infrawise 0.17.0 → 0.18.0

package/README.md

@@ -185,7 +185,7 @@ Add to your editor's MCP config:
 | `get_queue_details`          | SQS queues — DLQ status, encryption, FIFO type, visibility timeout, message counts                          |
 | `get_api_routes`             | API Gateway APIs (REST, HTTP, WebSocket) — routes, HTTP methods, paths, and Lambda integrations             |
 | `get_topic_details`          | SNS topics — subscription counts, protocols, and filter policies (required message attributes per subscription) |
-| `get_secrets_overview`       | Secrets Manager — names and rotation status (values never included)                                         |
+| `get_secrets_overview`       | Secrets Manager — names, rotation status, and key names inferred from code (values never included)          |
 | `get_parameter_overview`     | SSM Parameter Store — names, types, tiers (values never included)                                           |
 | `get_lambda_overview`        | Lambda functions — runtime, memory, timeout, execution role ARN, triggers (SQS/SNS/DynamoDB/Kinesis/MSK/EventBridge/S3), env var key names |
 | `get_eventbridge_details`    | EventBridge rules — name, state, schedule/event pattern, target functions                                   |
@@ -518,7 +518,7 @@ src/
 
 ## Roadmap
 
-Feature roadmap is tracked in the [GitHub Project](https://github.com/users/Sidd27/projects/1). Feature requests and upvotes welcome.
+Feature roadmap is tracked in the [Infrawise v1](https://github.com/users/Sidd27/projects/1) project board. Feature requests and upvotes welcome.
 
 ---
 

package/dist/context/index.js

@@ -95,29 +95,76 @@ const PRISMA_METHODS = new Set([
     'deleteMany',
     'updateMany',
 ]);
-function getEnclosingFunctionName(node) {
+function getEnclosingFunction(node) {
     let current = node.getParent();
     while (current) {
         if (Node.isFunctionDeclaration(current) ||
             Node.isFunctionExpression(current) ||
             Node.isArrowFunction(current) ||
             Node.isMethodDeclaration(current)) {
-            if (Node.isFunctionDeclaration(current) || Node.isMethodDeclaration(current)) {
-                return current.getName() ?? '<anonymous>';
-            }
-            // Arrow function or function expression — check if assigned to a variable
-            const parent = current.getParent();
-            if (parent && Node.isVariableDeclaration(parent)) {
-                return parent.getName();
+            return current;
+        }
+        current = current.getParent();
+    }
+    return undefined;
+}
+function getEnclosingFunctionName(node) {
+    const current = getEnclosingFunction(node);
+    if (!current)
+        return '<module>';
+    if (Node.isFunctionDeclaration(current) || Node.isMethodDeclaration(current)) {
+        return current.getName() ?? '<anonymous>';
+    }
+    // Arrow function or function expression — check if assigned to a variable
+    const parent = current.getParent();
+    if (parent && Node.isVariableDeclaration(parent)) {
+        return parent.getName();
+    }
+    if (parent && Node.isPropertyAssignment(parent)) {
+        return parent.getName();
+    }
+    return '<anonymous>';
+}
+// Scans the enclosing function for JSON.parse(x.SecretString) usage and collects the property
+// names accessed on the parsed result — never the secret values themselves.
+function extractSecretKeys(func) {
+    if (!func)
+        return undefined;
+    const keys = new Set();
+    for (const call of func.getDescendantsOfKind(SyntaxKind.CallExpression)) {
+        const expr = call.getExpression();
+        if (!Node.isPropertyAccessExpression(expr) || expr.getName() !== 'parse')
+            continue;
+        if (expr.getExpression().getText() !== 'JSON')
+            continue;
+        const arg = call.getArguments()[0];
+        if (!arg || !arg.getText().includes('SecretString'))
+            continue;
+        const parent = call.getParent();
+        if (Node.isPropertyAccessExpression(parent) && parent.getExpression() === call) {
+            keys.add(parent.getName());
+            continue;
+        }
+        if (Node.isVariableDeclaration(parent)) {
+            const nameNode = parent.getNameNode();
+            if (Node.isObjectBindingPattern(nameNode)) {
+                for (const el of nameNode.getElements()) {
+                    const propName = el.getPropertyNameNode();
+                    keys.add(propName ? propName.getText() : el.getName());
+                }
+                continue;
             }
-            if (parent && Node.isPropertyAssignment(parent)) {
-                return parent.getName();
+            if (Node.isIdentifier(nameNode)) {
+                const varName = nameNode.getText();
+                for (const access of func.getDescendantsOfKind(SyntaxKind.PropertyAccessExpression)) {
+                    if (access.getExpression().getText() === varName) {
+                        keys.add(access.getName());
+                    }
+                }
             }
-            return '<anonymous>';
         }
-        current = current.getParent();
     }
-    return '<module>';
+    return keys.size > 0 ? Array.from(keys).sort() : undefined;
 }
 function extractTableNameFromArg(arg) {
     if (Node.isStringLiteral(arg)) {
@@ -505,6 +552,7 @@ function detectAWSServiceOperations(callExpr, filePath) {
                     serviceType: 'secretsmanager',
                     target: cmdArgs.length > 0 ? extractArgValue(cmdArgs[0], ...SECRETS_ARG_KEYS) : 'unknown',
                     filePath,
+                    keys: extractSecretKeys(getEnclosingFunction(callExpr)),
                 };
             }
             if (LAMBDA_COMMANDS.has(className)) {
@@ -558,6 +606,7 @@ function detectAWSServiceOperations(callExpr, filePath) {
                 serviceType: 'secretsmanager',
                 target: args.length > 0 ? extractArgValue(args[0], ...SECRETS_ARG_KEYS) : 'unknown',
                 filePath,
+                keys: extractSecretKeys(getEnclosingFunction(callExpr)),
             };
         }
         if (LAMBDA_COMMANDS.has(methodName) && (objText.includes('lambda') || objText.includes('fn'))) {
@@ -586,6 +635,8 @@ function detectLanguages(root) {
     const stack = [root];
     while (stack.length > 0 && !(hasTypeScript && hasPython)) {
         const dir = stack.pop();
+        if (dir === undefined)
+            break;
         for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
             if (entry.isDirectory()) {
                 if (!PROBE_EXCLUDED_DIRS.has(entry.name) && !entry.name.startsWith('.')) {

package/dist/context/scanner.py

@@ -69,6 +69,33 @@ def sql_table(sql):
     return 'unknown'
 
 
+def const_str(node):
+    if isinstance(node, ast.Index):  # py3.8 compat
+        node = node.value
+    if isinstance(node, ast.Constant) and isinstance(node.value, str):
+        return node.value
+    return None
+
+
+def is_secret_string_ref(node):
+    if isinstance(node, ast.Attribute) and node.attr == 'SecretString':
+        return True
+    if isinstance(node, ast.Subscript):
+        return const_str(node.slice) == 'SecretString'
+    return False
+
+
+def is_json_loads_secret(node):
+    return (
+        isinstance(node, ast.Call)
+        and isinstance(node.func, ast.Attribute)
+        and node.func.attr == 'loads'
+        and expr_text(node.func.value) == 'json'
+        and node.args
+        and is_secret_string_ref(node.args[0])
+    )
+
+
 class Visitor(ast.NodeVisitor):
     def __init__(self, file_path):
         self.file_path = file_path
@@ -93,11 +120,54 @@ class Visitor(ast.NodeVisitor):
 
     def visit_FunctionDef(self, node):
         self.stack.append(node.name)
+        start = len(self.ops)
         self.generic_visit(node)
+        keys = self.find_secret_keys(node)
+        if keys:
+            for op in self.ops[start:]:
+                if op['serviceType'] == 'secretsmanager':
+                    op['keys'] = keys
         self.stack.pop()
 
     visit_AsyncFunctionDef = visit_FunctionDef
 
+    # Finds json.loads(x['SecretString']) usage in this function and collects the key names
+    # accessed on the parsed result (via subscript or .get) — never the secret values.
+    def find_secret_keys(self, func_node):
+        keys = set()
+        tracked_vars = set()
+
+        for n in ast.walk(func_node):
+            if isinstance(n, ast.Assign) and len(n.targets) == 1 and isinstance(n.targets[0], ast.Name):
+                if is_json_loads_secret(n.value):
+                    tracked_vars.add(n.targets[0].id)
+                elif isinstance(n.value, ast.Subscript) and is_json_loads_secret(n.value.value):
+                    key = const_str(n.value.slice)
+                    if key:
+                        keys.add(key)
+
+        if not tracked_vars:
+            return sorted(keys)
+
+        for n in ast.walk(func_node):
+            if isinstance(n, ast.Subscript) and isinstance(n.value, ast.Name) and n.value.id in tracked_vars:
+                key = const_str(n.slice)
+                if key:
+                    keys.add(key)
+            elif (
+                isinstance(n, ast.Call)
+                and isinstance(n.func, ast.Attribute)
+                and n.func.attr == 'get'
+                and isinstance(n.func.value, ast.Name)
+                and n.func.value.id in tracked_vars
+                and n.args
+            ):
+                key = const_str(n.args[0])
+                if key:
+                    keys.add(key)
+
+        return sorted(keys)
+
     def resolve_string(self, node):
         if isinstance(node, ast.Constant) and isinstance(node.value, str):
             return node.value

package/dist/graph/index.js

@@ -386,6 +386,12 @@ export function buildGraph(operations, dynamoMeta, postgresMeta, mysqlMeta = [],
                 provider: 'aws',
                 rotationEnabled: false,
             });
+            if (op.keys && op.keys.length > 0) {
+                const node = nodeMap.get(secretId);
+                if (node && node.type === 'secret') {
+                    node.referencedKeys = Array.from(new Set([...(node.referencedKeys ?? []), ...op.keys])).sort();
+                }
+            }
             edges.push({ from: funcNodeId, to: secretId, type: 'reads_secret' });
             continue;
         }

package/dist/server/index.js

@@ -344,7 +344,7 @@ export function createMcpServer() {
         });
     }));
     mcp.registerTool('get_secrets_overview', {
-        description: 'Returns all Secrets Manager secrets with rotation status and rotation interval. Secret values are never returned. Call this when checking which secrets exist, confirming rotation is enabled before a security review, or identifying secrets that lack rotation.',
+        description: 'Returns all Secrets Manager secrets with rotation status, rotation interval, and referencedKeys — key names (e.g. "password", "apiKey") inferred from application code that parses the secret, never the values. Call this when checking which secrets exist, confirming rotation is enabled before a security review, or before writing code that reads a secret so you use the correct key name instead of guessing.',
         inputSchema: z.object({}),
     }, logged('get_secrets_overview', async () => {
         const secrets = getSecretNodes(currentGraph);
@@ -357,6 +357,7 @@ export function createMcpServer() {
                 provider: s.provider,
                 rotationEnabled: s.rotationEnabled,
                 rotationDays: s.rotationDays,
+                referencedKeys: s.referencedKeys ?? [],
                 findings: secretFindings
                     .filter((f) => f.metadata.secretName === s.name)
                     .map((f) => ({ severity: f.severity, issue: f.issue })),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "infrawise",
-  "version": "0.17.0",
+  "version": "0.18.0",
   "mcpName": "io.github.Sidd27/infrawise",
   "description": "CLI-first infrastructure intelligence platform — analyzes DynamoDB, PostgreSQL, MySQL, MongoDB, SQS, SNS, SSM, Secrets Manager, Lambda, S3, API Gateway, CloudWatch Logs and exposes findings as an MCP server for Claude Code",
   "keywords": [