infrawise 0.6.0 → 0.7.0

package/README.md

@@ -15,6 +15,8 @@ It statically analyzes your codebase, cloud infrastructure, and database schemas
 
 ## Why this exists
 
+New software developers don't write wrong code. Claude Code writes wrong code and they ship it. Infrawise is the only thing standing between Claude Code's generated output and a production incident.
+
 AI coding assistants can read your source files but have no deterministic knowledge of your infrastructure. They do not know which GSIs exist, how tables are partitioned, which functions already trigger scans, or where indexes are missing. So they guess.
 
 Infrawise replaces guessing with infrastructure-aware context.
@@ -159,7 +161,7 @@ To let Claude Code manage the server lifecycle automatically:
 |---|---|
 | `get_infra_overview` | Complete snapshot — all services, counts, and high-severity findings |
 | `get_graph_summary` | Full infrastructure graph — all nodes, edges, and findings |
-| `analyze_function` | Issues in a specific function — scans, missing indexes, N+1 |
+| `analyze_function` | Issues in a specific function — scans, missing indexes, N+1, trigger event shapes |
 | `suggest_gsi` | Exact GSI config for a DynamoDB table + attribute |
 | `postgres_index_suggestions` | Exact `CREATE INDEX` SQL for your actual table |
 | `suggest_mongo_index` | Exact `createIndex` command for a MongoDB collection + field |
@@ -168,7 +170,8 @@ To let Claude Code manage the server lifecycle automatically:
 | `get_topic_details` | SNS topics — subscription counts and protocols |
 | `get_secrets_overview` | Secrets Manager — names and rotation status (values never included) |
 | `get_parameter_overview` | SSM Parameter Store — names, types, tiers (values never included) |
-| `get_lambda_overview` | Lambda functions — runtime, memory, timeout, env var key names |
+| `get_lambda_overview` | Lambda functions — runtime, memory, timeout, triggers (SQS/DynamoDB/Kinesis/EventBridge), env var key names |
+| `get_eventbridge_details` | EventBridge rules — name, state, schedule/event pattern, target functions |
 | `get_log_errors` | CloudWatch error patterns and counts (no raw log messages) |
 
 ---
@@ -239,6 +242,12 @@ secretsManager:
 
 lambda:
   enabled: true
+  includeFunctions:           # omit to include all functions
+    - processOrders
+    - generateReport
+
+eventbridge:
+  enabled: true
 
 rds:
   enabled: false
@@ -312,7 +321,8 @@ Works from AWS APIs, database schema introspection, and IaC files — no depende
 | SQS | Missing DLQs, unencrypted queues, large backlogs |
 | Kafka (kafkajs) | Producer/consumer topic mapping from code |
 | Secrets Manager | Missing secret rotation |
-| Lambda | Default memory (128 MB), high timeouts |
+| Lambda | Default memory (128 MB), high timeouts, triggers (SQS/DynamoDB/Kinesis/EventBridge), missing DLQ on trigger source |
+| EventBridge | Rules, schedules, event patterns, target Lambda functions |
 | RDS | Publicly accessible, no backups, unencrypted, no deletion protection, single-AZ |
 | CloudWatch Logs | Log groups with no retention policy |
 | Terraform / CloudFormation / CDK | IaC drift vs deployed state |
@@ -420,6 +430,8 @@ src/
 
 ## Roadmap
 
+Feature roadmap is tracked in the [GitHub Project](https://github.com/users/Sidd27/projects/1). Priorities, complexity, and virality scores are visible there. Feature requests and upvotes welcome.
+
 ### Planned
 - Runtime tracing integration
 - Incremental analysis for large monorepos
@@ -435,6 +447,12 @@ src/
 
 ---
 
+## Demo
+
+The `demo/localstack/` directory runs infrawise against real AWS APIs emulated locally via [LocalStack](https://localstack.cloud) — an open-source tool that spins up a full AWS environment in Docker so you can test AWS integrations at zero cost, with no real AWS account needed. See [`demo/localstack/README.md`](demo/localstack/README.md) for setup instructions.
+
+---
+
 ## Contributing
 
 ### Prerequisites

package/dist/adapters/aws.js

@@ -2,7 +2,8 @@ import { SQSClient, ListQueuesCommand, GetQueueAttributesCommand, } from '@aws-s
 import { SNSClient, ListTopicsCommand, GetTopicAttributesCommand, ListSubscriptionsByTopicCommand, } from '@aws-sdk/client-sns';
 import { SSMClient, DescribeParametersCommand, } from '@aws-sdk/client-ssm';
 import { SecretsManagerClient, ListSecretsCommand, } from '@aws-sdk/client-secrets-manager';
-import { LambdaClient, ListFunctionsCommand, } from '@aws-sdk/client-lambda';
+import { LambdaClient, ListFunctionsCommand, ListEventSourceMappingsCommand, } from '@aws-sdk/client-lambda';
+import { EventBridgeClient, ListRulesCommand, ListTargetsByRuleCommand, } from '@aws-sdk/client-eventbridge';
 import { RDSClient, DescribeDBInstancesCommand, } from '@aws-sdk/client-rds';
 import { fromIni } from '@aws-sdk/credential-providers';
 import { logger } from '../core/index.js';
@@ -13,11 +14,6 @@ function clientConfig(cfg) {
         base.endpoint = cfg.endpoint;
     if (cfg.profile)
         base.credentials = fromIni({ profile: cfg.profile });
-    else if (cfg.endpoint)
-        base.credentials = {
-            accessKeyId: process.env.AWS_ACCESS_KEY_ID ?? 'test',
-            secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY ?? 'test',
-        };
     return base;
 }
 // ─── SQS ─────────────────────────────────────────────────────────────────────
@@ -101,7 +97,7 @@ export async function extractSNSMetadata(cfg = {}) {
                     name: arn.split(':').pop() ?? arn,
                     arn,
                     encrypted: !!attrs['KmsMasterKeyId'],
-                    subscriptionCount: subs.length,
+                    subscriptionCount: parseInt(attrs['SubscriptionsConfirmed'] ?? '0', 10),
                     subscriptionProtocols: [...new Set(subs.map((s) => s.Protocol ?? 'unknown'))],
                 });
             }
@@ -128,7 +124,9 @@ export async function extractSSMMetadata(cfg = {}) {
             const res = await client.send(new DescribeParametersCommand({
                 NextToken: nextToken,
                 MaxResults: 50,
-                // Only metadata — GetParameter/GetParameters would return values
+                ParameterFilters: cfg.paths?.length
+                    ? [{ Key: 'Path', Values: cfg.paths, Option: 'Recursive' }]
+                    : undefined,
             }));
             for (const p of res.Parameters ?? []) {
                 parameters.push({
@@ -183,7 +181,94 @@ export async function validateSecretsAccess(cfg = {}) {
     await new SecretsManagerClient(clientConfig(cfg)).send(new ListSecretsCommand({ MaxResults: 1 }));
 }
 // ─── Lambda ───────────────────────────────────────────────────────────────────
-export async function extractLambdaMetadata(cfg = {}) {
+const EVENT_SHAPES = {
+    sqs: 'event.Records[0].body',
+    dynamodb: 'event.Records[0].dynamodb.NewImage',
+    kinesis: 'event.Records[0].kinesis.data  // base64',
+    msk: 'event.records[topic][0].value  // base64',
+    sns: 'event.Records[0].Sns.Message',
+    s3: 'event.Records[0].s3.object.key',
+    eventbridge: 'event.detail',
+    unknown: 'event  // unknown trigger type',
+};
+function triggerFromArn(arn, batchSize, state) {
+    let type = 'unknown';
+    if (arn.includes(':sqs:'))
+        type = 'sqs';
+    else if (arn.includes(':dynamodb:'))
+        type = 'dynamodb';
+    else if (arn.includes(':kinesis:'))
+        type = 'kinesis';
+    else if (arn.includes(':kafka:') || arn.toLowerCase().includes('msk'))
+        type = 'msk';
+    else if (arn.includes(':sns:'))
+        type = 'sns';
+    else if (arn.includes(':s3:'))
+        type = 's3';
+    const sourceName = arn.split(':').pop() ?? arn;
+    return { type, sourceArn: arn, sourceName, eventShape: EVENT_SHAPES[type], batchSize, state };
+}
+async function fetchAllEventSourceMappings(cfg) {
+    const client = new LambdaClient(clientConfig(cfg));
+    const triggerMap = new Map();
+    try {
+        let marker;
+        do {
+            const res = await client.send(new ListEventSourceMappingsCommand({ Marker: marker, MaxItems: 100 }));
+            for (const m of res.EventSourceMappings ?? []) {
+                if (!m.FunctionArn || !m.EventSourceArn)
+                    continue;
+                const trigger = triggerFromArn(m.EventSourceArn, m.BatchSize, m.State);
+                const existing = triggerMap.get(m.FunctionArn) ?? [];
+                existing.push(trigger);
+                triggerMap.set(m.FunctionArn, existing);
+            }
+            marker = res.NextMarker;
+        } while (marker);
+    }
+    catch (err) {
+        logger.warn(`Event source mappings fetch failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    return triggerMap;
+}
+export async function extractEventBridgeMetadata(cfg = {}) {
+    const client = new EventBridgeClient(clientConfig(cfg));
+    const rules = [];
+    try {
+        let nextToken;
+        do {
+            const res = await client.send(new ListRulesCommand({ NextToken: nextToken, Limit: 100 }));
+            for (const rule of res.Rules ?? []) {
+                if (!rule.Name)
+                    continue;
+                try {
+                    const targetsRes = await client.send(new ListTargetsByRuleCommand({ Rule: rule.Name }));
+                    const targetArns = (targetsRes.Targets ?? []).map((t) => t.Arn ?? '').filter(Boolean);
+                    rules.push({
+                        name: rule.Name,
+                        arn: rule.Arn ?? '',
+                        state: rule.State ?? 'UNKNOWN',
+                        scheduleExpression: rule.ScheduleExpression,
+                        eventPattern: rule.EventPattern,
+                        targetArns,
+                    });
+                }
+                catch (err) {
+                    logger.warn(`EventBridge targets fetch failed for ${rule.Name}: ${err instanceof Error ? err.message : String(err)}`);
+                }
+            }
+            nextToken = res.NextToken;
+        } while (nextToken && rules.length < 500);
+    }
+    catch (err) {
+        logger.warn(`EventBridge list failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    return rules;
+}
+export async function validateEventBridgeAccess(cfg = {}) {
+    await new EventBridgeClient(clientConfig(cfg)).send(new ListRulesCommand({ Limit: 1 }));
+}
+export async function extractLambdaMetadata(cfg = {}, includeFunctions) {
     const client = new LambdaClient(clientConfig(cfg));
     const functions = [];
     try {
@@ -191,8 +276,11 @@ export async function extractLambdaMetadata(cfg = {}) {
         do {
             const res = await client.send(new ListFunctionsCommand({ Marker: marker, MaxItems: 50 }));
             for (const fn of res.Functions ?? []) {
+                const name = fn.FunctionName ?? '';
+                if (includeFunctions?.length && !includeFunctions.includes(name))
+                    continue;
                 functions.push({
-                    name: fn.FunctionName ?? '',
+                    name,
                     arn: fn.FunctionArn ?? '',
                     runtime: fn.Runtime,
                     handler: fn.Handler,
@@ -201,10 +289,16 @@ export async function extractLambdaMetadata(cfg = {}) {
                     lastModified: fn.LastModified,
                     envVarKeys: Object.keys(fn.Environment?.Variables ?? {}),
                     layers: (fn.Layers ?? []).map((l) => l.Arn ?? '').filter(Boolean),
+                    triggers: [],
                 });
             }
             marker = res.NextMarker;
         } while (marker && functions.length < 200);
+        // Fetch all event source mappings in one paginated call and attach to functions
+        const triggerMap = await fetchAllEventSourceMappings(cfg);
+        for (const fn of functions) {
+            fn.triggers = triggerMap.get(fn.arn) ?? [];
+        }
     }
     catch (err) {
         logger.warn(`Lambda list failed: ${err instanceof Error ? err.message : String(err)}`);

package/dist/adapters/dynamodb.js

@@ -10,11 +10,6 @@ function createDynamoClient(config) {
         clientConfig.endpoint = endpoint;
     if (profile)
         clientConfig.credentials = fromIni({ profile });
-    else if (endpoint)
-        clientConfig.credentials = {
-            accessKeyId: process.env.AWS_ACCESS_KEY_ID ?? 'test',
-            secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY ?? 'test',
-        };
     return new DynamoDBClient(clientConfig);
 }
 function parseTableDescription(desc) {

package/dist/adapters/logs.js

@@ -11,11 +11,6 @@ function clientConfig(cfg) {
         base.endpoint = cfg.endpoint;
     if (cfg.profile)
         base.credentials = fromIni({ profile: cfg.profile });
-    else if (cfg.endpoint)
-        base.credentials = {
-            accessKeyId: process.env.AWS_ACCESS_KEY_ID ?? 'test',
-            secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY ?? 'test',
-        };
     return base;
 }
 // Strip UUIDs, timestamps, numbers → group similar messages by pattern

package/dist/analyzers/aws-services.js

@@ -136,6 +136,33 @@ export class LambdaDefaultMemoryAnalyzer {
         return findings;
     }
 }
+export class LambdaMissingTriggerDLQAnalyzer {
+    name = 'LambdaMissingTriggerDLQAnalyzer';
+    async analyze(graph) {
+        const findings = [];
+        for (const node of graph.nodes) {
+            if (node.type !== 'lambda')
+                continue;
+            for (const trigger of node.triggers ?? []) {
+                if (trigger.type !== 'sqs' && trigger.type !== 'kinesis' && trigger.type !== 'dynamodb')
+                    continue;
+                // Check if there's a DLQ/destination on the trigger edge — we flag if the source queue itself has no DLQ
+                // and the trigger is active, since failures will be silently dropped
+                const sourceQueue = graph.nodes.find((n) => n.type === 'queue' && n.name === trigger.sourceName);
+                if (sourceQueue && sourceQueue.type === 'queue' && !sourceQueue.hasDLQ) {
+                    findings.push({
+                        severity: 'high',
+                        issue: `Lambda "${node.name}" is triggered by "${trigger.sourceName}" which has no DLQ`,
+                        description: `"${node.name}" receives events from "${trigger.sourceName}" (${trigger.type.toUpperCase()}). If the Lambda handler fails, messages will be retried and eventually discarded with no failure record.`,
+                        recommendation: `Add a DLQ to "${trigger.sourceName}" and set a destination config on the event source mapping so failed batches are captured and inspectable.`,
+                        metadata: { functionName: node.name, triggerSource: trigger.sourceName, triggerType: trigger.type },
+                    });
+                }
+            }
+        }
+        return findings;
+    }
+}
 export class LambdaHighTimeoutAnalyzer {
     name = 'LambdaHighTimeoutAnalyzer';
     async analyze(graph) {

package/dist/analyzers/index.js

@@ -4,7 +4,7 @@ export { MissingIndexAnalyzer, NplusOneAnalyzer, LargeSelectAnalyzer } from './p
 export { MissingMySQLIndexAnalyzer, MySQLFullTableScanAnalyzer } from './mysql.js';
 export { MissingMongoIndexAnalyzer, MongoCollectionScanAnalyzer } from './mongodb.js';
 export { IaCDriftAnalyzer } from './terraform.js';
-export { MissingDLQAnalyzer, UnencryptedQueueAnalyzer, LargeQueueBacklogAnalyzer, MissingSecretRotationAnalyzer, MissingLogRetentionAnalyzer, LambdaDefaultMemoryAnalyzer, LambdaHighTimeoutAnalyzer, } from './aws-services.js';
+export { MissingDLQAnalyzer, UnencryptedQueueAnalyzer, LargeQueueBacklogAnalyzer, MissingSecretRotationAnalyzer, MissingLogRetentionAnalyzer, LambdaDefaultMemoryAnalyzer, LambdaHighTimeoutAnalyzer, LambdaMissingTriggerDLQAnalyzer, } from './aws-services.js';
 export { RDSPubliclyAccessibleAnalyzer, RDSNoBackupAnalyzer, RDSUnencryptedAnalyzer, RDSNoDeletionProtectionAnalyzer, RDSNoMultiAZAnalyzer, } from './rds.js';
 export async function runAllAnalyzers(graph, analyzers) {
     const allFindings = [];

package/dist/cli/commands/analyze.js

@@ -7,11 +7,11 @@ import { extractPostgresMetadata } from '../../adapters/postgres.js';
 import { extractMySQLMetadata } from '../../adapters/mysql.js';
 import { extractMongoMetadata } from '../../adapters/mongodb.js';
 import { extractIaCSchema } from '../../adapters/terraform.js';
-import { extractSQSMetadata, extractSNSMetadata, extractSSMMetadata, extractSecretsMetadata, extractLambdaMetadata, extractRDSMetadata, } from '../../adapters/aws.js';
+import { extractSQSMetadata, extractSNSMetadata, extractSSMMetadata, extractSecretsMetadata, extractLambdaMetadata, extractEventBridgeMetadata, extractRDSMetadata, } from '../../adapters/aws.js';
 import { extractLogsMetadata } from '../../adapters/logs.js';
 import { scanRepository } from '../../context/index.js';
 import { buildGraph } from '../../graph/index.js';
-import { runAllAnalyzers, IaCDriftAnalyzer, FullTableScanAnalyzer, MissingGSIAnalyzer, HotPartitionAnalyzer, MissingIndexAnalyzer, NplusOneAnalyzer, LargeSelectAnalyzer, MissingMySQLIndexAnalyzer, MySQLFullTableScanAnalyzer, MissingMongoIndexAnalyzer, MongoCollectionScanAnalyzer, MissingDLQAnalyzer, UnencryptedQueueAnalyzer, LargeQueueBacklogAnalyzer, MissingSecretRotationAnalyzer, MissingLogRetentionAnalyzer, LambdaDefaultMemoryAnalyzer, LambdaHighTimeoutAnalyzer, RDSPubliclyAccessibleAnalyzer, RDSNoBackupAnalyzer, RDSUnencryptedAnalyzer, RDSNoDeletionProtectionAnalyzer, RDSNoMultiAZAnalyzer, } from '../../analyzers/index.js';
+import { runAllAnalyzers, IaCDriftAnalyzer, FullTableScanAnalyzer, MissingGSIAnalyzer, HotPartitionAnalyzer, MissingIndexAnalyzer, NplusOneAnalyzer, LargeSelectAnalyzer, MissingMySQLIndexAnalyzer, MySQLFullTableScanAnalyzer, MissingMongoIndexAnalyzer, MongoCollectionScanAnalyzer, MissingDLQAnalyzer, UnencryptedQueueAnalyzer, LargeQueueBacklogAnalyzer, MissingSecretRotationAnalyzer, MissingLogRetentionAnalyzer, LambdaDefaultMemoryAnalyzer, LambdaHighTimeoutAnalyzer, LambdaMissingTriggerDLQAnalyzer, RDSPubliclyAccessibleAnalyzer, RDSNoBackupAnalyzer, RDSUnencryptedAnalyzer, RDSNoDeletionProtectionAnalyzer, RDSNoMultiAZAnalyzer, } from '../../analyzers/index.js';
 import { printFinding, printSummaryBox, log, printHeader } from '../utils.js';
 function mkSpinner(text) {
     return ora({ text: chalk.dim(text), color: 'cyan' }).start();
@@ -134,7 +134,7 @@ export async function runAnalyze(options = {}) {
     if (config.lambda?.enabled === true) {
         const s = mkSpinner('Extracting Lambda functions...');
         try {
-            const result = await extractLambdaMetadata(awsCfg);
+            const result = await extractLambdaMetadata(awsCfg, config.lambda?.includeFunctions);
             servicesMeta.lambda = result;
             s.succeed(chalk.green('Lambda') + chalk.dim(`  ${result.length} function(s)`));
         }
@@ -142,6 +142,18 @@ export async function runAnalyze(options = {}) {
             s.warn(chalk.yellow('Lambda skipped') + chalk.dim(`  ${err instanceof Error ? err.message : String(err)}`));
         }
     }
+    // ── EventBridge ──────────────────────────────────────────────────────────────
+    if (config.eventbridge?.enabled === true) {
+        const s = mkSpinner('Extracting EventBridge rules...');
+        try {
+            const result = await extractEventBridgeMetadata(awsCfg);
+            servicesMeta.eventbridge = result;
+            s.succeed(chalk.green('EventBridge') + chalk.dim(`  ${result.length} rule(s)`));
+        }
+        catch (err) {
+            s.warn(chalk.yellow('EventBridge skipped') + chalk.dim(`  ${err instanceof Error ? err.message : String(err)}`));
+        }
+    }
     // ── RDS ──────────────────────────────────────────────────────────────────────
     if (config.rds?.enabled === true) {
         const s = mkSpinner('Extracting RDS instances...');
@@ -246,6 +258,7 @@ export async function runAnalyze(options = {}) {
             ...(config.lambda?.enabled === true ? [
                 new LambdaDefaultMemoryAnalyzer(),
                 new LambdaHighTimeoutAnalyzer(),
+                new LambdaMissingTriggerDLQAnalyzer(),
             ] : []),
             ...(config.rds?.enabled === true ? [
                 new RDSPubliclyAccessibleAnalyzer(),

package/dist/cli/commands/dev.js

@@ -20,6 +20,7 @@ const TOOL_MAP = [
     { name: 'get_secrets_overview', service: 'secretsManager' },
     { name: 'get_parameter_overview', service: 'ssm' },
     { name: 'get_lambda_overview', service: 'lambda' },
+    { name: 'get_eventbridge_details', service: 'eventbridge' },
     { name: 'get_log_errors', service: 'cloudwatchLogs' },
 ];
 function isEnabled(cfg, service) {
@@ -70,7 +71,7 @@ export async function runDev(options = {}) {
     const cachedFindings = readCache('findings');
     if (cachedGraph && cachedFindings) {
         log.success('Cached analysis loaded', `${cachedGraph.nodes.length} nodes · ${cachedGraph.edges.length} edges · ${cachedFindings.length} finding(s)`);
-        setGraphState(cachedGraph, cachedFindings);
+        setGraphState(cachedGraph, cachedFindings, config);
     }
     else {
         log.warn('No cache found — running analysis now...');
@@ -78,7 +79,7 @@ export async function runDev(options = {}) {
         await runAnalyze({ repo: repoPath, config: options.config });
         const freshGraph = readCache('graph') ?? { nodes: [], edges: [] };
         const freshFindings = readCache('findings') ?? [];
-        setGraphState(freshGraph, freshFindings);
+        setGraphState(freshGraph, freshFindings, config);
     }
     console.log('');
     // Start server
@@ -145,7 +146,7 @@ export async function runDev(options = {}) {
                 const spin = ora({ text: chalk.dim('Refreshing code analysis...'), color: 'cyan' }).start();
                 try {
                     const { graph, findings } = await runCodeRefresh(repoPath, config);
-                    setGraphState(graph, findings);
+                    setGraphState(graph, findings, config);
                     spin.succeed(chalk.green('Analysis refreshed') + chalk.dim(`  ${graph.nodes.length} nodes · ${findings.length} finding(s)`));
                 }
                 catch (err) {

package/dist/cli/commands/doctor.js

@@ -8,7 +8,7 @@ import { probeDynamoAccess } from '../../adapters/dynamodb.js';
 import { validatePostgresAccess } from '../../adapters/postgres.js';
 import { validateMySQLAccess } from '../../adapters/mysql.js';
 import { validateMongoAccess } from '../../adapters/mongodb.js';
-import { validateSQSAccess, validateSNSAccess, validateSSMAccess, validateSecretsAccess, validateLambdaAccess, } from '../../adapters/aws.js';
+import { validateSQSAccess, validateSNSAccess, validateSSMAccess, validateSecretsAccess, validateLambdaAccess, validateEventBridgeAccess, } from '../../adapters/aws.js';
 import { validateLogsAccess } from '../../adapters/logs.js';
 import { printHeader } from '../utils.js';
 async function runCheck(label, fn) {
@@ -173,6 +173,22 @@ export async function runDoctor(options = {}) {
             };
         }
     }));
+    // EventBridge
+    results.push(await runCheck('Testing EventBridge access...', async () => {
+        if (config?.eventbridge?.enabled !== true)
+            return { name: 'EventBridge', status: 'skip', message: 'Disabled in config' };
+        try {
+            await validateEventBridgeAccess(awsCfg);
+            return { name: 'EventBridge', status: 'pass', message: 'Connected' };
+        }
+        catch (err) {
+            return {
+                name: 'EventBridge', status: 'warn',
+                message: err instanceof Error ? err.message : String(err),
+                detail: 'Check IAM: events:ListRules, events:ListTargetsByRule',
+            };
+        }
+    }));
     // CloudWatch Logs
     results.push(await runCheck('Testing CloudWatch Logs access...', async () => {
         if (!config?.cloudwatchLogs?.enabled)

package/dist/cli/commands/init.js

@@ -29,7 +29,7 @@ export async function runInit(options = {}) {
             default: repoName,
         },
         {
-            type: 'list',
+            type: 'select',
             name: 'awsProfile',
             message: 'AWS profile:',
             choices: [
@@ -155,6 +155,18 @@ export async function runInit(options = {}) {
             message: 'Introspect Lambda functions?',
             default: true,
         },
+        {
+            type: 'confirm',
+            name: 'eventbridgeEnabled',
+            message: 'Introspect EventBridge rules?',
+            default: true,
+        },
+        {
+            type: 'confirm',
+            name: 'rdsEnabled',
+            message: 'Introspect RDS instances?',
+            default: true,
+        },
         {
             type: 'confirm',
             name: 'logsEnabled',
@@ -195,6 +207,8 @@ export async function runInit(options = {}) {
         ssm: { enabled: services.ssmEnabled, paths: ssmPaths },
         secretsManager: { enabled: services.secretsEnabled },
         lambda: { enabled: services.lambdaEnabled },
+        eventbridge: { enabled: services.eventbridgeEnabled },
+        rds: { enabled: services.rdsEnabled },
         cloudwatchLogs: {
             enabled: services.logsEnabled,
             logGroupPrefixes,

package/dist/core/config.js

@@ -6,7 +6,7 @@ export const InfrawiseConfigSchema = z.object({
     project: z.string().min(1, 'Project name is required'),
     aws: z
         .object({
-        profile: z.string().optional().default('default'),
+        profile: z.string().optional().default(''),
         region: z.string().optional().default('us-east-1'),
         endpoint: z.string().optional(),
     })
@@ -34,7 +34,11 @@ export const InfrawiseConfigSchema = z.object({
         paths: z.array(z.string()).optional(),
     }).optional(),
     secretsManager: z.object({ enabled: z.boolean().optional().default(true) }).optional(),
-    lambda: z.object({ enabled: z.boolean().optional().default(true) }).optional(),
+    lambda: z.object({
+        enabled: z.boolean().optional().default(true),
+        includeFunctions: z.array(z.string()).optional(),
+    }).optional(),
+    eventbridge: z.object({ enabled: z.boolean().optional().default(true) }).optional(),
     rds: z.object({ enabled: z.boolean().optional().default(false) }).optional(),
     kafka: z.object({ enabled: z.boolean().optional().default(false) }).optional(),
     cloudwatchLogs: z.object({
@@ -94,7 +98,7 @@ export function generateDefaultConfig(projectName, options) {
     const config = {
         project: projectName,
         aws: {
-            profile: options?.aws?.profile ?? 'default',
+            profile: options?.aws?.profile ?? '',
             region: options?.aws?.region ?? 'us-east-1',
             ...(options?.aws?.endpoint ? { endpoint: options.aws.endpoint } : {}),
         },
@@ -121,6 +125,8 @@ export function generateDefaultConfig(projectName, options) {
         },
         secretsManager: { enabled: options?.secretsManager?.enabled ?? true },
         lambda: { enabled: options?.lambda?.enabled ?? true },
+        eventbridge: { enabled: options?.eventbridge?.enabled ?? true },
+        rds: { enabled: options?.rds?.enabled ?? true },
         cloudwatchLogs: {
             enabled: options?.cloudwatchLogs?.enabled ?? false,
             logGroupPrefixes: options?.cloudwatchLogs?.logGroupPrefixes ?? [],

package/dist/graph/index.js

@@ -102,15 +102,69 @@ export function buildGraph(operations, dynamoMeta, postgresMeta, mysqlMeta = [],
         });
     }
     for (const fn of servicesMeta.lambda ?? []) {
+        const lambdaId = `lambda:aws:${fn.name}`;
         addNode({
-            id: `lambda:aws:${fn.name}`,
+            id: lambdaId,
             type: 'lambda',
             name: fn.name,
             runtime: fn.runtime,
             memoryMB: fn.memoryMB,
             timeoutSec: fn.timeoutSec,
             envVarKeys: fn.envVarKeys,
+            triggers: fn.triggers,
         });
+        // Add trigger edges from source → lambda (only for enabled/active mappings)
+        for (const trigger of fn.triggers ?? []) {
+            if (trigger.state && trigger.state !== 'Enabled')
+                continue;
+            let sourceId;
+            if (trigger.type === 'sqs') {
+                sourceId = `queue:aws:${trigger.sourceName}`;
+                addNode({ id: sourceId, type: 'queue', name: trigger.sourceName, provider: 'aws', hasDLQ: false, encrypted: false });
+            }
+            else if (trigger.type === 'dynamodb') {
+                sourceId = `table:dynamo:${trigger.sourceName}`;
+                addNode({ id: sourceId, type: 'table', name: trigger.sourceName, databaseType: 'dynamodb' });
+            }
+            else if (trigger.type === 'kinesis') {
+                sourceId = `queue:aws:${trigger.sourceName}`;
+                addNode({ id: sourceId, type: 'queue', name: trigger.sourceName, provider: 'aws', hasDLQ: false, encrypted: false });
+            }
+            else {
+                continue;
+            }
+            edges.push({ from: sourceId, to: lambdaId, type: 'triggers' });
+        }
+    }
+    for (const rule of servicesMeta.eventbridge ?? []) {
+        const ruleId = `eventbridge_rule:aws:${rule.name}`;
+        addNode({
+            id: ruleId,
+            type: 'eventbridge_rule',
+            name: rule.name,
+            state: rule.state,
+            scheduleExpression: rule.scheduleExpression,
+            eventPattern: rule.eventPattern,
+        });
+        for (const targetArn of rule.targetArns) {
+            const fnName = targetArn.split(':').pop() ?? '';
+            const lambdaId = `lambda:aws:${fnName}`;
+            if (!nodeIds.has(lambdaId))
+                continue;
+            edges.push({ from: ruleId, to: lambdaId, type: 'triggers' });
+            const lambdaNodeRef = nodes.find((n) => n.id === lambdaId);
+            if (lambdaNodeRef && lambdaNodeRef.type === 'lambda') {
+                const trigger = {
+                    type: 'eventbridge',
+                    sourceArn: rule.arn,
+                    sourceName: rule.name,
+                    eventShape: 'event.detail',
+                    ruleName: rule.name,
+                    eventPattern: rule.scheduleExpression ?? rule.eventPattern ?? '',
+                };
+                lambdaNodeRef.triggers = [...(lambdaNodeRef.triggers ?? []), trigger];
+            }
+        }
     }
     for (const db of servicesMeta.rds ?? []) {
         addNode({
@@ -236,6 +290,9 @@ export function getLogGroupNodes(graph) {
 export function getLambdaNodes(graph) {
     return graph.nodes.filter((n) => n.type === 'lambda');
 }
+export function getEventBridgeRuleNodes(graph) {
+    return graph.nodes.filter((n) => n.type === 'eventbridge_rule');
+}
 export function getEdgesForNode(graph, nodeId) {
     return graph.edges.filter((e) => e.from === nodeId || e.to === nodeId);
 }

package/dist/server/index.js

@@ -8,11 +8,11 @@ import { z } from 'zod';
 import { logger } from '../core/index.js';
 const { version } = JSON.parse(readFileSync(join(import.meta.dirname, '../../package.json'), 'utf8'));
 import { summarizeFindings } from '../analyzers/index.js';
-import { getTableNodes, getFunctionNodes, getQueueNodes, getTopicNodes, getSecretNodes, getParameterNodes, getLogGroupNodes, getLambdaNodes, getScanEdges, getOutgoingEdges, } from '../graph/index.js';
+import { getTableNodes, getFunctionNodes, getQueueNodes, getTopicNodes, getSecretNodes, getParameterNodes, getLogGroupNodes, getLambdaNodes, getEventBridgeRuleNodes, getScanEdges, getOutgoingEdges, } from '../graph/index.js';
 // ── State ────────────────────────────────────────────────────────────────────
 let currentGraph = { nodes: [], edges: [] };
 let currentFindings = [];
-export function setGraphState(graph, findings) {
+export function setGraphState(graph, findings, _config) {
     currentGraph = graph;
     currentFindings = findings;
 }
@@ -76,21 +76,28 @@ export function createMcpServer() {
         },
     })));
     mcp.registerTool('analyze_function', {
-        description: 'Analyze a specific function for all infrastructure issues: DB queries, queue publishing, secret access, etc.',
+        description: 'Analyze a specific function for all infrastructure issues: DB queries, queue publishing, secret access, trigger event shapes, etc.',
         inputSchema: z.object({ function: z.string().describe('Function name to analyze') }),
     }, logged('analyze_function', async ({ function: functionName }) => {
         const funcNode = currentGraph.nodes.find((n) => n.type === 'function' && n.name === functionName);
-        if (!funcNode) {
+        // Also check if there's a Lambda node with this name (for AWS-deployed functions)
+        const lambdaNode = currentGraph.nodes.find((n) => n.type === 'lambda' && n.name === functionName);
+        if (!funcNode && !lambdaNode) {
             return toText({ function: functionName, found: false, issues: [], recommendations: [`Function "${functionName}" not found in the analyzed codebase.`] });
         }
-        const outEdges = getOutgoingEdges(currentGraph, funcNode.id);
+        const outEdges = funcNode ? getOutgoingEdges(currentGraph, funcNode.id) : [];
         const relatedFindings = currentFindings.filter((f) => {
             const meta = f.metadata;
             return meta?.functionName === functionName || String(meta?.callerFunctions ?? '').includes(functionName);
         });
+        const allTriggers = lambdaNode?.type === 'lambda' ? (lambdaNode.triggers ?? []) : [];
         return toText({
             function: functionName, found: true,
-            file: funcNode.type === 'function' ? funcNode.file : undefined,
+            file: funcNode?.type === 'function' ? funcNode.file : undefined,
+            triggers: allTriggers.map((t) => ({
+                type: t.type, source: t.sourceName, eventShape: t.eventShape,
+                ...(t.ruleName ? { ruleName: t.ruleName, eventPattern: t.eventPattern } : {}),
+            })),
             accesses: outEdges.map((e) => {
                 const target = currentGraph.nodes.find((n) => n.id === e.to);
                 return { targetId: e.to, edgeType: e.type, targetName: target && 'name' in target ? target.name : e.to, targetType: target?.type };
@@ -220,7 +227,7 @@ export function createMcpServer() {
         });
     }));
     mcp.registerTool('get_lambda_overview', {
-        description: 'Returns all Lambda functions: runtime, memory, timeout, env var key names (values never included).',
+        description: 'Returns all Lambda functions: runtime, memory, timeout, env var key names (values never included), and known event source triggers with correct handler event shapes.',
         inputSchema: z.object({}),
     }, logged('get_lambda_overview', async () => {
         const lambdas = getLambdaNodes(currentGraph);
@@ -230,10 +237,31 @@ export function createMcpServer() {
             lambdas: lambdas.map((l) => ({
                 name: l.name, runtime: l.runtime, memoryMB: l.memoryMB, timeoutSec: l.timeoutSec,
                 envVarCount: l.envVarKeys?.length ?? 0, envVarKeys: l.envVarKeys,
+                triggers: (l.triggers ?? []).map((t) => ({ type: t.type, source: t.sourceName, eventShape: t.eventShape, state: t.state })),
                 findings: lambdaFindings.filter((f) => f.metadata.functionName === l.name).map((f) => ({ severity: f.severity, issue: f.issue })),
             })),
         });
     }));
+    mcp.registerTool('get_eventbridge_details', {
+        description: 'Returns all EventBridge rules: name, state, schedule expression or event pattern, and target Lambda functions.',
+        inputSchema: z.object({}),
+    }, logged('get_eventbridge_details', async () => {
+        const rules = getEventBridgeRuleNodes(currentGraph);
+        return toText({
+            total: rules.length,
+            rules: rules.map((r) => ({
+                name: r.name,
+                state: r.state,
+                scheduleExpression: r.scheduleExpression,
+                eventPattern: r.eventPattern,
+                targets: currentGraph.edges
+                    .filter((e) => e.from === r.id && e.type === 'triggers')
+                    .map((e) => currentGraph.nodes.find((n) => n.id === e.to))
+                    .filter(Boolean)
+                    .map((n) => n && 'name' in n ? n.name : ''),
+            })),
+        });
+    }));
     mcp.registerTool('get_log_errors', {
         description: 'Returns recent error patterns from CloudWatch log groups. Returns pattern counts and frequencies — never raw log messages.',
         inputSchema: z.object({ logGroup: z.string().describe('Filter to a specific log group name (optional)').optional() }),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "infrawise",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "mcpName": "io.github.Sidd27/infrawise",
   "description": "CLI-first infrastructure intelligence platform — analyzes DynamoDB, PostgreSQL, MySQL, MongoDB, SQS, SNS, SSM, Secrets Manager, Lambda, CloudWatch Logs and exposes findings as an MCP server for Claude Code",
   "keywords": [
@@ -54,6 +54,7 @@
   "dependencies": {
     "@aws-sdk/client-cloudwatch-logs": "^3.1048.0",
     "@aws-sdk/client-dynamodb": "^3.1048.0",
+    "@aws-sdk/client-eventbridge": "^3.1051.0",
     "@aws-sdk/client-lambda": "^3.1048.0",
     "@aws-sdk/client-rds": "^3.1048.0",
     "@aws-sdk/client-secrets-manager": "^3.1048.0",