infrawise 0.16.0 → 0.17.0

package/README.md

@@ -427,10 +427,12 @@ Works from AWS APIs, database schema introspection, and IaC files — no depende
 | Runtime signals (opt-in)         | Lambda throttling/errors and stale queue messages from CloudWatch metrics                                          |
 | Terraform / CloudFormation / CDK | IaC drift vs deployed state; stack outputs and cross-stack exports                                                 |
 
-### Code correlation analysis (TypeScript / JavaScript)
+### Code correlation analysis (TypeScript / JavaScript / Python)
 
 Uses [ts-morph](https://ts-morph.com/) AST analysis to detect which functions call which tables and how:
 
+Python repositories are scanned with a bundled stdlib-`ast` scanner (requires `python3` on PATH; skipped with a warning otherwise): boto3 clients and `dynamodb.Table()` resources, `cursor.execute` SQL, pymongo collections, and kafka-python/confluent-kafka producers and consumers. Language detection is automatic — TypeScript and Python scans each run only when matching files exist.
+
 | Analyzer                   | Severity | What it detects                               |
 | -------------------------- | -------- | --------------------------------------------- |
 | Full Table Scan (DynamoDB) | High     | `.scan()` calls without filters               |
@@ -447,7 +449,7 @@ Uses [ts-morph](https://ts-morph.com/) AST analysis to detect which functions ca
 | Pipeline: repeated table access | Medium / Verify | Same table read by 2+ functions in one service pipeline |
 | Pipeline: missing DLQ hop  | Medium   | Mid-pipeline queue (has producer and consumer) with no Dead Letter Queue |
 
-Non-TypeScript/JavaScript projects still get full value from infrastructure-level analyzers — code correlation (function-to-table mapping, N+1 patterns) is skipped.
+Projects in other languages still get full value from infrastructure-level analyzers — code correlation (function-to-table mapping, N+1 patterns) currently supports TypeScript, JavaScript, and Python.
 
 The scanner supports: AWS SDK v3/v2 for DynamoDB, `pg`/Prisma/Knex for PostgreSQL, `mysql2`/Knex for MySQL, driver/Mongoose for MongoDB, AWS SDK v3 for SQS/SNS/SSM/Secrets/Lambda, and `kafkajs` for Kafka topics (producer/consumer).
 
@@ -498,7 +500,7 @@ src/
     db/         PostgreSQL, MySQL, MongoDB
     iac/        Terraform, CDK, CloudFormation (local file parsing)
   analyzers/    34 rule-based analyzers
-  context/      Repository scanner (ts-morph AST)
+  context/      Repository scanner (ts-morph AST + Python stdlib-ast subprocess)
   server/       Fastify MCP server (@modelcontextprotocol/sdk, Streamable HTTP)
   cli/          CLI commands (Commander.js)
 ```
@@ -507,7 +509,7 @@ src/
 
 ## Current limitations
 
-- Code-level correlation supports TypeScript and JavaScript only
+- Code-level correlation supports TypeScript, JavaScript, and Python (Python requires python3 on PATH)
 - Dynamically constructed queries may not always be resolved statically
 - Runtime tracing is not yet implemented
 - Large monorepos may require future incremental analysis optimization

package/dist/adapters/aws/services.js

@@ -234,13 +234,15 @@ function servicesFromDoc(doc) {
 }
 async function extractAllowedServices(roleArn, cfg) {
     const client = new IAMClient(clientConfig(cfg));
-    const roleName = roleArn.split('/').pop();
+    const roleName = roleArn.split('/').pop() ?? roleArn;
     const services = new Set();
     try {
         let marker;
         do {
             const res = await client.send(new ListAttachedRolePoliciesCommand({ RoleName: roleName, Marker: marker }));
             for (const policy of res.AttachedPolicies ?? []) {
+                if (!policy.PolicyArn)
+                    continue;
                 try {
                     const meta = await client.send(new GetPolicyCommand({ PolicyArn: policy.PolicyArn }));
                     const versionId = meta.Policy?.DefaultVersionId;

package/dist/adapters/db/mongodb.js

@@ -90,9 +90,15 @@ export async function validateMongoAccess(connectionString) {
         serverSelectionTimeoutMS: 5000,
         connectTimeoutMS: 5000,
     });
+    // driver can exceed serverSelectionTimeoutMS when SYNs are dropped; hard-cap the probe
+    const deadline = new Promise((_, reject) => {
+        setTimeout(() => reject(new Error('validation timeout')), 6000).unref();
+    });
     try {
-        await client.connect();
-        await client.db('admin').command({ ping: 1 });
+        await Promise.race([
+            client.connect().then(() => client.db('admin').command({ ping: 1 })),
+            deadline,
+        ]);
         return true;
     }
     catch {

package/dist/context/index.js

@@ -2,6 +2,7 @@ import * as path from 'path';
 import * as fs from 'fs';
 import { Project, SyntaxKind, Node } from 'ts-morph';
 import { RepositoryScanError, logger } from '../core/index.js';
+import { scanPythonRepository } from './python.js';
 const DYNAMO_OPERATIONS = new Set([
     'query',
     'scan',
@@ -571,11 +572,56 @@ function detectAWSServiceOperations(callExpr, filePath) {
     }
     return null;
 }
+const PROBE_EXCLUDED_DIRS = new Set([
+    'node_modules',
+    'venv',
+    '.venv',
+    'site-packages',
+    '__pycache__',
+    'dist',
+]);
+function detectLanguages(root) {
+    let hasTypeScript = fs.existsSync(path.join(root, 'tsconfig.json'));
+    let hasPython = false;
+    const stack = [root];
+    while (stack.length > 0 && !(hasTypeScript && hasPython)) {
+        const dir = stack.pop();
+        for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+            if (entry.isDirectory()) {
+                if (!PROBE_EXCLUDED_DIRS.has(entry.name) && !entry.name.startsWith('.')) {
+                    stack.push(path.join(dir, entry.name));
+                }
+            }
+            else if (entry.name.endsWith('.ts') || entry.name.endsWith('.tsx')) {
+                hasTypeScript = true;
+            }
+            else if (entry.name.endsWith('.py')) {
+                hasPython = true;
+            }
+            if (hasTypeScript && hasPython)
+                break;
+        }
+    }
+    return { hasTypeScript, hasPython };
+}
 export async function scanRepository(repoPath) {
     const resolvedPath = path.resolve(repoPath);
     if (!fs.existsSync(resolvedPath)) {
         throw new RepositoryScanError(`Path does not exist: ${resolvedPath}`);
     }
+    const { hasTypeScript, hasPython } = detectLanguages(resolvedPath);
+    const detected = [hasTypeScript && 'TypeScript', hasPython && 'Python'].filter(Boolean);
+    logger.info(`Detected languages: ${detected.length > 0 ? detected.join(', ') : 'none'}`);
+    const operations = [];
+    if (hasTypeScript) {
+        operations.push(...scanTypeScriptRepository(resolvedPath));
+    }
+    if (hasPython) {
+        operations.push(...(await scanPythonRepository(resolvedPath)));
+    }
+    return operations;
+}
+function scanTypeScriptRepository(resolvedPath) {
     const tsconfigPath = path.join(resolvedPath, 'tsconfig.json');
     const hasTsConfig = fs.existsSync(tsconfigPath);
     const project = new Project({

package/dist/context/python.js

@@ -0,0 +1,42 @@
+import { execFile } from 'child_process';
+import { promisify } from 'util';
+import * as path from 'path';
+import { fileURLToPath } from 'url';
+import { logger } from '../core/index.js';
+const execFileAsync = promisify(execFile);
+const SCANNER_PATH = path.join(path.dirname(fileURLToPath(import.meta.url)), 'scanner.py');
+let cachedInterpreter;
+async function findPythonInterpreter() {
+    if (cachedInterpreter !== undefined)
+        return cachedInterpreter;
+    for (const cmd of ['python3', 'python', 'py']) {
+        try {
+            await execFileAsync(cmd, ['--version']);
+            cachedInterpreter = cmd;
+            return cmd;
+        }
+        catch {
+            // try next candidate
+        }
+    }
+    cachedInterpreter = null;
+    return null;
+}
+export async function scanPythonRepository(repoPath) {
+    const interpreter = await findPythonInterpreter();
+    if (interpreter === null) {
+        logger.warn('Python files found but no python3 on PATH — skipping Python scan');
+        return [];
+    }
+    try {
+        const { stdout } = await execFileAsync(interpreter, [SCANNER_PATH, repoPath], {
+            maxBuffer: 64 * 1024 * 1024,
+        });
+        return JSON.parse(stdout);
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message.slice(0, 200) : String(err);
+        logger.warn(`Python scan failed — skipping (${message})`);
+        return [];
+    }
+}

package/dist/context/scanner.py

@@ -0,0 +1,310 @@
+import ast
+import json
+import os
+import re
+import sys
+
+EXCLUDED_DIRS = {'node_modules', 'venv', '.venv', 'site-packages', '__pycache__', 'dist'}
+
+SQS_METHODS = {'send_message', 'send_message_batch', 'receive_message', 'delete_message'}
+SNS_METHODS = {'publish', 'publish_batch'}
+SSM_METHODS = {'get_parameter', 'get_parameters', 'get_parameters_by_path'}
+SECRETS_METHODS = {'get_secret_value'}
+LAMBDA_METHODS = {'invoke', 'invoke_async'}
+DYNAMO_METHODS = {'query', 'scan', 'get_item', 'put_item', 'update_item', 'delete_item',
+                  'batch_get_item', 'batch_write_item'}
+SQL_METHODS = {'execute', 'executemany'}
+SQL_RECEIVER_HINTS = ('cursor', 'cur', 'conn', 'connection', 'session', 'db', 'pool',
+                      'pg', 'psycopg', 'asyncpg', 'engine', 'mysql', 'pymysql', 'maria')
+MYSQL_HINTS = ('mysql', 'pymysql', 'maria')
+SQL_TABLE_PATTERNS = [
+    re.compile(r'FROM\s+["\']?(\w+)["\']?', re.IGNORECASE),
+    re.compile(r'INTO\s+["\']?(\w+)["\']?', re.IGNORECASE),
+    re.compile(r'UPDATE\s+["\']?(\w+)["\']?', re.IGNORECASE),
+    re.compile(r'JOIN\s+["\']?(\w+)["\']?', re.IGNORECASE),
+]
+
+MONGO_METHODS = {'find', 'find_one', 'insert_one', 'insert_many', 'update_one', 'update_many',
+                 'delete_one', 'delete_many', 'aggregate', 'count_documents',
+                 'estimated_document_count'}
+MONGO_SCAN_METHODS = {'find', 'aggregate'}
+MONGO_BASE_HINTS = ('db', 'mongo')
+KAFKA_PRODUCER_METHODS = {'send', 'produce'}
+KAFKA_HINTS = ('kafka', 'producer', 'consumer')
+
+SERVICE_RULES = [
+    ('sqs', SQS_METHODS, ('QueueUrl', 'QueueName'), ('sqs', 'queue')),
+    ('sns', SNS_METHODS, ('TopicArn', 'TargetArn'), ('sns', 'topic')),
+    ('ssm', SSM_METHODS, ('Name', 'Path'), ('ssm', 'parameter')),
+    ('secretsmanager', SECRETS_METHODS, ('SecretId',), ('secret',)),
+    ('lambda', LAMBDA_METHODS, ('FunctionName',), ('lambda', 'fn')),
+]
+
+
+def expr_text(node):
+    if isinstance(node, ast.Name):
+        return node.id
+    if isinstance(node, ast.Attribute):
+        return expr_text(node.value) + '.' + node.attr
+    if isinstance(node, ast.Call):
+        return expr_text(node.func) + '()'
+    if isinstance(node, ast.Subscript):
+        return expr_text(node.value) + '[]'
+    return ''
+
+
+def short_name(val):
+    if val.startswith('http://') or val.startswith('https://'):
+        return val.rstrip('/').rsplit('/', 1)[-1]
+    if ':' in val:
+        return val.rsplit(':', 1)[-1]
+    return val
+
+
+def sql_table(sql):
+    for pattern in SQL_TABLE_PATTERNS:
+        match = pattern.search(sql)
+        if match:
+            return match.group(1)
+    return 'unknown'
+
+
+class Visitor(ast.NodeVisitor):
+    def __init__(self, file_path):
+        self.file_path = file_path
+        self.ops = []
+        self.stack = []
+        self.strings = {}
+        self.boto_clients = {}
+        self.dynamo_tables = {}
+        self.collections = {}
+
+    def function_name(self):
+        return self.stack[-1] if self.stack else '<module>'
+
+    def add(self, op_type, service, target):
+        self.ops.append({
+            'functionName': self.function_name(),
+            'operationType': op_type,
+            'serviceType': service,
+            'target': target,
+            'filePath': self.file_path,
+        })
+
+    def visit_FunctionDef(self, node):
+        self.stack.append(node.name)
+        self.generic_visit(node)
+        self.stack.pop()
+
+    visit_AsyncFunctionDef = visit_FunctionDef
+
+    def resolve_string(self, node):
+        if isinstance(node, ast.Constant) and isinstance(node.value, str):
+            return node.value
+        if isinstance(node, ast.Name):
+            return self.strings.get(node.id)
+        if isinstance(node, ast.JoinedStr):
+            parts = []
+            for value in node.values:
+                if isinstance(value, ast.Constant) and isinstance(value.value, str):
+                    parts.append(value.value)
+                elif isinstance(value, ast.FormattedValue):
+                    resolved = self.resolve_string(value.value)
+                    if resolved is None:
+                        return None
+                    parts.append(resolved)
+                else:
+                    return None
+            return ''.join(parts)
+        return None
+
+    def kwarg(self, node, keys):
+        for kw in node.keywords:
+            if kw.arg in keys:
+                return self.resolve_string(kw.value)
+        return None
+
+    def boto3_service(self, node):
+        if (
+            isinstance(node, ast.Call)
+            and isinstance(node.func, ast.Attribute)
+            and node.func.attr in ('client', 'resource')
+            and expr_text(node.func.value) == 'boto3'
+            and node.args
+        ):
+            return self.resolve_string(node.args[0])
+        return None
+
+    def table_name(self, node):
+        if (
+            isinstance(node, ast.Call)
+            and isinstance(node.func, ast.Attribute)
+            and node.func.attr == 'Table'
+            and node.args
+        ):
+            return self.resolve_string(node.args[0])
+        return None
+
+    def collection_name(self, node):
+        if isinstance(node, ast.Subscript):
+            base = expr_text(node.value).lower()
+            if any(h in base for h in MONGO_BASE_HINTS):
+                return self.resolve_string(node.slice)
+        if (
+            isinstance(node, ast.Call)
+            and isinstance(node.func, ast.Attribute)
+            and node.func.attr == 'get_collection'
+            and node.args
+        ):
+            return self.resolve_string(node.args[0])
+        return None
+
+    def visit_Assign(self, node):
+        if len(node.targets) == 1 and isinstance(node.targets[0], ast.Name):
+            name = node.targets[0].id
+            resolved = self.resolve_string(node.value)
+            if resolved is not None:
+                self.strings[name] = resolved
+            else:
+                service = self.boto3_service(node.value)
+                table = self.table_name(node.value)
+                collection = self.collection_name(node.value)
+                if service is not None:
+                    self.boto_clients[name] = service
+                elif table is not None:
+                    self.dynamo_tables[name] = table
+                elif collection is not None:
+                    self.collections[name] = collection
+        self.generic_visit(node)
+
+    def visit_Call(self, node):
+        if isinstance(node.func, ast.Attribute):
+            method = node.func.attr
+            recv = node.func.value
+            recv_text = expr_text(recv).lower()
+            _ = (
+                self.detect_dynamo(node, method, recv, recv_text)
+                or self.detect_sql(node, method, recv_text)
+                or self.detect_mongo(node, method, recv, recv_text)
+                or self.detect_kafka(node, method, recv_text)
+                or self.detect_aws_client(node, method, recv, recv_text)
+            )
+        self.generic_visit(node)
+
+    def detect_dynamo(self, node, method, recv, recv_text):
+        if method not in DYNAMO_METHODS:
+            return False
+        if isinstance(recv, ast.Name) and recv.id in self.dynamo_tables:
+            self.add(method, 'dynamodb', self.dynamo_tables[recv.id])
+            return True
+        inline = self.table_name(recv)
+        if inline is not None:
+            self.add(method, 'dynamodb', inline)
+            return True
+        kw = self.kwarg(node, ('TableName',))
+        tracked = isinstance(recv, ast.Name) and self.boto_clients.get(recv.id) == 'dynamodb'
+        if kw is not None or tracked or 'dynamo' in recv_text or 'ddb' in recv_text:
+            self.add(method, 'dynamodb', kw if kw else 'unknown')
+            return True
+        return False
+
+    def detect_sql(self, node, method, recv_text):
+        if method not in SQL_METHODS:
+            return False
+        if not any(h in recv_text for h in SQL_RECEIVER_HINTS):
+            return False
+        sql = None
+        if node.args:
+            arg = node.args[0]
+            if (
+                isinstance(arg, ast.Call)
+                and isinstance(arg.func, ast.Name)
+                and arg.func.id == 'text'
+                and arg.args
+            ):
+                arg = arg.args[0]
+            sql = self.resolve_string(arg)
+        service = 'mysql' if any(h in recv_text for h in MYSQL_HINTS) else 'postgres'
+        self.add('query', service, sql_table(sql) if sql else 'unknown')
+        return True
+
+    def detect_mongo(self, node, method, recv, recv_text):
+        if method not in MONGO_METHODS:
+            return False
+        collection = None
+        if isinstance(recv, ast.Name) and recv.id in self.collections:
+            collection = self.collections[recv.id]
+        elif isinstance(recv, ast.Attribute):
+            base = expr_text(recv.value).lower()
+            if any(h in base for h in MONGO_BASE_HINTS):
+                collection = recv.attr
+        else:
+            collection = self.collection_name(recv)
+        if collection is None and ('collection' in recv_text or 'mongo' in recv_text):
+            collection = 'unknown'
+        if collection is None:
+            return False
+        op_type = 'scan' if method in MONGO_SCAN_METHODS else 'query'
+        self.add(op_type, 'mongodb', collection)
+        return True
+
+    def detect_kafka(self, node, method, recv_text):
+        if not any(h in recv_text for h in KAFKA_HINTS):
+            return False
+        if method in KAFKA_PRODUCER_METHODS:
+            target = self.resolve_string(node.args[0]) if node.args else None
+            self.add(method, 'kafka', target if target else 'unknown')
+            return True
+        if method == 'subscribe':
+            topics = []
+            if node.args and isinstance(node.args[0], (ast.List, ast.Tuple)):
+                for element in node.args[0].elts:
+                    resolved = self.resolve_string(element)
+                    if resolved is not None:
+                        topics.append(resolved)
+            elif node.args:
+                resolved = self.resolve_string(node.args[0])
+                if resolved is not None:
+                    topics.append(resolved)
+            for topic in topics or ['unknown']:
+                self.add('subscribe', 'kafka', topic)
+            return True
+        return False
+
+    def detect_aws_client(self, node, method, recv, recv_text):
+        for service, methods, keys, hints in SERVICE_RULES:
+            if method not in methods:
+                continue
+            tracked = isinstance(recv, ast.Name) and self.boto_clients.get(recv.id) == service
+            target = self.kwarg(node, keys)
+            if tracked or target is not None or any(h in recv_text for h in hints):
+                self.add(method, service, short_name(target) if target else 'unknown')
+                return True
+        return False
+
+
+def find_py_files(root):
+    for dirpath, dirnames, filenames in os.walk(root):
+        dirnames[:] = [d for d in dirnames if d not in EXCLUDED_DIRS and not d.startswith('.')]
+        for f in filenames:
+            if f.endswith('.py'):
+                yield os.path.join(dirpath, f)
+
+
+def main():
+    root = os.path.abspath(sys.argv[1])
+    ops = []
+    for file_path in find_py_files(root):
+        try:
+            with open(file_path, 'r', encoding='utf-8', errors='replace') as fh:
+                tree = ast.parse(fh.read())
+        except SyntaxError:
+            continue
+        visitor = Visitor(file_path)
+        visitor.visit(tree)
+        ops.extend(visitor.ops)
+    print(json.dumps(ops))
+
+
+if __name__ == '__main__':
+    main()

package/dist/server/index.js

@@ -501,8 +501,7 @@ export function createMcpServer() {
         const indexNamesFor = (nodeId) => currentGraph.edges
             .filter((e) => e.from === nodeId && e.type === 'uses_index')
             .map((e) => currentGraph.nodes.find((n) => n.id === e.to))
-            .filter((n) => n?.type === 'index')
-            .map((n) => n.name);
+            .flatMap((n) => (n?.type === 'index' ? [n.name] : []));
         const results = tables.map((requested) => {
             const lower = requested.toLowerCase();
             const matches = tableNodes.filter((t) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "infrawise",
-  "version": "0.16.0",
+  "version": "0.17.0",
   "mcpName": "io.github.Sidd27/infrawise",
   "description": "CLI-first infrastructure intelligence platform — analyzes DynamoDB, PostgreSQL, MySQL, MongoDB, SQS, SNS, SSM, Secrets Manager, Lambda, S3, API Gateway, CloudWatch Logs and exposes findings as an MCP server for Claude Code",
   "keywords": [
@@ -56,7 +56,7 @@
   },
   "packageManager": "pnpm@10.14.0",
   "scripts": {
-    "build": "tsc --noEmit false --outDir dist",
+    "build": "tsc --noEmit false --outDir dist && cp src/context/scanner.py dist/context/scanner.py",
     "test": "vitest run --passWithNoTests",
     "coverage": "vitest run --coverage",
     "lint": "eslint src",