infrawise 0.16.1 → 0.18.0

package/README.md

@@ -185,7 +185,7 @@ Add to your editor's MCP config:
 | `get_queue_details`          | SQS queues — DLQ status, encryption, FIFO type, visibility timeout, message counts                          |
 | `get_api_routes`             | API Gateway APIs (REST, HTTP, WebSocket) — routes, HTTP methods, paths, and Lambda integrations             |
 | `get_topic_details`          | SNS topics — subscription counts, protocols, and filter policies (required message attributes per subscription) |
-| `get_secrets_overview`       | Secrets Manager — names and rotation status (values never included)                                         |
+| `get_secrets_overview`       | Secrets Manager — names, rotation status, and key names inferred from code (values never included)          |
 | `get_parameter_overview`     | SSM Parameter Store — names, types, tiers (values never included)                                           |
 | `get_lambda_overview`        | Lambda functions — runtime, memory, timeout, execution role ARN, triggers (SQS/SNS/DynamoDB/Kinesis/MSK/EventBridge/S3), env var key names |
 | `get_eventbridge_details`    | EventBridge rules — name, state, schedule/event pattern, target functions                                   |
@@ -427,10 +427,12 @@ Works from AWS APIs, database schema introspection, and IaC files — no depende
 | Runtime signals (opt-in)         | Lambda throttling/errors and stale queue messages from CloudWatch metrics                                          |
 | Terraform / CloudFormation / CDK | IaC drift vs deployed state; stack outputs and cross-stack exports                                                 |
 
-### Code correlation analysis (TypeScript / JavaScript)
+### Code correlation analysis (TypeScript / JavaScript / Python)
 
 Uses [ts-morph](https://ts-morph.com/) AST analysis to detect which functions call which tables and how:
 
+Python repositories are scanned with a bundled stdlib-`ast` scanner (requires `python3` on PATH; skipped with a warning otherwise): boto3 clients and `dynamodb.Table()` resources, `cursor.execute` SQL, pymongo collections, and kafka-python/confluent-kafka producers and consumers. Language detection is automatic — TypeScript and Python scans each run only when matching files exist.
+
 | Analyzer                   | Severity | What it detects                               |
 | -------------------------- | -------- | --------------------------------------------- |
 | Full Table Scan (DynamoDB) | High     | `.scan()` calls without filters               |
@@ -447,7 +449,7 @@ Uses [ts-morph](https://ts-morph.com/) AST analysis to detect which functions ca
 | Pipeline: repeated table access | Medium / Verify | Same table read by 2+ functions in one service pipeline |
 | Pipeline: missing DLQ hop  | Medium   | Mid-pipeline queue (has producer and consumer) with no Dead Letter Queue |
 
-Non-TypeScript/JavaScript projects still get full value from infrastructure-level analyzers — code correlation (function-to-table mapping, N+1 patterns) is skipped.
+Projects in other languages still get full value from infrastructure-level analyzers — code correlation (function-to-table mapping, N+1 patterns) currently supports TypeScript, JavaScript, and Python.
 
 The scanner supports: AWS SDK v3/v2 for DynamoDB, `pg`/Prisma/Knex for PostgreSQL, `mysql2`/Knex for MySQL, driver/Mongoose for MongoDB, AWS SDK v3 for SQS/SNS/SSM/Secrets/Lambda, and `kafkajs` for Kafka topics (producer/consumer).
 
@@ -498,7 +500,7 @@ src/
     db/         PostgreSQL, MySQL, MongoDB
     iac/        Terraform, CDK, CloudFormation (local file parsing)
   analyzers/    34 rule-based analyzers
-  context/      Repository scanner (ts-morph AST)
+  context/      Repository scanner (ts-morph AST + Python stdlib-ast subprocess)
   server/       Fastify MCP server (@modelcontextprotocol/sdk, Streamable HTTP)
   cli/          CLI commands (Commander.js)
 ```
@@ -507,7 +509,7 @@ src/
 
 ## Current limitations
 
-- Code-level correlation supports TypeScript and JavaScript only
+- Code-level correlation supports TypeScript, JavaScript, and Python (Python requires python3 on PATH)
 - Dynamically constructed queries may not always be resolved statically
 - Runtime tracing is not yet implemented
 - Large monorepos may require future incremental analysis optimization
@@ -516,7 +518,7 @@ src/
 
 ## Roadmap
 
-Feature roadmap is tracked in the [GitHub Project](https://github.com/users/Sidd27/projects/1). Feature requests and upvotes welcome.
+Feature roadmap is tracked in the [Infrawise v1](https://github.com/users/Sidd27/projects/1) project board. Feature requests and upvotes welcome.
 
 ---
 

package/dist/adapters/db/mongodb.js

@@ -90,9 +90,15 @@ export async function validateMongoAccess(connectionString) {
         serverSelectionTimeoutMS: 5000,
         connectTimeoutMS: 5000,
     });
+    // driver can exceed serverSelectionTimeoutMS when SYNs are dropped; hard-cap the probe
+    const deadline = new Promise((_, reject) => {
+        setTimeout(() => reject(new Error('validation timeout')), 6000).unref();
+    });
     try {
-        await client.connect();
-        await client.db('admin').command({ ping: 1 });
+        await Promise.race([
+            client.connect().then(() => client.db('admin').command({ ping: 1 })),
+            deadline,
+        ]);
         return true;
     }
     catch {

package/dist/context/index.js

@@ -2,6 +2,7 @@ import * as path from 'path';
 import * as fs from 'fs';
 import { Project, SyntaxKind, Node } from 'ts-morph';
 import { RepositoryScanError, logger } from '../core/index.js';
+import { scanPythonRepository } from './python.js';
 const DYNAMO_OPERATIONS = new Set([
     'query',
     'scan',
@@ -94,29 +95,76 @@ const PRISMA_METHODS = new Set([
     'deleteMany',
     'updateMany',
 ]);
-function getEnclosingFunctionName(node) {
+function getEnclosingFunction(node) {
     let current = node.getParent();
     while (current) {
         if (Node.isFunctionDeclaration(current) ||
             Node.isFunctionExpression(current) ||
             Node.isArrowFunction(current) ||
             Node.isMethodDeclaration(current)) {
-            if (Node.isFunctionDeclaration(current) || Node.isMethodDeclaration(current)) {
-                return current.getName() ?? '<anonymous>';
-            }
-            // Arrow function or function expression — check if assigned to a variable
-            const parent = current.getParent();
-            if (parent && Node.isVariableDeclaration(parent)) {
-                return parent.getName();
+            return current;
+        }
+        current = current.getParent();
+    }
+    return undefined;
+}
+function getEnclosingFunctionName(node) {
+    const current = getEnclosingFunction(node);
+    if (!current)
+        return '<module>';
+    if (Node.isFunctionDeclaration(current) || Node.isMethodDeclaration(current)) {
+        return current.getName() ?? '<anonymous>';
+    }
+    // Arrow function or function expression — check if assigned to a variable
+    const parent = current.getParent();
+    if (parent && Node.isVariableDeclaration(parent)) {
+        return parent.getName();
+    }
+    if (parent && Node.isPropertyAssignment(parent)) {
+        return parent.getName();
+    }
+    return '<anonymous>';
+}
+// Scans the enclosing function for JSON.parse(x.SecretString) usage and collects the property
+// names accessed on the parsed result — never the secret values themselves.
+function extractSecretKeys(func) {
+    if (!func)
+        return undefined;
+    const keys = new Set();
+    for (const call of func.getDescendantsOfKind(SyntaxKind.CallExpression)) {
+        const expr = call.getExpression();
+        if (!Node.isPropertyAccessExpression(expr) || expr.getName() !== 'parse')
+            continue;
+        if (expr.getExpression().getText() !== 'JSON')
+            continue;
+        const arg = call.getArguments()[0];
+        if (!arg || !arg.getText().includes('SecretString'))
+            continue;
+        const parent = call.getParent();
+        if (Node.isPropertyAccessExpression(parent) && parent.getExpression() === call) {
+            keys.add(parent.getName());
+            continue;
+        }
+        if (Node.isVariableDeclaration(parent)) {
+            const nameNode = parent.getNameNode();
+            if (Node.isObjectBindingPattern(nameNode)) {
+                for (const el of nameNode.getElements()) {
+                    const propName = el.getPropertyNameNode();
+                    keys.add(propName ? propName.getText() : el.getName());
+                }
+                continue;
             }
-            if (parent && Node.isPropertyAssignment(parent)) {
-                return parent.getName();
+            if (Node.isIdentifier(nameNode)) {
+                const varName = nameNode.getText();
+                for (const access of func.getDescendantsOfKind(SyntaxKind.PropertyAccessExpression)) {
+                    if (access.getExpression().getText() === varName) {
+                        keys.add(access.getName());
+                    }
+                }
             }
-            return '<anonymous>';
         }
-        current = current.getParent();
     }
-    return '<module>';
+    return keys.size > 0 ? Array.from(keys).sort() : undefined;
 }
 function extractTableNameFromArg(arg) {
     if (Node.isStringLiteral(arg)) {
@@ -504,6 +552,7 @@ function detectAWSServiceOperations(callExpr, filePath) {
                     serviceType: 'secretsmanager',
                     target: cmdArgs.length > 0 ? extractArgValue(cmdArgs[0], ...SECRETS_ARG_KEYS) : 'unknown',
                     filePath,
+                    keys: extractSecretKeys(getEnclosingFunction(callExpr)),
                 };
             }
             if (LAMBDA_COMMANDS.has(className)) {
@@ -557,6 +606,7 @@ function detectAWSServiceOperations(callExpr, filePath) {
                 serviceType: 'secretsmanager',
                 target: args.length > 0 ? extractArgValue(args[0], ...SECRETS_ARG_KEYS) : 'unknown',
                 filePath,
+                keys: extractSecretKeys(getEnclosingFunction(callExpr)),
             };
         }
         if (LAMBDA_COMMANDS.has(methodName) && (objText.includes('lambda') || objText.includes('fn'))) {
@@ -571,11 +621,58 @@ function detectAWSServiceOperations(callExpr, filePath) {
     }
     return null;
 }
+const PROBE_EXCLUDED_DIRS = new Set([
+    'node_modules',
+    'venv',
+    '.venv',
+    'site-packages',
+    '__pycache__',
+    'dist',
+]);
+function detectLanguages(root) {
+    let hasTypeScript = fs.existsSync(path.join(root, 'tsconfig.json'));
+    let hasPython = false;
+    const stack = [root];
+    while (stack.length > 0 && !(hasTypeScript && hasPython)) {
+        const dir = stack.pop();
+        if (dir === undefined)
+            break;
+        for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+            if (entry.isDirectory()) {
+                if (!PROBE_EXCLUDED_DIRS.has(entry.name) && !entry.name.startsWith('.')) {
+                    stack.push(path.join(dir, entry.name));
+                }
+            }
+            else if (entry.name.endsWith('.ts') || entry.name.endsWith('.tsx')) {
+                hasTypeScript = true;
+            }
+            else if (entry.name.endsWith('.py')) {
+                hasPython = true;
+            }
+            if (hasTypeScript && hasPython)
+                break;
+        }
+    }
+    return { hasTypeScript, hasPython };
+}
 export async function scanRepository(repoPath) {
     const resolvedPath = path.resolve(repoPath);
     if (!fs.existsSync(resolvedPath)) {
         throw new RepositoryScanError(`Path does not exist: ${resolvedPath}`);
     }
+    const { hasTypeScript, hasPython } = detectLanguages(resolvedPath);
+    const detected = [hasTypeScript && 'TypeScript', hasPython && 'Python'].filter(Boolean);
+    logger.info(`Detected languages: ${detected.length > 0 ? detected.join(', ') : 'none'}`);
+    const operations = [];
+    if (hasTypeScript) {
+        operations.push(...scanTypeScriptRepository(resolvedPath));
+    }
+    if (hasPython) {
+        operations.push(...(await scanPythonRepository(resolvedPath)));
+    }
+    return operations;
+}
+function scanTypeScriptRepository(resolvedPath) {
     const tsconfigPath = path.join(resolvedPath, 'tsconfig.json');
     const hasTsConfig = fs.existsSync(tsconfigPath);
     const project = new Project({

package/dist/context/python.js

@@ -0,0 +1,42 @@
+import { execFile } from 'child_process';
+import { promisify } from 'util';
+import * as path from 'path';
+import { fileURLToPath } from 'url';
+import { logger } from '../core/index.js';
+const execFileAsync = promisify(execFile);
+const SCANNER_PATH = path.join(path.dirname(fileURLToPath(import.meta.url)), 'scanner.py');
+let cachedInterpreter;
+async function findPythonInterpreter() {
+    if (cachedInterpreter !== undefined)
+        return cachedInterpreter;
+    for (const cmd of ['python3', 'python', 'py']) {
+        try {
+            await execFileAsync(cmd, ['--version']);
+            cachedInterpreter = cmd;
+            return cmd;
+        }
+        catch {
+            // try next candidate
+        }
+    }
+    cachedInterpreter = null;
+    return null;
+}
+export async function scanPythonRepository(repoPath) {
+    const interpreter = await findPythonInterpreter();
+    if (interpreter === null) {
+        logger.warn('Python files found but no python3 on PATH — skipping Python scan');
+        return [];
+    }
+    try {
+        const { stdout } = await execFileAsync(interpreter, [SCANNER_PATH, repoPath], {
+            maxBuffer: 64 * 1024 * 1024,
+        });
+        return JSON.parse(stdout);
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message.slice(0, 200) : String(err);
+        logger.warn(`Python scan failed — skipping (${message})`);
+        return [];
+    }
+}

package/dist/context/scanner.py

@@ -0,0 +1,380 @@
+import ast
+import json
+import os
+import re
+import sys
+
+EXCLUDED_DIRS = {'node_modules', 'venv', '.venv', 'site-packages', '__pycache__', 'dist'}
+
+SQS_METHODS = {'send_message', 'send_message_batch', 'receive_message', 'delete_message'}
+SNS_METHODS = {'publish', 'publish_batch'}
+SSM_METHODS = {'get_parameter', 'get_parameters', 'get_parameters_by_path'}
+SECRETS_METHODS = {'get_secret_value'}
+LAMBDA_METHODS = {'invoke', 'invoke_async'}
+DYNAMO_METHODS = {'query', 'scan', 'get_item', 'put_item', 'update_item', 'delete_item',
+                  'batch_get_item', 'batch_write_item'}
+SQL_METHODS = {'execute', 'executemany'}
+SQL_RECEIVER_HINTS = ('cursor', 'cur', 'conn', 'connection', 'session', 'db', 'pool',
+                      'pg', 'psycopg', 'asyncpg', 'engine', 'mysql', 'pymysql', 'maria')
+MYSQL_HINTS = ('mysql', 'pymysql', 'maria')
+SQL_TABLE_PATTERNS = [
+    re.compile(r'FROM\s+["\']?(\w+)["\']?', re.IGNORECASE),
+    re.compile(r'INTO\s+["\']?(\w+)["\']?', re.IGNORECASE),
+    re.compile(r'UPDATE\s+["\']?(\w+)["\']?', re.IGNORECASE),
+    re.compile(r'JOIN\s+["\']?(\w+)["\']?', re.IGNORECASE),
+]
+
+MONGO_METHODS = {'find', 'find_one', 'insert_one', 'insert_many', 'update_one', 'update_many',
+                 'delete_one', 'delete_many', 'aggregate', 'count_documents',
+                 'estimated_document_count'}
+MONGO_SCAN_METHODS = {'find', 'aggregate'}
+MONGO_BASE_HINTS = ('db', 'mongo')
+KAFKA_PRODUCER_METHODS = {'send', 'produce'}
+KAFKA_HINTS = ('kafka', 'producer', 'consumer')
+
+SERVICE_RULES = [
+    ('sqs', SQS_METHODS, ('QueueUrl', 'QueueName'), ('sqs', 'queue')),
+    ('sns', SNS_METHODS, ('TopicArn', 'TargetArn'), ('sns', 'topic')),
+    ('ssm', SSM_METHODS, ('Name', 'Path'), ('ssm', 'parameter')),
+    ('secretsmanager', SECRETS_METHODS, ('SecretId',), ('secret',)),
+    ('lambda', LAMBDA_METHODS, ('FunctionName',), ('lambda', 'fn')),
+]
+
+
+def expr_text(node):
+    if isinstance(node, ast.Name):
+        return node.id
+    if isinstance(node, ast.Attribute):
+        return expr_text(node.value) + '.' + node.attr
+    if isinstance(node, ast.Call):
+        return expr_text(node.func) + '()'
+    if isinstance(node, ast.Subscript):
+        return expr_text(node.value) + '[]'
+    return ''
+
+
+def short_name(val):
+    if val.startswith('http://') or val.startswith('https://'):
+        return val.rstrip('/').rsplit('/', 1)[-1]
+    if ':' in val:
+        return val.rsplit(':', 1)[-1]
+    return val
+
+
+def sql_table(sql):
+    for pattern in SQL_TABLE_PATTERNS:
+        match = pattern.search(sql)
+        if match:
+            return match.group(1)
+    return 'unknown'
+
+
+def const_str(node):
+    if isinstance(node, ast.Index):  # py3.8 compat
+        node = node.value
+    if isinstance(node, ast.Constant) and isinstance(node.value, str):
+        return node.value
+    return None
+
+
+def is_secret_string_ref(node):
+    if isinstance(node, ast.Attribute) and node.attr == 'SecretString':
+        return True
+    if isinstance(node, ast.Subscript):
+        return const_str(node.slice) == 'SecretString'
+    return False
+
+
+def is_json_loads_secret(node):
+    return (
+        isinstance(node, ast.Call)
+        and isinstance(node.func, ast.Attribute)
+        and node.func.attr == 'loads'
+        and expr_text(node.func.value) == 'json'
+        and node.args
+        and is_secret_string_ref(node.args[0])
+    )
+
+
+class Visitor(ast.NodeVisitor):
+    def __init__(self, file_path):
+        self.file_path = file_path
+        self.ops = []
+        self.stack = []
+        self.strings = {}
+        self.boto_clients = {}
+        self.dynamo_tables = {}
+        self.collections = {}
+
+    def function_name(self):
+        return self.stack[-1] if self.stack else '<module>'
+
+    def add(self, op_type, service, target):
+        self.ops.append({
+            'functionName': self.function_name(),
+            'operationType': op_type,
+            'serviceType': service,
+            'target': target,
+            'filePath': self.file_path,
+        })
+
+    def visit_FunctionDef(self, node):
+        self.stack.append(node.name)
+        start = len(self.ops)
+        self.generic_visit(node)
+        keys = self.find_secret_keys(node)
+        if keys:
+            for op in self.ops[start:]:
+                if op['serviceType'] == 'secretsmanager':
+                    op['keys'] = keys
+        self.stack.pop()
+
+    visit_AsyncFunctionDef = visit_FunctionDef
+
+    # Finds json.loads(x['SecretString']) usage in this function and collects the key names
+    # accessed on the parsed result (via subscript or .get) — never the secret values.
+    def find_secret_keys(self, func_node):
+        keys = set()
+        tracked_vars = set()
+
+        for n in ast.walk(func_node):
+            if isinstance(n, ast.Assign) and len(n.targets) == 1 and isinstance(n.targets[0], ast.Name):
+                if is_json_loads_secret(n.value):
+                    tracked_vars.add(n.targets[0].id)
+                elif isinstance(n.value, ast.Subscript) and is_json_loads_secret(n.value.value):
+                    key = const_str(n.value.slice)
+                    if key:
+                        keys.add(key)
+
+        if not tracked_vars:
+            return sorted(keys)
+
+        for n in ast.walk(func_node):
+            if isinstance(n, ast.Subscript) and isinstance(n.value, ast.Name) and n.value.id in tracked_vars:
+                key = const_str(n.slice)
+                if key:
+                    keys.add(key)
+            elif (
+                isinstance(n, ast.Call)
+                and isinstance(n.func, ast.Attribute)
+                and n.func.attr == 'get'
+                and isinstance(n.func.value, ast.Name)
+                and n.func.value.id in tracked_vars
+                and n.args
+            ):
+                key = const_str(n.args[0])
+                if key:
+                    keys.add(key)
+
+        return sorted(keys)
+
+    def resolve_string(self, node):
+        if isinstance(node, ast.Constant) and isinstance(node.value, str):
+            return node.value
+        if isinstance(node, ast.Name):
+            return self.strings.get(node.id)
+        if isinstance(node, ast.JoinedStr):
+            parts = []
+            for value in node.values:
+                if isinstance(value, ast.Constant) and isinstance(value.value, str):
+                    parts.append(value.value)
+                elif isinstance(value, ast.FormattedValue):
+                    resolved = self.resolve_string(value.value)
+                    if resolved is None:
+                        return None
+                    parts.append(resolved)
+                else:
+                    return None
+            return ''.join(parts)
+        return None
+
+    def kwarg(self, node, keys):
+        for kw in node.keywords:
+            if kw.arg in keys:
+                return self.resolve_string(kw.value)
+        return None
+
+    def boto3_service(self, node):
+        if (
+            isinstance(node, ast.Call)
+            and isinstance(node.func, ast.Attribute)
+            and node.func.attr in ('client', 'resource')
+            and expr_text(node.func.value) == 'boto3'
+            and node.args
+        ):
+            return self.resolve_string(node.args[0])
+        return None
+
+    def table_name(self, node):
+        if (
+            isinstance(node, ast.Call)
+            and isinstance(node.func, ast.Attribute)
+            and node.func.attr == 'Table'
+            and node.args
+        ):
+            return self.resolve_string(node.args[0])
+        return None
+
+    def collection_name(self, node):
+        if isinstance(node, ast.Subscript):
+            base = expr_text(node.value).lower()
+            if any(h in base for h in MONGO_BASE_HINTS):
+                return self.resolve_string(node.slice)
+        if (
+            isinstance(node, ast.Call)
+            and isinstance(node.func, ast.Attribute)
+            and node.func.attr == 'get_collection'
+            and node.args
+        ):
+            return self.resolve_string(node.args[0])
+        return None
+
+    def visit_Assign(self, node):
+        if len(node.targets) == 1 and isinstance(node.targets[0], ast.Name):
+            name = node.targets[0].id
+            resolved = self.resolve_string(node.value)
+            if resolved is not None:
+                self.strings[name] = resolved
+            else:
+                service = self.boto3_service(node.value)
+                table = self.table_name(node.value)
+                collection = self.collection_name(node.value)
+                if service is not None:
+                    self.boto_clients[name] = service
+                elif table is not None:
+                    self.dynamo_tables[name] = table
+                elif collection is not None:
+                    self.collections[name] = collection
+        self.generic_visit(node)
+
+    def visit_Call(self, node):
+        if isinstance(node.func, ast.Attribute):
+            method = node.func.attr
+            recv = node.func.value
+            recv_text = expr_text(recv).lower()
+            _ = (
+                self.detect_dynamo(node, method, recv, recv_text)
+                or self.detect_sql(node, method, recv_text)
+                or self.detect_mongo(node, method, recv, recv_text)
+                or self.detect_kafka(node, method, recv_text)
+                or self.detect_aws_client(node, method, recv, recv_text)
+            )
+        self.generic_visit(node)
+
+    def detect_dynamo(self, node, method, recv, recv_text):
+        if method not in DYNAMO_METHODS:
+            return False
+        if isinstance(recv, ast.Name) and recv.id in self.dynamo_tables:
+            self.add(method, 'dynamodb', self.dynamo_tables[recv.id])
+            return True
+        inline = self.table_name(recv)
+        if inline is not None:
+            self.add(method, 'dynamodb', inline)
+            return True
+        kw = self.kwarg(node, ('TableName',))
+        tracked = isinstance(recv, ast.Name) and self.boto_clients.get(recv.id) == 'dynamodb'
+        if kw is not None or tracked or 'dynamo' in recv_text or 'ddb' in recv_text:
+            self.add(method, 'dynamodb', kw if kw else 'unknown')
+            return True
+        return False
+
+    def detect_sql(self, node, method, recv_text):
+        if method not in SQL_METHODS:
+            return False
+        if not any(h in recv_text for h in SQL_RECEIVER_HINTS):
+            return False
+        sql = None
+        if node.args:
+            arg = node.args[0]
+            if (
+                isinstance(arg, ast.Call)
+                and isinstance(arg.func, ast.Name)
+                and arg.func.id == 'text'
+                and arg.args
+            ):
+                arg = arg.args[0]
+            sql = self.resolve_string(arg)
+        service = 'mysql' if any(h in recv_text for h in MYSQL_HINTS) else 'postgres'
+        self.add('query', service, sql_table(sql) if sql else 'unknown')
+        return True
+
+    def detect_mongo(self, node, method, recv, recv_text):
+        if method not in MONGO_METHODS:
+            return False
+        collection = None
+        if isinstance(recv, ast.Name) and recv.id in self.collections:
+            collection = self.collections[recv.id]
+        elif isinstance(recv, ast.Attribute):
+            base = expr_text(recv.value).lower()
+            if any(h in base for h in MONGO_BASE_HINTS):
+                collection = recv.attr
+        else:
+            collection = self.collection_name(recv)
+        if collection is None and ('collection' in recv_text or 'mongo' in recv_text):
+            collection = 'unknown'
+        if collection is None:
+            return False
+        op_type = 'scan' if method in MONGO_SCAN_METHODS else 'query'
+        self.add(op_type, 'mongodb', collection)
+        return True
+
+    def detect_kafka(self, node, method, recv_text):
+        if not any(h in recv_text for h in KAFKA_HINTS):
+            return False
+        if method in KAFKA_PRODUCER_METHODS:
+            target = self.resolve_string(node.args[0]) if node.args else None
+            self.add(method, 'kafka', target if target else 'unknown')
+            return True
+        if method == 'subscribe':
+            topics = []
+            if node.args and isinstance(node.args[0], (ast.List, ast.Tuple)):
+                for element in node.args[0].elts:
+                    resolved = self.resolve_string(element)
+                    if resolved is not None:
+                        topics.append(resolved)
+            elif node.args:
+                resolved = self.resolve_string(node.args[0])
+                if resolved is not None:
+                    topics.append(resolved)
+            for topic in topics or ['unknown']:
+                self.add('subscribe', 'kafka', topic)
+            return True
+        return False
+
+    def detect_aws_client(self, node, method, recv, recv_text):
+        for service, methods, keys, hints in SERVICE_RULES:
+            if method not in methods:
+                continue
+            tracked = isinstance(recv, ast.Name) and self.boto_clients.get(recv.id) == service
+            target = self.kwarg(node, keys)
+            if tracked or target is not None or any(h in recv_text for h in hints):
+                self.add(method, service, short_name(target) if target else 'unknown')
+                return True
+        return False
+
+
+def find_py_files(root):
+    for dirpath, dirnames, filenames in os.walk(root):
+        dirnames[:] = [d for d in dirnames if d not in EXCLUDED_DIRS and not d.startswith('.')]
+        for f in filenames:
+            if f.endswith('.py'):
+                yield os.path.join(dirpath, f)
+
+
+def main():
+    root = os.path.abspath(sys.argv[1])
+    ops = []
+    for file_path in find_py_files(root):
+        try:
+            with open(file_path, 'r', encoding='utf-8', errors='replace') as fh:
+                tree = ast.parse(fh.read())
+        except SyntaxError:
+            continue
+        visitor = Visitor(file_path)
+        visitor.visit(tree)
+        ops.extend(visitor.ops)
+    print(json.dumps(ops))
+
+
+if __name__ == '__main__':
+    main()

package/dist/graph/index.js

@@ -386,6 +386,12 @@ export function buildGraph(operations, dynamoMeta, postgresMeta, mysqlMeta = [],
                 provider: 'aws',
                 rotationEnabled: false,
             });
+            if (op.keys && op.keys.length > 0) {
+                const node = nodeMap.get(secretId);
+                if (node && node.type === 'secret') {
+                    node.referencedKeys = Array.from(new Set([...(node.referencedKeys ?? []), ...op.keys])).sort();
+                }
+            }
             edges.push({ from: funcNodeId, to: secretId, type: 'reads_secret' });
             continue;
         }

package/dist/server/index.js

@@ -344,7 +344,7 @@ export function createMcpServer() {
         });
     }));
     mcp.registerTool('get_secrets_overview', {
-        description: 'Returns all Secrets Manager secrets with rotation status and rotation interval. Secret values are never returned. Call this when checking which secrets exist, confirming rotation is enabled before a security review, or identifying secrets that lack rotation.',
+        description: 'Returns all Secrets Manager secrets with rotation status, rotation interval, and referencedKeys — key names (e.g. "password", "apiKey") inferred from application code that parses the secret, never the values. Call this when checking which secrets exist, confirming rotation is enabled before a security review, or before writing code that reads a secret so you use the correct key name instead of guessing.',
         inputSchema: z.object({}),
     }, logged('get_secrets_overview', async () => {
         const secrets = getSecretNodes(currentGraph);
@@ -357,6 +357,7 @@ export function createMcpServer() {
                 provider: s.provider,
                 rotationEnabled: s.rotationEnabled,
                 rotationDays: s.rotationDays,
+                referencedKeys: s.referencedKeys ?? [],
                 findings: secretFindings
                     .filter((f) => f.metadata.secretName === s.name)
                     .map((f) => ({ severity: f.severity, issue: f.issue })),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "infrawise",
-  "version": "0.16.1",
+  "version": "0.18.0",
   "mcpName": "io.github.Sidd27/infrawise",
   "description": "CLI-first infrastructure intelligence platform — analyzes DynamoDB, PostgreSQL, MySQL, MongoDB, SQS, SNS, SSM, Secrets Manager, Lambda, S3, API Gateway, CloudWatch Logs and exposes findings as an MCP server for Claude Code",
   "keywords": [
@@ -56,7 +56,7 @@
   },
   "packageManager": "pnpm@10.14.0",
   "scripts": {
-    "build": "tsc --noEmit false --outDir dist",
+    "build": "tsc --noEmit false --outDir dist && cp src/context/scanner.py dist/context/scanner.py",
     "test": "vitest run --passWithNoTests",
     "coverage": "vitest run --coverage",
     "lint": "eslint src",