infrawise 0.17.0 → 0.19.0

package/README.md

@@ -176,7 +176,7 @@ Add to your editor's MCP config:
 | ---------------------------- | ----------------------------------------------------------------------------------------------------------- |
 | `get_infra_overview`         | Complete snapshot — services, counts, high-severity findings, analysis `freshness` (age + stale flag), `configured` flag |
 | `get_graph_summary`          | Full infrastructure graph — all nodes, edges, and findings                                                  |
-| `get_table_schema`           | Column-level schema for named tables/collections — types, PKs, FKs, indexes, DynamoDB keys (no row data)    |
+| `get_table_schema`           | Column-level schema for named tables/collections — types, PKs, FKs, indexes, DynamoDB keys/billing mode, cost signal (no row data) |
 | `analyze_function`           | Issues in a specific function — scans, missing indexes, N+1, trigger event shapes, missing IAM permissions  |
 | `suggest_gsi`                | Exact GSI config for a DynamoDB table + attribute                                                           |
 | `postgres_index_suggestions` | Exact `CREATE INDEX` SQL for your actual table                                                              |
@@ -185,16 +185,16 @@ Add to your editor's MCP config:
 | `get_queue_details`          | SQS queues — DLQ status, encryption, FIFO type, visibility timeout, message counts                          |
 | `get_api_routes`             | API Gateway APIs (REST, HTTP, WebSocket) — routes, HTTP methods, paths, and Lambda integrations             |
 | `get_topic_details`          | SNS topics — subscription counts, protocols, and filter policies (required message attributes per subscription) |
-| `get_secrets_overview`       | Secrets Manager — names and rotation status (values never included)                                         |
+| `get_secrets_overview`       | Secrets Manager — names, rotation status, and key names inferred from code (values never included)          |
 | `get_parameter_overview`     | SSM Parameter Store — names, types, tiers (values never included)                                           |
-| `get_lambda_overview`        | Lambda functions — runtime, memory, timeout, execution role ARN, triggers (SQS/SNS/DynamoDB/Kinesis/MSK/EventBridge/S3), env var key names |
+| `get_lambda_overview`        | Lambda functions — runtime, memory, timeout, execution role ARN, triggers (SQS/SNS/DynamoDB/Kinesis/MSK/EventBridge/S3), env var key names, cost signal |
 | `get_eventbridge_details`    | EventBridge rules — name, state, schedule/event pattern, target functions                                   |
 | `get_s3_overview`            | S3 buckets — versioning, encryption, public access, event notifications                                     |
 | `get_log_errors`             | CloudWatch error patterns and counts (no raw log messages)                                                  |
 | `get_stack_outputs`          | Stack outputs and cross-stack exports parsed from local IaC files (Terraform outputs, CFN/CDK Outputs)      |
 | `get_cognito_overview`       | Cognito user pools — MFA config, app client auth flows, OAuth settings, token validity (secrets never included) |
 | `get_stream_details`         | Kinesis streams (shards, retention, capacity mode) and MSK clusters (state, Kafka version, brokers)          |
-| `get_cache_overview`         | ElastiCache clusters — engine, encryption in transit/at rest, replication group, failover (data never read)  |
+| `get_cache_overview`         | ElastiCache clusters — engine, encryption in transit/at rest, replication group, failover, cost signal (data never read) |
 
 ---
 
@@ -408,22 +408,22 @@ Works from AWS APIs, database schema introspection, and IaC files — no depende
 
 | Service                          | What it checks                                                                                                     |
 | -------------------------------- | ------------------------------------------------------------------------------------------------------------------ |
-| DynamoDB schema                  | Tables, GSIs, partition keys                                                                                       |
+| DynamoDB schema                  | Tables, GSIs, partition keys, billing mode, cost signal (provisioned capacity)                                     |
 | PostgreSQL / MySQL schema        | Tables, indexes, column types                                                                                      |
 | MongoDB schema                   | Collections, indexes                                                                                               |
 | SQS                              | Missing DLQs, unencrypted queues, large backlogs, FIFO detection, visibility timeout vs Lambda timeout mismatch    |
 | SNS                              | Subscription filter policies — required message attributes per subscription                                        |
 | Apache Kafka (kafkajs)           | Producer/consumer topic mapping from code — any broker (self-hosted, Confluent, Redpanda, MSK); distinct from the MSK Lambda trigger |
 | Secrets Manager                  | Missing secret rotation                                                                                            |
-| Lambda                           | Default memory (128 MB), high timeouts, triggers (SQS/SNS/DynamoDB/Kinesis/MSK/EventBridge/S3), missing DLQ on trigger source |
+| Lambda                           | Default memory (128 MB), high timeouts, triggers (SQS/SNS/DynamoDB/Kinesis/MSK/EventBridge/S3), missing DLQ on trigger source, cost signal (high memory with no throttling evidence) |
 | S3                               | Public access blocking (verify), missing versioning, missing encryption                                            |
 | EventBridge                      | Rules, schedules, event patterns, target Lambda functions                                                          |
 | API Gateway                      | REST, HTTP, and WebSocket APIs — routes, methods, Lambda integrations                                             |
-| RDS                              | Publicly accessible, no backups, unencrypted, no deletion protection, single-AZ                                    |
+| RDS                              | Publicly accessible, no backups, unencrypted, no deletion protection, single-AZ, cost signal (Multi-AZ on a non-production-looking instance) |
 | CloudWatch Logs                  | Log groups with no retention policy                                                                                |
 | Cognito                          | User pools and app client config — auth flows, OAuth settings, token validity, client secret presence              |
 | Kinesis / MSK                    | Streams (shards, retention, capacity mode) and MSK clusters (state, Kafka version, brokers)                        |
-| ElastiCache                      | Missing in-transit encryption, single-node clusters with no replication                                            |
+| ElastiCache                      | Missing in-transit encryption, single-node clusters with no replication, cost signal (more than 3 nodes)           |
 | Runtime signals (opt-in)         | Lambda throttling/errors and stale queue messages from CloudWatch metrics                                          |
 | Terraform / CloudFormation / CDK | IaC drift vs deployed state; stack outputs and cross-stack exports                                                 |
 
@@ -499,7 +499,7 @@ src/
     aws/        DynamoDB, S3, Lambda, SQS/SNS/SSM/Secrets/EventBridge/RDS/APIGateway, CloudWatch
     db/         PostgreSQL, MySQL, MongoDB
     iac/        Terraform, CDK, CloudFormation (local file parsing)
-  analyzers/    34 rule-based analyzers
+  analyzers/    36 rule-based analyzers
   context/      Repository scanner (ts-morph AST + Python stdlib-ast subprocess)
   server/       Fastify MCP server (@modelcontextprotocol/sdk, Streamable HTTP)
   cli/          CLI commands (Commander.js)
@@ -518,7 +518,7 @@ src/
 
 ## Roadmap
 
-Feature roadmap is tracked in the [GitHub Project](https://github.com/users/Sidd27/projects/1). Feature requests and upvotes welcome.
+Feature roadmap is tracked in the [Infrawise v1](https://github.com/users/Sidd27/projects/1) project board. Feature requests and upvotes welcome.
 
 ---
 

package/dist/adapters/aws/dynamodb.js

@@ -28,7 +28,15 @@ function parseTableDescription(desc) {
                 indexes.push(lsi.IndexName);
         }
     }
-    return { tableName, partitionKey, sortKey, indexes };
+    const billingMode = desc.BillingModeSummary?.BillingMode;
+    const provisionedThroughput = desc.ProvisionedThroughput?.ReadCapacityUnits !== undefined &&
+        desc.ProvisionedThroughput?.WriteCapacityUnits !== undefined
+        ? {
+            readCapacityUnits: desc.ProvisionedThroughput.ReadCapacityUnits,
+            writeCapacityUnits: desc.ProvisionedThroughput.WriteCapacityUnits,
+        }
+        : undefined;
+    return { tableName, partitionKey, sortKey, indexes, billingMode, provisionedThroughput };
 }
 async function listAllTables(client) {
     const tableNames = [];

package/dist/analyzers/cost-signals.js

@@ -0,0 +1,70 @@
+// ─── Cost signals ────────────────────────────────────────────────────────────
+// No billing API involved — every signal here is derived from resource specs
+// already extracted (config-level heuristics, not real utilization data).
+const HIGH_MEMORY_MB = 3008;
+const NON_PROD_NAME = /dev|staging|test|sandbox/i;
+const MANY_CACHE_NODES = 3;
+export class LambdaHighMemoryAnalyzer {
+    name = 'LambdaHighMemoryAnalyzer';
+    async analyze(graph) {
+        const findings = [];
+        for (const node of graph.nodes) {
+            if (node.type !== 'lambda')
+                continue;
+            if ((node.memoryMB ?? 0) < HIGH_MEMORY_MB)
+                continue;
+            if (node.recentThrottles !== 0)
+                continue;
+            findings.push({
+                severity: 'low',
+                issue: `Lambda "${node.name}" has high memory (${node.memoryMB} MB) with zero recent throttles`,
+                description: `"${node.name}" is allocated ${node.memoryMB} MB with no recent throttling, which is one signal (not proof) that it may be over-provisioned. AWS Lambda pricing is duration × memory.`,
+                recommendation: `Run Lambda Power Tuning on "${node.name}" to find the cost-optimal memory size for its actual workload.`,
+                metadata: { functionName: node.name, memoryMB: node.memoryMB },
+            });
+        }
+        return findings;
+    }
+}
+export class RDSMultiAZNonProdAnalyzer {
+    name = 'RDSMultiAZNonProdAnalyzer';
+    async analyze(graph) {
+        const findings = [];
+        for (const node of graph.nodes) {
+            if (node.type !== 'database_instance')
+                continue;
+            if (!node.multiAZ)
+                continue;
+            if (!NON_PROD_NAME.test(node.name))
+                continue;
+            findings.push({
+                severity: 'low',
+                issue: `RDS instance "${node.name}" has Multi-AZ enabled on what looks like a non-production instance`,
+                description: `"${node.name}" has Multi-AZ enabled, which roughly doubles RDS cost by running a standby replica. The name suggests a non-production instance, where Multi-AZ is often unnecessary.`,
+                recommendation: `If "${node.name}" is not production, disable Multi-AZ to cut its cost roughly in half.`,
+                metadata: { dbInstanceIdentifier: node.name, engine: node.engine },
+            });
+        }
+        return findings;
+    }
+}
+/** Advisory only — no Finding, since there's no runtime-signal evidence either way. */
+export function lambdaCostSignal(node) {
+    if ((node.memoryMB ?? 0) < HIGH_MEMORY_MB)
+        return undefined;
+    if (node.recentThrottles !== undefined)
+        return undefined; // covered by LambdaHighMemoryAnalyzer's Finding when signals are on
+    return `${node.memoryMB} MB memory allocated; verify this matches actual workload needs — Lambda Power Tuning can find the cost-optimal size.`;
+}
+export function dynamoCostSignal(node) {
+    if (node.databaseType !== 'dynamodb')
+        return undefined;
+    if (node.billingMode !== 'PROVISIONED')
+        return undefined;
+    return 'Provisioned capacity; on-demand may cost less under spiky traffic, provisioned is usually cheaper under steady traffic.';
+}
+export function cacheCostSignal(node) {
+    if ((node.numNodes ?? 0) <= MANY_CACHE_NODES)
+        return undefined;
+    return `${node.numNodes} nodes; verify traffic justifies ${node.numNodes}× the per-node cost.`;
+}

package/dist/analyzers/index.js

@@ -7,6 +7,7 @@ export { IaCDriftAnalyzer } from './terraform.js';
 export { PipelineAnalyzer } from './pipeline.js';
 export { MissingDLQAnalyzer, UnencryptedQueueAnalyzer, LargeQueueBacklogAnalyzer, VisibilityTimeoutMismatchAnalyzer, MissingSecretRotationAnalyzer, MissingLogRetentionAnalyzer, LambdaDefaultMemoryAnalyzer, LambdaHighTimeoutAnalyzer, LambdaMissingTriggerDLQAnalyzer, LambdaMissingIAMPermissionsAnalyzer, S3PublicAccessAnalyzer, S3MissingVersioningAnalyzer, S3UnencryptedAnalyzer, CacheTransitEncryptionAnalyzer, CacheSingleNodeAnalyzer, LambdaThrottlingAnalyzer, StaleQueueMessagesAnalyzer, } from './aws-services.js';
 export { RDSPubliclyAccessibleAnalyzer, RDSNoBackupAnalyzer, RDSUnencryptedAnalyzer, RDSNoDeletionProtectionAnalyzer, RDSNoMultiAZAnalyzer, } from './rds.js';
+export { LambdaHighMemoryAnalyzer, RDSMultiAZNonProdAnalyzer, lambdaCostSignal, dynamoCostSignal, cacheCostSignal, } from './cost-signals.js';
 export async function runAllAnalyzers(graph, analyzers) {
     const allFindings = [];
     for (const analyzer of analyzers) {

package/dist/cli/commands/analyze.js

@@ -14,7 +14,7 @@ import { extractRuntimeSignals } from '../../adapters/aws/metrics.js';
 import { extractS3Metadata } from '../../adapters/aws/s3.js';
 import { scanRepository } from '../../context/index.js';
 import { buildGraph, addStackOutputNodes } from '../../graph/index.js';
-import { runAllAnalyzers, IaCDriftAnalyzer, PipelineAnalyzer, FullTableScanAnalyzer, MissingGSIAnalyzer, HotPartitionAnalyzer, MissingIndexAnalyzer, NplusOneAnalyzer, LargeSelectAnalyzer, MissingMySQLIndexAnalyzer, MySQLFullTableScanAnalyzer, MissingMongoIndexAnalyzer, MongoCollectionScanAnalyzer, MissingDLQAnalyzer, UnencryptedQueueAnalyzer, LargeQueueBacklogAnalyzer, VisibilityTimeoutMismatchAnalyzer, MissingSecretRotationAnalyzer, MissingLogRetentionAnalyzer, LambdaDefaultMemoryAnalyzer, LambdaHighTimeoutAnalyzer, LambdaMissingTriggerDLQAnalyzer, LambdaMissingIAMPermissionsAnalyzer, RDSPubliclyAccessibleAnalyzer, RDSNoBackupAnalyzer, RDSUnencryptedAnalyzer, RDSNoDeletionProtectionAnalyzer, RDSNoMultiAZAnalyzer, S3PublicAccessAnalyzer, S3MissingVersioningAnalyzer, S3UnencryptedAnalyzer, CacheTransitEncryptionAnalyzer, CacheSingleNodeAnalyzer, LambdaThrottlingAnalyzer, StaleQueueMessagesAnalyzer, } from '../../analyzers/index.js';
+import { runAllAnalyzers, IaCDriftAnalyzer, PipelineAnalyzer, FullTableScanAnalyzer, MissingGSIAnalyzer, HotPartitionAnalyzer, MissingIndexAnalyzer, NplusOneAnalyzer, LargeSelectAnalyzer, MissingMySQLIndexAnalyzer, MySQLFullTableScanAnalyzer, MissingMongoIndexAnalyzer, MongoCollectionScanAnalyzer, MissingDLQAnalyzer, UnencryptedQueueAnalyzer, LargeQueueBacklogAnalyzer, VisibilityTimeoutMismatchAnalyzer, MissingSecretRotationAnalyzer, MissingLogRetentionAnalyzer, LambdaDefaultMemoryAnalyzer, LambdaHighTimeoutAnalyzer, LambdaMissingTriggerDLQAnalyzer, LambdaMissingIAMPermissionsAnalyzer, RDSPubliclyAccessibleAnalyzer, RDSNoBackupAnalyzer, RDSUnencryptedAnalyzer, RDSNoDeletionProtectionAnalyzer, RDSNoMultiAZAnalyzer, S3PublicAccessAnalyzer, S3MissingVersioningAnalyzer, S3UnencryptedAnalyzer, CacheTransitEncryptionAnalyzer, CacheSingleNodeAnalyzer, LambdaThrottlingAnalyzer, StaleQueueMessagesAnalyzer, LambdaHighMemoryAnalyzer, RDSMultiAZNonProdAnalyzer, } from '../../analyzers/index.js';
 import { printFinding, printSummaryBox, log, printHeader } from '../utils.js';
 const SEVERITY_ORDER = { high: 3, medium: 2, low: 1, verify: 0 };
 function buildMarkdownReport(findings, projectName) {
@@ -102,6 +102,7 @@ function buildAnalyzers(config, iacDriftAnalyzer, iacLambdas) {
                 new LambdaHighTimeoutAnalyzer(),
                 new LambdaMissingTriggerDLQAnalyzer(),
                 new LambdaMissingIAMPermissionsAnalyzer(),
+                new LambdaHighMemoryAnalyzer(),
             ]
             : []),
         ...(config.rds?.enabled === true
@@ -111,6 +112,7 @@ function buildAnalyzers(config, iacDriftAnalyzer, iacLambdas) {
                 new RDSUnencryptedAnalyzer(),
                 new RDSNoDeletionProtectionAnalyzer(),
                 new RDSNoMultiAZAnalyzer(),
+                new RDSMultiAZNonProdAnalyzer(),
             ]
             : []),
         ...(config.s3?.enabled === true

package/dist/context/index.js

@@ -95,29 +95,76 @@ const PRISMA_METHODS = new Set([
     'deleteMany',
     'updateMany',
 ]);
-function getEnclosingFunctionName(node) {
+function getEnclosingFunction(node) {
     let current = node.getParent();
     while (current) {
         if (Node.isFunctionDeclaration(current) ||
             Node.isFunctionExpression(current) ||
             Node.isArrowFunction(current) ||
             Node.isMethodDeclaration(current)) {
-            if (Node.isFunctionDeclaration(current) || Node.isMethodDeclaration(current)) {
-                return current.getName() ?? '<anonymous>';
-            }
-            // Arrow function or function expression — check if assigned to a variable
-            const parent = current.getParent();
-            if (parent && Node.isVariableDeclaration(parent)) {
-                return parent.getName();
+            return current;
+        }
+        current = current.getParent();
+    }
+    return undefined;
+}
+function getEnclosingFunctionName(node) {
+    const current = getEnclosingFunction(node);
+    if (!current)
+        return '<module>';
+    if (Node.isFunctionDeclaration(current) || Node.isMethodDeclaration(current)) {
+        return current.getName() ?? '<anonymous>';
+    }
+    // Arrow function or function expression — check if assigned to a variable
+    const parent = current.getParent();
+    if (parent && Node.isVariableDeclaration(parent)) {
+        return parent.getName();
+    }
+    if (parent && Node.isPropertyAssignment(parent)) {
+        return parent.getName();
+    }
+    return '<anonymous>';
+}
+// Scans the enclosing function for JSON.parse(x.SecretString) usage and collects the property
+// names accessed on the parsed result — never the secret values themselves.
+function extractSecretKeys(func) {
+    if (!func)
+        return undefined;
+    const keys = new Set();
+    for (const call of func.getDescendantsOfKind(SyntaxKind.CallExpression)) {
+        const expr = call.getExpression();
+        if (!Node.isPropertyAccessExpression(expr) || expr.getName() !== 'parse')
+            continue;
+        if (expr.getExpression().getText() !== 'JSON')
+            continue;
+        const arg = call.getArguments()[0];
+        if (!arg || !arg.getText().includes('SecretString'))
+            continue;
+        const parent = call.getParent();
+        if (Node.isPropertyAccessExpression(parent) && parent.getExpression() === call) {
+            keys.add(parent.getName());
+            continue;
+        }
+        if (Node.isVariableDeclaration(parent)) {
+            const nameNode = parent.getNameNode();
+            if (Node.isObjectBindingPattern(nameNode)) {
+                for (const el of nameNode.getElements()) {
+                    const propName = el.getPropertyNameNode();
+                    keys.add(propName ? propName.getText() : el.getName());
+                }
+                continue;
             }
-            if (parent && Node.isPropertyAssignment(parent)) {
-                return parent.getName();
+            if (Node.isIdentifier(nameNode)) {
+                const varName = nameNode.getText();
+                for (const access of func.getDescendantsOfKind(SyntaxKind.PropertyAccessExpression)) {
+                    if (access.getExpression().getText() === varName) {
+                        keys.add(access.getName());
+                    }
+                }
             }
-            return '<anonymous>';
         }
-        current = current.getParent();
     }
-    return '<module>';
+    return keys.size > 0 ? Array.from(keys).sort() : undefined;
 }
 function extractTableNameFromArg(arg) {
     if (Node.isStringLiteral(arg)) {
@@ -505,6 +552,7 @@ function detectAWSServiceOperations(callExpr, filePath) {
                     serviceType: 'secretsmanager',
                     target: cmdArgs.length > 0 ? extractArgValue(cmdArgs[0], ...SECRETS_ARG_KEYS) : 'unknown',
                     filePath,
+                    keys: extractSecretKeys(getEnclosingFunction(callExpr)),
                 };
             }
             if (LAMBDA_COMMANDS.has(className)) {
@@ -558,6 +606,7 @@ function detectAWSServiceOperations(callExpr, filePath) {
                 serviceType: 'secretsmanager',
                 target: args.length > 0 ? extractArgValue(args[0], ...SECRETS_ARG_KEYS) : 'unknown',
                 filePath,
+                keys: extractSecretKeys(getEnclosingFunction(callExpr)),
             };
         }
         if (LAMBDA_COMMANDS.has(methodName) && (objText.includes('lambda') || objText.includes('fn'))) {
@@ -586,6 +635,8 @@ function detectLanguages(root) {
     const stack = [root];
     while (stack.length > 0 && !(hasTypeScript && hasPython)) {
         const dir = stack.pop();
+        if (dir === undefined)
+            break;
         for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
             if (entry.isDirectory()) {
                 if (!PROBE_EXCLUDED_DIRS.has(entry.name) && !entry.name.startsWith('.')) {

package/dist/context/scanner.py

@@ -69,6 +69,33 @@ def sql_table(sql):
     return 'unknown'
 
 
+def const_str(node):
+    if isinstance(node, ast.Index):  # py3.8 compat
+        node = node.value
+    if isinstance(node, ast.Constant) and isinstance(node.value, str):
+        return node.value
+    return None
+
+
+def is_secret_string_ref(node):
+    if isinstance(node, ast.Attribute) and node.attr == 'SecretString':
+        return True
+    if isinstance(node, ast.Subscript):
+        return const_str(node.slice) == 'SecretString'
+    return False
+
+
+def is_json_loads_secret(node):
+    return (
+        isinstance(node, ast.Call)
+        and isinstance(node.func, ast.Attribute)
+        and node.func.attr == 'loads'
+        and expr_text(node.func.value) == 'json'
+        and node.args
+        and is_secret_string_ref(node.args[0])
+    )
+
+
 class Visitor(ast.NodeVisitor):
     def __init__(self, file_path):
         self.file_path = file_path
@@ -93,11 +120,54 @@ class Visitor(ast.NodeVisitor):
 
     def visit_FunctionDef(self, node):
         self.stack.append(node.name)
+        start = len(self.ops)
         self.generic_visit(node)
+        keys = self.find_secret_keys(node)
+        if keys:
+            for op in self.ops[start:]:
+                if op['serviceType'] == 'secretsmanager':
+                    op['keys'] = keys
         self.stack.pop()
 
     visit_AsyncFunctionDef = visit_FunctionDef
 
+    # Finds json.loads(x['SecretString']) usage in this function and collects the key names
+    # accessed on the parsed result (via subscript or .get) — never the secret values.
+    def find_secret_keys(self, func_node):
+        keys = set()
+        tracked_vars = set()
+
+        for n in ast.walk(func_node):
+            if isinstance(n, ast.Assign) and len(n.targets) == 1 and isinstance(n.targets[0], ast.Name):
+                if is_json_loads_secret(n.value):
+                    tracked_vars.add(n.targets[0].id)
+                elif isinstance(n.value, ast.Subscript) and is_json_loads_secret(n.value.value):
+                    key = const_str(n.value.slice)
+                    if key:
+                        keys.add(key)
+
+        if not tracked_vars:
+            return sorted(keys)
+
+        for n in ast.walk(func_node):
+            if isinstance(n, ast.Subscript) and isinstance(n.value, ast.Name) and n.value.id in tracked_vars:
+                key = const_str(n.slice)
+                if key:
+                    keys.add(key)
+            elif (
+                isinstance(n, ast.Call)
+                and isinstance(n.func, ast.Attribute)
+                and n.func.attr == 'get'
+                and isinstance(n.func.value, ast.Name)
+                and n.func.value.id in tracked_vars
+                and n.args
+            ):
+                key = const_str(n.args[0])
+                if key:
+                    keys.add(key)
+
+        return sorted(keys)
+
     def resolve_string(self, node):
         if isinstance(node, ast.Constant) and isinstance(node.value, str):
             return node.value

package/dist/graph/index.js

@@ -20,6 +20,8 @@ export function buildGraph(operations, dynamoMeta, postgresMeta, mysqlMeta = [],
             databaseType: 'dynamodb',
             partitionKey: table.partitionKey,
             sortKey: table.sortKey,
+            billingMode: table.billingMode,
+            provisionedThroughput: table.provisionedThroughput,
         });
         for (const indexName of table.indexes) {
             const indexNodeId = `index:${table.tableName}:${indexName}`;
@@ -386,6 +388,12 @@ export function buildGraph(operations, dynamoMeta, postgresMeta, mysqlMeta = [],
                 provider: 'aws',
                 rotationEnabled: false,
             });
+            if (op.keys && op.keys.length > 0) {
+                const node = nodeMap.get(secretId);
+                if (node && node.type === 'secret') {
+                    node.referencedKeys = Array.from(new Set([...(node.referencedKeys ?? []), ...op.keys])).sort();
+                }
+            }
             edges.push({ from: funcNodeId, to: secretId, type: 'reads_secret' });
             continue;
         }

package/dist/server/index.js

@@ -7,7 +7,7 @@ import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/
 import { z } from 'zod';
 import { logger } from '../core/index.js';
 const { version } = JSON.parse(readFileSync(join(import.meta.dirname, '../../package.json'), 'utf8'));
-import { summarizeFindings } from '../analyzers/index.js';
+import { summarizeFindings, lambdaCostSignal, dynamoCostSignal, cacheCostSignal, } from '../analyzers/index.js';
 import { getTableNodes, getFunctionNodes, getQueueNodes, getTopicNodes, getSecretNodes, getParameterNodes, getLogGroupNodes, getLambdaNodes, getEventBridgeRuleNodes, getBucketNodes, getAPINodes, getStackOutputNodes, getUserPoolNodes, getStreamNodes, getKafkaClusterNodes, getCacheClusterNodes, getScanEdges, getOutgoingEdges, } from '../graph/index.js';
 // ── State ────────────────────────────────────────────────────────────────────
 let currentGraph = { nodes: [], edges: [] };
@@ -344,7 +344,7 @@ export function createMcpServer() {
         });
     }));
     mcp.registerTool('get_secrets_overview', {
-        description: 'Returns all Secrets Manager secrets with rotation status and rotation interval. Secret values are never returned. Call this when checking which secrets exist, confirming rotation is enabled before a security review, or identifying secrets that lack rotation.',
+        description: 'Returns all Secrets Manager secrets with rotation status, rotation interval, and referencedKeys — key names (e.g. "password", "apiKey") inferred from application code that parses the secret, never the values. Call this when checking which secrets exist, confirming rotation is enabled before a security review, or before writing code that reads a secret so you use the correct key name instead of guessing.',
         inputSchema: z.object({}),
     }, logged('get_secrets_overview', async () => {
         const secrets = getSecretNodes(currentGraph);
@@ -357,6 +357,7 @@ export function createMcpServer() {
                 provider: s.provider,
                 rotationEnabled: s.rotationEnabled,
                 rotationDays: s.rotationDays,
+                referencedKeys: s.referencedKeys ?? [],
                 findings: secretFindings
                     .filter((f) => f.metadata.secretName === s.name)
                     .map((f) => ({ severity: f.severity, issue: f.issue })),
@@ -380,7 +381,7 @@ export function createMcpServer() {
         });
     }));
     mcp.registerTool('get_lambda_overview', {
-        description: 'Returns all Lambda functions with runtime, memory (MB), timeout (sec), environment variable key names (values never returned), and event source triggers with the correct handler event shape for each. Call this when auditing Lambda configuration for default memory (128 MB) or high timeouts, or when you need the trigger event shape for a specific function without running analyze_function. When runtime signals are enabled, recentThrottles and recentErrors report CloudWatch counts for the analysis window.',
+        description: 'Returns all Lambda functions with runtime, memory (MB), timeout (sec), environment variable key names (values never returned), and event source triggers with the correct handler event shape for each. Call this when auditing Lambda configuration for default memory (128 MB) or high timeouts, or when you need the trigger event shape for a specific function without running analyze_function. When runtime signals are enabled, recentThrottles and recentErrors report CloudWatch counts for the analysis window. A costSignal note appears when memory is 3008 MB+ and there is no throttling evidence to justify it — no billing API involved, this is a config-level heuristic.',
         inputSchema: z.object({}),
     }, logged('get_lambda_overview', async () => {
         const lambdas = getLambdaNodes(currentGraph);
@@ -388,26 +389,30 @@ export function createMcpServer() {
         return toText({
             total: lambdas.length,
             note: 'Environment variable values are never included.',
-            lambdas: lambdas.map((l) => ({
-                name: l.name,
-                runtime: l.runtime,
-                memoryMB: l.memoryMB,
-                timeoutSec: l.timeoutSec,
-                envVarCount: l.envVarKeys?.length ?? 0,
-                envVarKeys: l.envVarKeys,
-                roleArn: l.roleArn,
-                recentThrottles: l.recentThrottles,
-                recentErrors: l.recentErrors,
-                triggers: (l.triggers ?? []).map((t) => ({
-                    type: t.type,
-                    source: t.sourceName,
-                    eventShape: t.eventShape,
-                    state: t.state,
-                })),
-                findings: lambdaFindings
-                    .filter((f) => f.metadata.functionName === l.name)
-                    .map((f) => ({ severity: f.severity, issue: f.issue })),
-            })),
+            lambdas: lambdas.map((l) => {
+                const costSignal = lambdaCostSignal(l);
+                return {
+                    name: l.name,
+                    runtime: l.runtime,
+                    memoryMB: l.memoryMB,
+                    timeoutSec: l.timeoutSec,
+                    envVarCount: l.envVarKeys?.length ?? 0,
+                    envVarKeys: l.envVarKeys,
+                    roleArn: l.roleArn,
+                    recentThrottles: l.recentThrottles,
+                    recentErrors: l.recentErrors,
+                    ...(costSignal ? { costSignal } : {}),
+                    triggers: (l.triggers ?? []).map((t) => ({
+                        type: t.type,
+                        source: t.sourceName,
+                        eventShape: t.eventShape,
+                        state: t.state,
+                    })),
+                    findings: lambdaFindings
+                        .filter((f) => f.metadata.functionName === l.name)
+                        .map((f) => ({ severity: f.severity, issue: f.issue })),
+                };
+            }),
         });
     }));
     mcp.registerTool('get_eventbridge_details', {
@@ -488,7 +493,7 @@ export function createMcpServer() {
         });
     }));
     mcp.registerTool('get_table_schema', {
-        description: 'Returns the full schema for specific tables or collections by name: columns with data types and nullability, primary keys, foreign keys (join paths), indexes, DynamoDB partition/sort keys, and MongoDB estimated document counts. Accepts short names ("orders" matches "public.orders") and is case-insensitive. Call this after get_infra_overview when you need column-level detail to write a SQL query, DynamoDB expression, or MongoDB filter for specific tables — instead of pulling every schema with get_graph_summary. Do NOT call for a table inventory; use get_infra_overview for that. Row data is never included.',
+        description: 'Returns the full schema for specific tables or collections by name: columns with data types and nullability, primary keys, foreign keys (join paths), indexes, DynamoDB partition/sort keys and billing mode, and MongoDB estimated document counts. Accepts short names ("orders" matches "public.orders") and is case-insensitive. Call this after get_infra_overview when you need column-level detail to write a SQL query, DynamoDB expression, or MongoDB filter for specific tables — instead of pulling every schema with get_graph_summary. Do NOT call for a table inventory; use get_infra_overview for that. Row data is never included. DynamoDB matches include a costSignal note for provisioned-capacity tables.',
         inputSchema: z.object({
             tables: z
                 .array(z.string())
@@ -518,17 +523,25 @@ export function createMcpServer() {
             return {
                 requested,
                 found: true,
-                matches: matches.map((t) => ({
-                    name: t.name,
-                    databaseType: t.databaseType,
-                    ...(t.columns ? { columns: t.columns } : {}),
-                    ...(t.primaryKeys?.length ? { primaryKeys: t.primaryKeys } : {}),
-                    ...(t.foreignKeys?.length ? { foreignKeys: t.foreignKeys } : {}),
-                    ...(t.partitionKey ? { partitionKey: t.partitionKey } : {}),
-                    ...(t.sortKey ? { sortKey: t.sortKey } : {}),
-                    ...(t.estimatedCount !== undefined ? { estimatedCount: t.estimatedCount } : {}),
-                    indexes: indexNamesFor(t.id),
-                })),
+                matches: matches.map((t) => {
+                    const costSignal = t.databaseType === 'dynamodb' ? dynamoCostSignal(t) : undefined;
+                    return {
+                        name: t.name,
+                        databaseType: t.databaseType,
+                        ...(t.columns ? { columns: t.columns } : {}),
+                        ...(t.primaryKeys?.length ? { primaryKeys: t.primaryKeys } : {}),
+                        ...(t.foreignKeys?.length ? { foreignKeys: t.foreignKeys } : {}),
+                        ...(t.partitionKey ? { partitionKey: t.partitionKey } : {}),
+                        ...(t.sortKey ? { sortKey: t.sortKey } : {}),
+                        ...(t.estimatedCount !== undefined ? { estimatedCount: t.estimatedCount } : {}),
+                        ...(t.billingMode ? { billingMode: t.billingMode } : {}),
+                        ...(t.provisionedThroughput
+                            ? { provisionedThroughput: t.provisionedThroughput }
+                            : {}),
+                        ...(costSignal ? { costSignal } : {}),
+                        indexes: indexNamesFor(t.id),
+                    };
+                }),
             };
         });
         return toText({
@@ -537,7 +550,7 @@ export function createMcpServer() {
         });
     }));
     mcp.registerTool('get_cache_overview', {
-        description: 'Returns all ElastiCache clusters with engine, version, node type, node count, in-transit and at-rest encryption status, replication group, and automatic failover state. Call this before writing cache client code (TLS is required when transit encryption is on — rediss:// for Redis) or when reviewing cache availability and security posture. Cached data is never read or included.',
+        description: 'Returns all ElastiCache clusters with engine, version, node type, node count, in-transit and at-rest encryption status, replication group, and automatic failover state. Call this before writing cache client code (TLS is required when transit encryption is on — rediss:// for Redis) or when reviewing cache availability and security posture. Cached data is never read or included. A costSignal note appears on clusters with more than 3 nodes.',
         inputSchema: z.object({}),
     }, logged('get_cache_overview', async () => {
         const caches = getCacheClusterNodes(currentGraph);
@@ -545,20 +558,24 @@ export function createMcpServer() {
         return toText({
             total: caches.length,
             note: 'Cached data is never included.',
-            caches: caches.map((c) => ({
-                id: c.name,
-                engine: c.engine,
-                engineVersion: c.engineVersion,
-                nodeType: c.nodeType,
-                numNodes: c.numNodes,
-                transitEncryption: c.transitEncryption,
-                atRestEncryption: c.atRestEncryption,
-                replicationGroupId: c.replicationGroupId,
-                automaticFailover: c.automaticFailover,
-                findings: cacheFindings
-                    .filter((f) => f.metadata.cacheClusterId === c.name)
-                    .map((f) => ({ severity: f.severity, issue: f.issue })),
-            })),
+            caches: caches.map((c) => {
+                const costSignal = cacheCostSignal(c);
+                return {
+                    id: c.name,
+                    engine: c.engine,
+                    engineVersion: c.engineVersion,
+                    nodeType: c.nodeType,
+                    numNodes: c.numNodes,
+                    transitEncryption: c.transitEncryption,
+                    atRestEncryption: c.atRestEncryption,
+                    replicationGroupId: c.replicationGroupId,
+                    automaticFailover: c.automaticFailover,
+                    ...(costSignal ? { costSignal } : {}),
+                    findings: cacheFindings
+                        .filter((f) => f.metadata.cacheClusterId === c.name)
+                        .map((f) => ({ severity: f.severity, issue: f.issue })),
+                };
+            }),
         });
     }));
     mcp.registerTool('get_stream_details', {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "infrawise",
-  "version": "0.17.0",
+  "version": "0.19.0",
   "mcpName": "io.github.Sidd27/infrawise",
   "description": "CLI-first infrastructure intelligence platform — analyzes DynamoDB, PostgreSQL, MySQL, MongoDB, SQS, SNS, SSM, Secrets Manager, Lambda, S3, API Gateway, CloudWatch Logs and exposes findings as an MCP server for Claude Code",
   "keywords": [