ export function createMcpServer() {
         });
     }));
     mcp.registerTool('get_lambda_overview', {
-        description: 'Returns all Lambda functions with runtime, memory (MB), timeout (sec), environment variable key names (values never returned), and event source triggers with the correct handler event shape for each. Call this when auditing Lambda configuration for default memory (128 MB) or high timeouts, or when you need the trigger event shape for a specific function without running analyze_function.',
+        description: 'Returns all Lambda functions with runtime, memory (MB), timeout (sec), environment variable key names (values never returned), and event source triggers with the correct handler event shape for each. Call this when auditing Lambda configuration for default memory (128 MB) or high timeouts, or when you need the trigger event shape for a specific function without running analyze_function. When runtime signals are enabled, recentThrottles and recentErrors report CloudWatch counts for the analysis window.',
         inputSchema: z.object({}),
     }, logged('get_lambda_overview', async () => {
         const lambdas = getLambdaNodes(currentGraph);
@@ -391,6 +396,8 @@ export function createMcpServer() {
                 envVarCount: l.envVarKeys?.length ?? 0,
                 envVarKeys: l.envVarKeys,
                 roleArn: l.roleArn,
+                recentThrottles: l.recentThrottles,
+                recentErrors: l.recentErrors,
                 triggers: (l.triggers ?? []).map((t) => ({
                     type: t.type,
                     source: t.sourceName,
@@ -480,6 +487,90 @@ export function createMcpServer() {
             })),
         });
     }));
+    mcp.registerTool('get_cache_overview', {
+        description: 'Returns all ElastiCache clusters with engine, version, node type, node count, in-transit and at-rest encryption status, replication group, and automatic failover state. Call this before writing cache client code (TLS is required when transit encryption is on — rediss:// for Redis) or when reviewing cache availability and security posture. Cached data is never read or included.',
+        inputSchema: z.object({}),
+    }, logged('get_cache_overview', async () => {
+        const caches = getCacheClusterNodes(currentGraph);
+        const cacheFindings = currentFindings.filter((f) => f.metadata?.cacheClusterId);
+        return toText({
+            total: caches.length,
+            note: 'Cached data is never included.',
+            caches: caches.map((c) => ({
+                id: c.name,
+                engine: c.engine,
+                engineVersion: c.engineVersion,
+                nodeType: c.nodeType,
+                numNodes: c.numNodes,
+                transitEncryption: c.transitEncryption,
+                atRestEncryption: c.atRestEncryption,
+                replicationGroupId: c.replicationGroupId,
+                automaticFailover: c.automaticFailover,
+                findings: cacheFindings
+                    .filter((f) => f.metadata.cacheClusterId === c.name)
+                    .map((f) => ({ severity: f.severity, issue: f.issue })),
+            })),
+        });
+    }));
+    mcp.registerTool('get_stream_details', {
+        description: 'Returns all Kinesis data streams (status, shard count, retention hours, encryption, capacity mode) and Amazon MSK clusters (state, cluster type, Kafka version, broker count). Call this when writing Kinesis producer or consumer code, checking whether a stream is PROVISIONED or ON_DEMAND before writing PutRecord calls, or reviewing streaming architecture. For Kafka topic-level producer/consumer mappings extracted from application code, use get_topic_details instead.',
+        inputSchema: z.object({}),
+    }, logged('get_stream_details', async () => {
+        const streams = getStreamNodes(currentGraph);
+        const clusters = getKafkaClusterNodes(currentGraph);
+        return toText({
+            totalStreams: streams.length,
+            totalKafkaClusters: clusters.length,
+            streams: streams.map((s) => ({
+                name: s.name,
+                status: s.status,
+                shardCount: s.shardCount,
+                retentionHours: s.retentionHours,
+                encrypted: s.encrypted,
+                mode: s.mode,
+            })),
+            kafkaClusters: clusters.map((c) => ({
+                name: c.name,
+                state: c.state,
+                clusterType: c.clusterType,
+                kafkaVersion: c.kafkaVersion,
+                brokerNodes: c.brokerNodes,
+            })),
+        });
+    }));
+    mcp.registerTool('get_cognito_overview', {
+        description: 'Returns all Cognito user pools with MFA configuration and every app client config: allowed auth flows, OAuth flows/scopes, callback URLs, token validity, and whether the client has a secret (SDK auth calls must send SECRET_HASH when true). Client secret values are never returned. Call this before writing any Cognito sign-in, sign-up, or token-refresh code to use the correct auth flow and client settings. Do NOT call to look up users or tokens — infrawise never reads user data.',
+        inputSchema: z.object({}),
+    }, logged('get_cognito_overview', async () => {
+        const pools = getUserPoolNodes(currentGraph);
+        return toText({
+            total: pools.length,
+            note: 'Client secret values and user data are never included.',
+            userPools: pools.map((p) => ({
+                name: p.name,
+                id: p.poolId,
+                mfaConfiguration: p.mfaConfiguration,
+                clients: p.clients ?? [],
+            })),
+        });
+    }));
+    mcp.registerTool('get_stack_outputs', {
+        description: 'Returns all stack outputs and cross-stack exports parsed from local IaC files: Terraform output blocks and CloudFormation/CDK Outputs sections, with name, description, export name, and the raw value expression. Call this when wiring cross-stack references (Fn::ImportValue, terraform_remote_state) or when you need the exported name of a resource defined in another stack. Do NOT call for live resource attributes — outputs come from local IaC files, not the deployed stack.',
+        inputSchema: z.object({}),
+    }, logged('get_stack_outputs', async () => {
+        const outputs = getStackOutputNodes(currentGraph);
+        return toText({
+            total: outputs.length,
+            outputs: outputs.map((o) => ({
+                name: o.name,
+                description: o.description,
+                exportName: o.exportName,
+                value: o.value,
+                source: o.iacSource,
+                file: o.file,
+            })),
+        });
+    }));
     return mcp;
 }
 // ── Fastify server ────────────────────────────────────────────────────────────
@@ -519,6 +610,10 @@ export function createServer(port = 3000) {
             'get_s3_overview',
             'get_api_routes',
             'get_log_errors',
+            'get_stack_outputs',
+            'get_cognito_overview',
+            'get_stream_details',
+            'get_cache_overview',
         ],
     }));
     fastify.post('/mcp', async (request, reply) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "infrawise",
-  "version": "0.13.2",
+  "version": "0.14.0",
   "mcpName": "io.github.Sidd27/infrawise",
   "description": "CLI-first infrastructure intelligence platform — analyzes DynamoDB, PostgreSQL, MySQL, MongoDB, SQS, SNS, SSM, Secrets Manager, Lambda, S3, API Gateway, CloudWatch Logs and exposes findings as an MCP server for Claude Code",
   "keywords": [
@@ -76,10 +76,15 @@
   "dependencies": {
     "@aws-sdk/client-api-gateway": "^3.1068.0",
     "@aws-sdk/client-apigatewayv2": "^3.1068.0",
+    "@aws-sdk/client-cloudwatch": "^3.1079.0",
     "@aws-sdk/client-cloudwatch-logs": "^3.1048.0",
+    "@aws-sdk/client-cognito-identity-provider": "^3.1079.0",
     "@aws-sdk/client-dynamodb": "^3.1048.0",
+    "@aws-sdk/client-elasticache": "^3.1079.0",
     "@aws-sdk/client-eventbridge": "^3.1051.0",
     "@aws-sdk/client-iam": "^3.1073.0",
+    "@aws-sdk/client-kafka": "^3.1079.0",
+    "@aws-sdk/client-kinesis": "^3.1079.0",
     "@aws-sdk/client-lambda": "^3.1048.0",
     "@aws-sdk/client-rds": "^3.1048.0",
     "@aws-sdk/client-s3": "^3.1048.0",