infrawise 0.7.0 → 0.7.2

package/README.md

@@ -4,6 +4,7 @@
 [![Publish to npm](https://github.com/Sidd27/infrawise/actions/workflows/npm-publish.yml/badge.svg)](https://github.com/Sidd27/infrawise/actions/workflows/npm-publish.yml)
 [![CI](https://github.com/Sidd27/infrawise/actions/workflows/ci.yml/badge.svg)](https://github.com/Sidd27/infrawise/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
+[![infrawise MCP server](https://glama.ai/mcp/servers/Sidd27/infrawise/badges/score.svg)](https://glama.ai/mcp/servers/Sidd27/infrawise)
 
 **Understand your infrastructure, not just your code.**
 
@@ -22,12 +23,14 @@ AI coding assistants can read your source files but have no deterministic knowle
 Infrawise replaces guessing with infrastructure-aware context.
 
 **Without Infrawise**, an AI assistant might:
+
 - Suggest a `.scan()` on your Orders table that has 50M rows
 - Recommend adding a GSI on `status` that you already have
 - Write a `SELECT *` when you need to keep query cost low
 - Not notice that 5 functions are already hammering the same partition key
 
 **With Infrawise**, it knows:
+
 - Your exact table schemas, partition keys, sort keys, and GSIs
 - Which functions query which tables and how
 - Which patterns are already flagged as high severity
@@ -157,34 +160,56 @@ To let Claude Code manage the server lifecycle automatically:
 
 ### MCP tools
 
-| Tool | What it provides |
-|---|---|
-| `get_infra_overview` | Complete snapshot — all services, counts, and high-severity findings |
-| `get_graph_summary` | Full infrastructure graph — all nodes, edges, and findings |
-| `analyze_function` | Issues in a specific function — scans, missing indexes, N+1, trigger event shapes |
-| `suggest_gsi` | Exact GSI config for a DynamoDB table + attribute |
-| `postgres_index_suggestions` | Exact `CREATE INDEX` SQL for your actual table |
-| `suggest_mongo_index` | Exact `createIndex` command for a MongoDB collection + field |
-| `mysql_index_suggestions` | Exact `ALTER TABLE ADD INDEX` SQL for your MySQL table |
-| `get_queue_details` | SQS queues — DLQ status, encryption, message counts |
-| `get_topic_details` | SNS topics — subscription counts and protocols |
-| `get_secrets_overview` | Secrets Manager — names and rotation status (values never included) |
-| `get_parameter_overview` | SSM Parameter Store — names, types, tiers (values never included) |
-| `get_lambda_overview` | Lambda functions — runtime, memory, timeout, triggers (SQS/DynamoDB/Kinesis/EventBridge), env var key names |
-| `get_eventbridge_details` | EventBridge rules — name, state, schedule/event pattern, target functions |
-| `get_log_errors` | CloudWatch error patterns and counts (no raw log messages) |
+| Tool                         | What it provides                                                                                            |
+| ---------------------------- | ----------------------------------------------------------------------------------------------------------- |
+| `get_infra_overview`         | Complete snapshot — all services, counts, and high-severity findings                                        |
+| `get_graph_summary`          | Full infrastructure graph — all nodes, edges, and findings                                                  |
+| `analyze_function`           | Issues in a specific function — scans, missing indexes, N+1, trigger event shapes                           |
+| `suggest_gsi`                | Exact GSI config for a DynamoDB table + attribute                                                           |
+| `postgres_index_suggestions` | Exact `CREATE INDEX` SQL for your actual table                                                              |
+| `suggest_mongo_index`        | Exact `createIndex` command for a MongoDB collection + field                                                |
+| `mysql_index_suggestions`    | Exact `ALTER TABLE ADD INDEX` SQL for your MySQL table                                                      |
+| `get_queue_details`          | SQS queues — DLQ status, encryption, message counts                                                         |
+| `get_topic_details`          | SNS topics — subscription counts and protocols                                                              |
+| `get_secrets_overview`       | Secrets Manager — names and rotation status (values never included)                                         |
+| `get_parameter_overview`     | SSM Parameter Store — names, types, tiers (values never included)                                           |
+| `get_lambda_overview`        | Lambda functions — runtime, memory, timeout, triggers (SQS/DynamoDB/Kinesis/EventBridge), env var key names |
+| `get_eventbridge_details`    | EventBridge rules — name, state, schedule/event pattern, target functions                                   |
+| `get_log_errors`             | CloudWatch error patterns and counts (no raw log messages)                                                  |
 
 ---
 
 ## CLI reference
 
-| Command | What it does |
-|---|---|
-| `infrawise init` | Detect AWS + repo, generate `infrawise.yaml` |
-| `infrawise auth` | Select or switch AWS profile |
-| `infrawise analyze` | Scan repo + AWS, build graph, print findings |
-| `infrawise dev` | Start MCP server — auto-analyzes if no cache, watches files for live refresh |
-| `infrawise doctor` | Validate AWS access, DB connectivity, and config |
+| Command             | What it does                                                                 |
+| ------------------- | ---------------------------------------------------------------------------- |
+| `infrawise init`    | Detect AWS + repo, generate `infrawise.yaml`                                 |
+| `infrawise auth`    | Select or switch AWS profile                                                 |
+| `infrawise analyze` | Scan repo + AWS, build graph, print findings                                 |
+| `infrawise dev`     | Start MCP server — auto-analyzes if no cache, watches files for live refresh |
+| `infrawise stdio`   | Start MCP server on stdio transport (for Claude Desktop)                     |
+| `infrawise doctor`  | Validate AWS access, DB connectivity, and config                             |
+
+### `infrawise analyze` options
+
+| Flag                  | Description                                                            |
+| --------------------- | ---------------------------------------------------------------------- |
+| `-c, --config <path>` | Path to `infrawise.yaml` (default: `infrawise.yaml`)                   |
+| `-r, --repo <path>`   | Repository to scan (default: current directory)                        |
+| `--no-cache`          | Skip reading/writing the cache                                         |
+| `-o, --output <path>` | Save findings as a markdown report, e.g. `report.md`                   |
+| `--severity <level>`  | Only show findings at or above this level: `high` \| `medium` \| `low` |
+
+```bash
+# Export a shareable findings report
+infrawise analyze --output report.md
+
+# Only show high-severity issues
+infrawise analyze --severity high
+
+# High-severity issues only, saved to a file
+infrawise analyze --severity high --output report.md
+```
 
 ---
 
@@ -206,12 +231,12 @@ Full example:
 project: payments-service
 
 aws:
-  profile: default          # AWS profile from ~/.aws/credentials
+  profile: default # AWS profile from ~/.aws/credentials
   region: ap-south-1
 
 dynamodb:
   enabled: true
-  includeTables:            # omit to include all tables
+  includeTables: # omit to include all tables
     - Orders
     - Users
 
@@ -221,11 +246,11 @@ postgres:
 
 mysql:
   enabled: false
-  connectionString: ""
+  connectionString: ''
 
 mongodb:
   enabled: false
-  connectionString: ""
+  connectionString: ''
 
 sqs:
   enabled: true
@@ -235,16 +260,16 @@ sns:
 
 ssm:
   enabled: true
-  paths: []                 # filter by prefix e.g. ["/myapp/prod"]
+  paths: [] # filter by prefix e.g. ["/myapp/prod"]
 
 secretsManager:
   enabled: true
 
 lambda:
   enabled: true
-  includeFunctions:           # omit to include all functions
-    - processOrders
-    - generateReport
+  includeFunctions: # omit to include all functions
+    - myFunction
+    - anotherFunction
 
 eventbridge:
   enabled: true
@@ -274,10 +299,7 @@ Infrawise is **read-only**. Minimum IAM policy required:
   "Statement": [
     {
       "Effect": "Allow",
-      "Action": [
-        "dynamodb:ListTables",
-        "dynamodb:DescribeTable"
-      ],
+      "Action": ["dynamodb:ListTables", "dynamodb:DescribeTable"],
       "Resource": "*"
     }
   ]
@@ -313,36 +335,36 @@ Infrawise has two analysis layers:
 
 Works from AWS APIs, database schema introspection, and IaC files — no dependency on application code:
 
-| Service | What it checks |
-|---|---|
-| DynamoDB schema | Tables, GSIs, partition keys |
-| PostgreSQL / MySQL schema | Tables, indexes, column types |
-| MongoDB schema | Collections, indexes |
-| SQS | Missing DLQs, unencrypted queues, large backlogs |
-| Kafka (kafkajs) | Producer/consumer topic mapping from code |
-| Secrets Manager | Missing secret rotation |
-| Lambda | Default memory (128 MB), high timeouts, triggers (SQS/DynamoDB/Kinesis/EventBridge), missing DLQ on trigger source |
-| EventBridge | Rules, schedules, event patterns, target Lambda functions |
-| RDS | Publicly accessible, no backups, unencrypted, no deletion protection, single-AZ |
-| CloudWatch Logs | Log groups with no retention policy |
-| Terraform / CloudFormation / CDK | IaC drift vs deployed state |
+| Service                          | What it checks                                                                                                     |
+| -------------------------------- | ------------------------------------------------------------------------------------------------------------------ |
+| DynamoDB schema                  | Tables, GSIs, partition keys                                                                                       |
+| PostgreSQL / MySQL schema        | Tables, indexes, column types                                                                                      |
+| MongoDB schema                   | Collections, indexes                                                                                               |
+| SQS                              | Missing DLQs, unencrypted queues, large backlogs                                                                   |
+| Kafka (kafkajs)                  | Producer/consumer topic mapping from code                                                                          |
+| Secrets Manager                  | Missing secret rotation                                                                                            |
+| Lambda                           | Default memory (128 MB), high timeouts, triggers (SQS/DynamoDB/Kinesis/EventBridge), missing DLQ on trigger source |
+| EventBridge                      | Rules, schedules, event patterns, target Lambda functions                                                          |
+| RDS                              | Publicly accessible, no backups, unencrypted, no deletion protection, single-AZ                                    |
+| CloudWatch Logs                  | Log groups with no retention policy                                                                                |
+| Terraform / CloudFormation / CDK | IaC drift vs deployed state                                                                                        |
 
 ### Code correlation analysis (TypeScript / JavaScript)
 
 Uses [ts-morph](https://ts-morph.com/) AST analysis to detect which functions call which tables and how:
 
-| Analyzer | Severity | What it detects |
-|---|---|---|
-| Full Table Scan (DynamoDB) | High | `.scan()` calls without filters |
-| Missing GSI | Medium | Queries on attributes without a matching GSI |
-| Hot Partition | Medium | 5+ distinct code paths hitting the same table |
-| Missing Index (PostgreSQL) | Medium | Tables queried without indexes |
-| N+1 Query | Medium | Repeated query patterns from ORM loops |
-| Large SELECT | Low | `SELECT *` usage |
-| Missing MySQL Index | Medium | MySQL tables queried without indexes |
-| MySQL Full Table Scan | High | Full table scan patterns in MySQL queries |
-| Missing Mongo Index | Medium | Collections queried without secondary indexes |
-| Collection Scan | High | `find()` calls without filter predicates |
+| Analyzer                   | Severity | What it detects                               |
+| -------------------------- | -------- | --------------------------------------------- |
+| Full Table Scan (DynamoDB) | High     | `.scan()` calls without filters               |
+| Missing GSI                | Medium   | Queries on attributes without a matching GSI  |
+| Hot Partition              | Medium   | 5+ distinct code paths hitting the same table |
+| Missing Index (PostgreSQL) | Medium   | Tables queried without indexes                |
+| N+1 Query                  | Medium   | Repeated query patterns from ORM loops        |
+| Large SELECT               | Low      | `SELECT *` usage                              |
+| Missing MySQL Index        | Medium   | MySQL tables queried without indexes          |
+| MySQL Full Table Scan      | High     | Full table scan patterns in MySQL queries     |
+| Missing Mongo Index        | Medium   | Collections queried without secondary indexes |
+| Collection Scan            | High     | `find()` calls without filter predicates      |
 
 Non-TypeScript/JavaScript projects still get full value from infrastructure-level analyzers — code correlation (function-to-table mapping, N+1 patterns) is skipped.
 
@@ -377,29 +399,52 @@ Infrawise does not use an LLM to analyze your infrastructure. All extraction and
 
 ## Architecture overview
 
-```
-Your repo (any language)          Your repo (TS/JS only)
-        │                                  │
-        │                    Repository Scanner (ts-morph AST)
-        │                     which functions → which tables
-        │                                  │
-┌───────┴──────────────────────────────────┴────────────┐
-│  infrawise analyze                                    │
-│                                                       │
-│  AWS APIs / DB schema / IaC files  +  Code ops (opt)  │
-│         (works for any project)      (TS/JS only)     │
-│                          │                            │
-│                     Graph Engine                      │
-│                   (nodes + edges)                     │
-│                          │                            │
-│                   Analyzer Engine                     │
-│               (rule-based, deterministic)             │
-└─────────────────────────┬─────────────────────────────┘
-                          │
-               ┌──────────────────┐
-               │   MCP Server     │ ◄── Claude Code
-               │  localhost:3000  │ ◄── Cursor
-               └──────────────────┘ ◄── Windsurf
+```mermaid
+flowchart LR
+    subgraph IN["Your Infrastructure & Code"]
+        direction TB
+        D["DynamoDB"]
+        L["Lambda · SQS · SNS\nEventBridge · RDS"]
+        S["Secrets Manager · SSM\nCloudWatch"]
+        P["PostgreSQL · MySQL"]
+        M["MongoDB"]
+        T["Terraform · CDK\nCloudFormation"]
+        C["TypeScript / JS"]
+    end
+
+    A["Adapters"]
+    G["Graph Engine"]
+    AN["23 Analyzers"]
+    CA["Cache"]
+
+    subgraph SV["infrawise dev"]
+        MCP["MCP Server\nlocalhost:3000/mcp"]
+    end
+
+    subgraph AI["AI Coding Assistants"]
+        direction TB
+        CC["Claude Code"]
+        CU["Cursor"]
+        WS["Windsurf"]
+    end
+
+    D & L & S & P & M & T & C --> A
+    A --> G --> AN --> CA --> MCP
+    MCP --> CC & CU & WS
+
+    classDef aws fill:#FF9900,stroke:#232F3E,color:#000
+    classDef db fill:#336791,stroke:#1a3a5c,color:#fff
+    classDef iac fill:#7B42BC,stroke:#4a2080,color:#fff
+    classDef code fill:#3178C6,stroke:#1a4a80,color:#fff
+    classDef iw fill:#1a1a2e,stroke:#e94560,color:#fff
+    classDef ai fill:#10a37f,stroke:#0a6b54,color:#fff
+
+    class D,L,S aws
+    class P,M db
+    class T iac
+    class C code
+    class A,G,AN,CA,MCP iw
+    class CC,CU,WS ai
 ```
 
 ### Source layout
@@ -409,8 +454,10 @@ src/
   types.ts      Shared type definitions
   core/         Config (Zod + YAML), logger (Pino), local cache
   graph/        Graph engine — nodes, edges, builder
-  adapters/     Flat extractors: dynamodb.ts, postgres.ts, mysql.ts,
-                mongodb.ts, aws.ts, logs.ts, terraform.ts
+  adapters/
+    aws/        DynamoDB, Lambda, SQS/SNS/SSM/Secrets/EventBridge/RDS, CloudWatch
+    db/         PostgreSQL, MySQL, MongoDB
+    iac/        Terraform, CDK, CloudFormation (local file parsing)
   analyzers/    23 rule-based analyzers
   context/      Repository scanner (ts-morph AST)
   server/       Fastify MCP server (@modelcontextprotocol/sdk, Streamable HTTP)
@@ -430,20 +477,7 @@ src/
 
 ## Roadmap
 
-Feature roadmap is tracked in the [GitHub Project](https://github.com/users/Sidd27/projects/1). Priorities, complexity, and virality scores are visible there. Feature requests and upvotes welcome.
-
-### Planned
-- Runtime tracing integration
-- Incremental analysis for large monorepos
-- Kubernetes workload graphing
-- VS Code extension
-- Infrastructure drift detection
-- MSK (Amazon Managed Streaming for Apache Kafka) — cluster metadata + topic listing via MSK API and Kafka admin client
-
-### Under consideration
-- OpenTelemetry integration
-- CI/CD reporting mode
-- Multi-repository graph correlation
+Feature roadmap is tracked in the [GitHub Project](https://github.com/users/Sidd27/projects/1). Feature requests and upvotes welcome.
 
 ---
 
@@ -455,47 +489,7 @@ The `demo/localstack/` directory runs infrawise against real AWS APIs emulated l
 
 ## Contributing
 
-### Prerequisites
-
-Node.js 24+, pnpm 9+, AWS CLI (for integration testing).
-
-### Setup
-
-```bash
-git clone https://github.com/Sidd27/infrawise
-cd infrawise
-pnpm install
-pnpm build
-```
-
-### Development workflow
-
-```bash
-pnpm build        # compile
-pnpm test         # run all tests
-pnpm typecheck    # TypeScript strict check
-pnpm lint         # ESLint
-```
-
-### Adding a new analyzer
-
-1. Create your analyzer in `src/analyzers/`
-2. Implement the `Analyzer` interface:
-```ts
-export class MyAnalyzer implements Analyzer {
-  name = 'MyAnalyzer';
-  async analyze(graph: SystemGraph): Promise<Finding[]> { ... }
-}
-```
-3. Export it from `src/analyzers/index.ts`
-4. Add tests in `src/analyzers/__tests__/`
-
-### Adding a new database adapter
-
-1. Create your extractor as `src/adapters/yourdb.ts`
-2. Export a function returning `Promise<YourTableMetadata[]>`
-3. Add the metadata type to `src/types.ts` if needed
-4. Wire it into `src/cli/commands/analyze.ts`
+See [CONTRIBUTING.md](CONTRIBUTING.md) for a full walkthrough — including how to add a new service adapter, a new analyzer, and the PR checklist.
 
 ### Releasing
 
@@ -508,14 +502,6 @@ pnpm release 1.5.0    # explicit version
 
 Bumps `package.json`, commits, tags, pushes, and creates a draft GitHub release with notes from commit messages. Then publish the draft on GitHub to trigger npm publish.
 
-### PR checklist
-
-- `pnpm lint` passes
-- `pnpm typecheck` passes
-- `pnpm test` passes
-- New analyzers have unit tests with mock graph data
-- No hardcoded AWS regions or credentials
-
 ---
 
 ## License

package/dist/adapters/{dynamodb.js → aws/dynamodb.js}

@@ -1,6 +1,6 @@
 import { DynamoDBClient, ListTablesCommand, DescribeTableCommand, } from '@aws-sdk/client-dynamodb';
 import { fromIni } from '@aws-sdk/credential-providers';
-import { DynamoDBError, logger } from '../core/index.js';
+import { DynamoDBError, logger } from '../../core/index.js';
 function createDynamoClient(config) {
     const region = config.aws?.region ?? 'us-east-1';
     const profile = config.aws?.profile;

package/dist/adapters/aws/index.js

@@ -0,0 +1,3 @@
+export * from './services.js';
+export * from './dynamodb.js';
+export * from './logs.js';

package/dist/adapters/{logs.js → aws/logs.js}

@@ -1,6 +1,6 @@
 import { CloudWatchLogsClient, DescribeLogGroupsCommand, FilterLogEventsCommand, } from '@aws-sdk/client-cloudwatch-logs';
 import { fromIni } from '@aws-sdk/credential-providers';
-import { logger } from '../core/index.js';
+import { logger } from '../../core/index.js';
 // Hard caps to prevent context bloat
 const MAX_LOG_GROUPS = 50;
 const MAX_EVENTS_PER_GROUP = 50;

package/dist/adapters/{aws.js → aws/services.js}

@@ -6,7 +6,7 @@ import { LambdaClient, ListFunctionsCommand, ListEventSourceMappingsCommand, } f
 import { EventBridgeClient, ListRulesCommand, ListTargetsByRuleCommand, } from '@aws-sdk/client-eventbridge';
 import { RDSClient, DescribeDBInstancesCommand, } from '@aws-sdk/client-rds';
 import { fromIni } from '@aws-sdk/credential-providers';
-import { logger } from '../core/index.js';
+import { logger } from '../../core/index.js';
 function clientConfig(cfg) {
     const region = cfg.region ?? 'us-east-1';
     const base = { region };

package/dist/adapters/db/index.js

@@ -0,0 +1,3 @@
+export * from './postgres.js';
+export * from './mysql.js';
+export * from './mongodb.js';

package/dist/adapters/{mongodb.js → db/mongodb.js}

@@ -1,5 +1,5 @@
 import { MongoClient } from 'mongodb';
-import { InfrawiseError, logger } from '../core/index.js';
+import { InfrawiseError, logger } from '../../core/index.js';
 const SYSTEM_DATABASES = new Set(['admin', 'local', 'config']);
 export class MongoConnectionError extends InfrawiseError {
     constructor(details) {

package/dist/adapters/{mysql.js → db/mysql.js}

@@ -1,5 +1,5 @@
 import mysql from 'mysql2/promise';
-import { InfrawiseError, logger } from '../core/index.js';
+import { InfrawiseError, logger } from '../../core/index.js';
 const SYSTEM_SCHEMAS = new Set(['information_schema', 'performance_schema', 'mysql', 'sys']);
 export class MySQLConnectionError extends InfrawiseError {
     constructor(details) {

package/dist/adapters/{postgres.js → db/postgres.js}

@@ -1,5 +1,5 @@
 import { Pool } from 'pg';
-import { PostgresConnectionError, logger } from '../core/index.js';
+import { PostgresConnectionError, logger } from '../../core/index.js';
 export async function extractPostgresMetadata(connectionString) {
     const pool = new Pool({
         connectionString,

package/dist/adapters/iac/index.js

@@ -0,0 +1 @@
+export * from './terraform.js';

package/dist/adapters/{terraform.js → iac/terraform.js}

@@ -1,7 +1,7 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import yaml from 'js-yaml';
-import { logger } from '../core/index.js';
+import { logger } from '../../core/index.js';
 function emptySchema() {
     return {
         dynamoTables: [],

package/dist/cli/commands/analyze.js

@@ -1,18 +1,43 @@
+import * as fs from 'fs';
 import * as path from 'path';
 import chalk from 'chalk';
 import ora from 'ora';
 import { loadConfig, formatError, writeCache, readCache } from '../../core/index.js';
-import { extractDynamoMetadata } from '../../adapters/dynamodb.js';
-import { extractPostgresMetadata } from '../../adapters/postgres.js';
-import { extractMySQLMetadata } from '../../adapters/mysql.js';
-import { extractMongoMetadata } from '../../adapters/mongodb.js';
-import { extractIaCSchema } from '../../adapters/terraform.js';
-import { extractSQSMetadata, extractSNSMetadata, extractSSMMetadata, extractSecretsMetadata, extractLambdaMetadata, extractEventBridgeMetadata, extractRDSMetadata, } from '../../adapters/aws.js';
-import { extractLogsMetadata } from '../../adapters/logs.js';
+import { extractDynamoMetadata } from '../../adapters/aws/dynamodb.js';
+import { extractPostgresMetadata } from '../../adapters/db/postgres.js';
+import { extractMySQLMetadata } from '../../adapters/db/mysql.js';
+import { extractMongoMetadata } from '../../adapters/db/mongodb.js';
+import { extractIaCSchema } from '../../adapters/iac/terraform.js';
+import { extractSQSMetadata, extractSNSMetadata, extractSSMMetadata, extractSecretsMetadata, extractLambdaMetadata, extractEventBridgeMetadata, extractRDSMetadata, } from '../../adapters/aws/services.js';
+import { extractLogsMetadata } from '../../adapters/aws/logs.js';
 import { scanRepository } from '../../context/index.js';
 import { buildGraph } from '../../graph/index.js';
 import { runAllAnalyzers, IaCDriftAnalyzer, FullTableScanAnalyzer, MissingGSIAnalyzer, HotPartitionAnalyzer, MissingIndexAnalyzer, NplusOneAnalyzer, LargeSelectAnalyzer, MissingMySQLIndexAnalyzer, MySQLFullTableScanAnalyzer, MissingMongoIndexAnalyzer, MongoCollectionScanAnalyzer, MissingDLQAnalyzer, UnencryptedQueueAnalyzer, LargeQueueBacklogAnalyzer, MissingSecretRotationAnalyzer, MissingLogRetentionAnalyzer, LambdaDefaultMemoryAnalyzer, LambdaHighTimeoutAnalyzer, LambdaMissingTriggerDLQAnalyzer, RDSPubliclyAccessibleAnalyzer, RDSNoBackupAnalyzer, RDSUnencryptedAnalyzer, RDSNoDeletionProtectionAnalyzer, RDSNoMultiAZAnalyzer, } from '../../analyzers/index.js';
 import { printFinding, printSummaryBox, log, printHeader } from '../utils.js';
+const SEVERITY_ORDER = { high: 3, medium: 2, low: 1 };
+function buildMarkdownReport(findings, projectName) {
+    const date = new Date().toISOString().split('T')[0];
+    const high = findings.filter((f) => f.severity === 'high');
+    const medium = findings.filter((f) => f.severity === 'medium');
+    const low = findings.filter((f) => f.severity === 'low');
+    const renderGroup = (label, emoji, group) => {
+        if (group.length === 0)
+            return '';
+        const rows = group.map((f) => `| ${f.issue} | ${f.recommendation} |`).join('\n');
+        return `\n## ${emoji} ${label} (${group.length})\n\n| Issue | Recommendation |\n|---|---|\n${rows}\n`;
+    };
+    return [
+        `# infrawise report — ${projectName}`,
+        `_Generated: ${date}_`,
+        '',
+        `**${findings.length} finding(s)**: ${high.length} high · ${medium.length} medium · ${low.length} low`,
+        renderGroup('High severity', '🔴', high),
+        renderGroup('Medium severity', '🟡', medium),
+        renderGroup('Low severity', '🟢', low),
+        '',
+        '_Generated by [infrawise](https://github.com/Sidd27/infrawise) — MCP server for AWS infrastructure analysis_',
+    ].filter((l) => l !== undefined).join('\n');
+}
 function mkSpinner(text) {
     return ora({ text: chalk.dim(text), color: 'cyan' }).start();
 }
@@ -28,6 +53,7 @@ export async function runAnalyze(options = {}) {
         process.exit(1);
     }
     const repoPath = options.repo ?? process.cwd();
+    const minSeverity = options.severity ? SEVERITY_ORDER[options.severity] ?? 1 : 0;
     const awsCfg = { region: config.aws?.region, profile: config.aws?.profile, endpoint: config.aws?.endpoint };
     const dynamoMeta = [];
     const postgresMeta = [];
@@ -278,18 +304,30 @@ export async function runAnalyze(options = {}) {
     writeCache('operations', operations);
     writeCache('meta', { dynamoMeta, postgresMeta, mysqlMeta, mongoMeta, servicesMeta });
     // ── Output ────────────────────────────────────────────────────────────────────
+    const displayFindings = minSeverity > 0
+        ? findings.filter((f) => (SEVERITY_ORDER[f.severity] ?? 0) >= minSeverity)
+        : findings;
     console.log('');
-    if (findings.length === 0) {
-        console.log(`  ${chalk.green.bold('✓ No issues found!')}  ${chalk.dim('Your infrastructure looks clean.')}`);
+    if (displayFindings.length === 0) {
+        const msg = minSeverity > 0 ? `No ${options.severity} (or higher) severity issues found.` : 'Your infrastructure looks clean.';
+        console.log(`  ${chalk.green.bold('✓ No issues found!')}  ${chalk.dim(msg)}`);
     }
     else {
-        console.log(chalk.bold(`  Findings`) + chalk.dim(`  ${findings.length} total`));
-        findings.forEach((f, i) => printFinding(f, i));
-        printSummaryBox(findings);
-        if (findings.some((f) => f.severity === 'high')) {
+        const filterNote = minSeverity > 0 ? chalk.dim(` (${options.severity}+ only)`) : '';
+        console.log(chalk.bold(`  Findings`) + chalk.dim(`  ${displayFindings.length} total`) + filterNote);
+        displayFindings.forEach((f, i) => printFinding(f, i));
+        printSummaryBox(displayFindings);
+        if (displayFindings.some((f) => f.severity === 'high')) {
             console.log(`\n  ${chalk.red.bold('Action required:')} ${chalk.red('High severity issues detected.')}`);
         }
     }
+    if (options.output) {
+        const report = buildMarkdownReport(displayFindings, config.project);
+        const outPath = path.resolve(options.output);
+        fs.writeFileSync(outPath, report, 'utf8');
+        console.log('');
+        log.success('Report saved', outPath);
+    }
     console.log('');
     log.dim(`Results cached in .infrawise/cache/`);
     log.info(`Run ${chalk.cyan('infrawise dev')} to explore via the MCP server`);

package/dist/cli/commands/auth.js

@@ -2,7 +2,7 @@ import chalk from 'chalk';
 import inquirer from 'inquirer';
 import ora from 'ora';
 import { readAWSProfiles, log, printHeader } from '../utils.js';
-import { validateDynamoAccess } from '../../adapters/dynamodb.js';
+import { validateDynamoAccess } from '../../adapters/aws/dynamodb.js';
 export async function runAuth() {
     printHeader('AWS Authentication');
     const profiles = readAWSProfiles();

package/dist/cli/commands/dev.js

@@ -54,7 +54,7 @@ function groupTools(tools) {
     return lines;
 }
 export async function runDev(options = {}) {
-    const port = options.port ?? 3000;
+    const port = options.port ?? (process.env.PORT ? parseInt(process.env.PORT, 10) : 3000);
     printHeader('MCP Server');
     let config;
     try {

package/dist/cli/commands/doctor.js

@@ -4,12 +4,12 @@ import * as os from 'os';
 import chalk from 'chalk';
 import ora from 'ora';
 import { loadConfig } from '../../core/index.js';
-import { probeDynamoAccess } from '../../adapters/dynamodb.js';
-import { validatePostgresAccess } from '../../adapters/postgres.js';
-import { validateMySQLAccess } from '../../adapters/mysql.js';
-import { validateMongoAccess } from '../../adapters/mongodb.js';
-import { validateSQSAccess, validateSNSAccess, validateSSMAccess, validateSecretsAccess, validateLambdaAccess, validateEventBridgeAccess, } from '../../adapters/aws.js';
-import { validateLogsAccess } from '../../adapters/logs.js';
+import { probeDynamoAccess } from '../../adapters/aws/dynamodb.js';
+import { validatePostgresAccess } from '../../adapters/db/postgres.js';
+import { validateMySQLAccess } from '../../adapters/db/mysql.js';
+import { validateMongoAccess } from '../../adapters/db/mongodb.js';
+import { validateSQSAccess, validateSNSAccess, validateSSMAccess, validateSecretsAccess, validateLambdaAccess, validateEventBridgeAccess, } from '../../adapters/aws/services.js';
+import { validateLogsAccess } from '../../adapters/aws/logs.js';
 import { printHeader } from '../utils.js';
 async function runCheck(label, fn) {
     const spin = ora({ text: chalk.dim(label), color: 'cyan' }).start();

package/dist/cli/commands/stdio.js

@@ -0,0 +1,28 @@
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { loadConfig, formatError, readCache } from '../../core/index.js';
+import { createMcpServer, setGraphState } from '../../server/index.js';
+import { runAnalyze } from './analyze.js';
+export async function runStdio(configPath) {
+    let config;
+    try {
+        config = loadConfig(configPath);
+    }
+    catch (err) {
+        process.stderr.write(formatError(err) + '\n');
+        process.exit(1);
+    }
+    const cachedGraph = readCache('graph');
+    const cachedFindings = readCache('findings');
+    if (cachedGraph && cachedFindings) {
+        setGraphState(cachedGraph, cachedFindings, config);
+    }
+    else {
+        await runAnalyze({ config: configPath });
+        const graph = readCache('graph') ?? { nodes: [], edges: [] };
+        const findings = readCache('findings') ?? [];
+        setGraphState(graph, findings, config);
+    }
+    const mcp = createMcpServer();
+    const transport = new StdioServerTransport();
+    await mcp.connect(transport);
+}

package/dist/cli/index.js

@@ -8,6 +8,7 @@ import { runAuth } from './commands/auth.js';
 import { runAnalyze } from './commands/analyze.js';
 import { runDev } from './commands/dev.js';
 import { runDoctor } from './commands/doctor.js';
+import { runStdio } from './commands/stdio.js';
 const { version } = JSON.parse(readFileSync(join(import.meta.dirname, '../../package.json'), 'utf8'));
 const program = new Command();
 program
@@ -35,12 +36,16 @@ program
     .option('-c, --config <path>', 'Path to infrawise.yaml', 'infrawise.yaml')
     .option('-r, --repo <path>', 'Path to repository to scan', process.cwd())
     .option('--no-cache', 'Skip reading/writing the cache')
+    .option('-o, --output <path>', 'Save findings as a markdown report (e.g. report.md)')
+    .option('--severity <level>', 'Only show findings at or above this level: high | medium | low')
     .action(async (options) => {
     printBanner();
     await runAnalyze({
         config: options.config !== 'infrawise.yaml' ? options.config : undefined,
         repo: options.repo,
         noCache: !options.cache,
+        output: options.output,
+        severity: options.severity,
     });
 });
 program
@@ -55,6 +60,13 @@ program
         port: parseInt(options.port, 10),
     });
 });
+program
+    .command('stdio')
+    .description('Start MCP server on stdio transport (for Claude Desktop and Glama)')
+    .option('-c, --config <path>', 'Path to infrawise.yaml', 'infrawise.yaml')
+    .action(async (options) => {
+    await runStdio(options.config !== 'infrawise.yaml' ? options.config : undefined);
+});
 program
     .command('doctor')
     .description('Validate AWS access, postgres connectivity, config, and repo scan')

package/dist/server/index.js

@@ -31,7 +31,7 @@ function logged(name, fn) {
 export function createMcpServer() {
     const mcp = new McpServer({ name: 'infrawise', version });
     mcp.registerTool('get_infra_overview', {
-        description: 'Returns a complete snapshot of all infrastructure: databases, queues, topics, secrets, parameters, log groups, lambdas, and all findings. Start here for a full picture.',
+        description: 'Returns a compact infrastructure snapshot: service counts, all databases, queues, topics, secrets, lambdas, and high-severity findings. Call this first at the start of any database or infrastructure task to understand what services are in scope. Prefer this over get_graph_summary for quick orientation; use get_graph_summary only when you need every node, edge, and finding in full.',
         inputSchema: z.object({}),
     }, logged('get_infra_overview', async () => {
         const tables = getTableNodes(currentGraph);
@@ -62,7 +62,7 @@ export function createMcpServer() {
         });
     }));
     mcp.registerTool('get_graph_summary', {
-        description: 'Returns the full infrastructure graph (all nodes and edges) plus findings summary.',
+        description: 'Returns every node (tables, functions, lambdas, queues, etc.), every edge (query, scan, triggers, publishes_to), and all findings. Use this when you need to trace relationships across multiple services or require the complete finding set — not just high-severity ones. For a quick overview use get_infra_overview instead.',
         inputSchema: z.object({}),
     }, logged('get_graph_summary', async () => toText({
         nodes: currentGraph.nodes,
@@ -76,7 +76,7 @@ export function createMcpServer() {
         },
     })));
     mcp.registerTool('analyze_function', {
-        description: 'Analyze a specific function for all infrastructure issues: DB queries, queue publishing, secret access, trigger event shapes, etc.',
+        description: 'Analyzes a single named function or Lambda handler for infrastructure issues: which tables it queries, how it queries them (scan vs query), queue publishing, secret access, and the correct event shape for each trigger (SQS, DynamoDB Streams, Kinesis, EventBridge). Call this before writing or reviewing a Lambda handler to get the exact trigger event shape and all findings scoped to this function. Returns found: false if the function name was not discovered during analysis.',
         inputSchema: z.object({ function: z.string().describe('Function name to analyze') }),
     }, logged('analyze_function', async ({ function: functionName }) => {
         const funcNode = currentGraph.nodes.find((n) => n.type === 'function' && n.name === functionName);
@@ -107,7 +107,7 @@ export function createMcpServer() {
         });
     }));
     mcp.registerTool('suggest_gsi', {
-        description: 'Get GSI suggestions for a DynamoDB table and attribute',
+        description: 'Generates a ready-to-use DynamoDB GSI definition — index name, partition key, projection type, billing mode — for a given table and attribute. Call this when a query pattern needs an index that does not exist yet, or when the analyzer flags a missing GSI finding. Does not verify whether the GSI already exists; check the table schema in get_infra_overview first.',
         inputSchema: z.object({
             table: z.string().describe('DynamoDB table name'),
             attribute: z.string().describe('Attribute to create the GSI on'),
@@ -125,7 +125,7 @@ export function createMcpServer() {
         });
     }));
     mcp.registerTool('postgres_index_suggestions', {
-        description: 'Get PostgreSQL index suggestions for a table column',
+        description: 'Generates the exact CREATE INDEX CONCURRENTLY SQL for a PostgreSQL table column, including a partial index variant and a post-creation ANALYZE reminder. Call this when the analyzer flags a missing index finding or when writing a query that filters on a column without an existing index. Does not verify whether the index already exists.',
         inputSchema: z.object({
             table: z.string().describe('PostgreSQL table name'),
             column: z.string().describe('Column name to index'),
@@ -143,7 +143,7 @@ export function createMcpServer() {
         });
     }));
     mcp.registerTool('suggest_mongo_index', {
-        description: 'Get index suggestions for a MongoDB collection field',
+        description: 'Generates the exact db.collection.createIndex() command for a MongoDB field, plus compound and text index variants and an explain query to verify. Call this when a collection scan is flagged by the analyzer or when writing a query that filters on an unindexed field. Does not check whether the index already exists.',
         inputSchema: z.object({
             collection: z.string().describe('MongoDB collection name'),
             field: z.string().describe('Field name to index'),
@@ -163,7 +163,7 @@ export function createMcpServer() {
         });
     }));
     mcp.registerTool('mysql_index_suggestions', {
-        description: 'Get MySQL index suggestions for a table column',
+        description: 'Generates the exact ALTER TABLE ADD INDEX SQL for a MySQL table column, including a composite variant and EXPLAIN guidance to verify the index is used. Call this when the analyzer flags a missing MySQL index or full table scan finding. Does not verify whether the index already exists.',
         inputSchema: z.object({
             table: z.string().describe('MySQL table name'),
             column: z.string().describe('Column name to index'),
@@ -181,7 +181,7 @@ export function createMcpServer() {
         });
     }));
     mcp.registerTool('get_queue_details', {
-        description: 'Returns all SQS queues with DLQ status, encryption, message counts, and retention.',
+        description: 'Returns all SQS queues with DLQ presence, encryption status, approximate message count, and retention days. Call this when reviewing messaging architecture, investigating a message backlog, or checking DLQ coverage before adding a new consumer. Use get_infra_overview for a quick queue count only.',
         inputSchema: z.object({}),
     }, logged('get_queue_details', async () => {
         const queues = getQueueNodes(currentGraph);
@@ -196,14 +196,14 @@ export function createMcpServer() {
         });
     }));
     mcp.registerTool('get_topic_details', {
-        description: 'Returns all SNS topics with subscription counts and protocols.',
+        description: 'Returns all SNS topics with subscription count and encryption status. Call this when reviewing event fan-out patterns or checking whether a topic has the expected number of subscribers.',
         inputSchema: z.object({}),
     }, logged('get_topic_details', async () => {
         const topics = getTopicNodes(currentGraph);
         return toText({ total: topics.length, topics: topics.map((t) => ({ name: t.name, provider: t.provider, subscriptionCount: t.subscriptionCount, encrypted: t.encrypted })) });
     }));
     mcp.registerTool('get_secrets_overview', {
-        description: 'Returns all Secrets Manager secrets: names, rotation status. Secret VALUES are never included.',
+        description: 'Returns all Secrets Manager secrets with rotation status and rotation interval. Secret values are never returned. Call this when checking which secrets exist, confirming rotation is enabled before a security review, or identifying secrets that lack rotation.',
         inputSchema: z.object({}),
     }, logged('get_secrets_overview', async () => {
         const secrets = getSecretNodes(currentGraph);
@@ -217,7 +217,7 @@ export function createMcpServer() {
         });
     }));
     mcp.registerTool('get_parameter_overview', {
-        description: 'Returns all SSM Parameter Store parameters: names, types, tiers. Parameter VALUES are never included.',
+        description: 'Returns all SSM Parameter Store parameters with type (String, SecureString, StringList) and tier (Standard, Advanced). Parameter values are never returned. Call this when checking which config parameters exist for a service or verifying parameter types.',
         inputSchema: z.object({}),
     }, logged('get_parameter_overview', async () => {
         const parameters = getParameterNodes(currentGraph);
@@ -227,7 +227,7 @@ export function createMcpServer() {
         });
     }));
     mcp.registerTool('get_lambda_overview', {
-        description: 'Returns all Lambda functions: runtime, memory, timeout, env var key names (values never included), and known event source triggers with correct handler event shapes.',
+        description: 'Returns all Lambda functions with runtime, memory (MB), timeout (sec), environment variable key names (values never returned), and event source triggers with the correct handler event shape for each. Call this when auditing Lambda configuration for default memory (128 MB) or high timeouts, or when you need the trigger event shape for a specific function without running analyze_function.',
         inputSchema: z.object({}),
     }, logged('get_lambda_overview', async () => {
         const lambdas = getLambdaNodes(currentGraph);
@@ -243,7 +243,7 @@ export function createMcpServer() {
         });
     }));
     mcp.registerTool('get_eventbridge_details', {
-        description: 'Returns all EventBridge rules: name, state, schedule expression or event pattern, and target Lambda functions.',
+        description: 'Returns all EventBridge rules with name, ENABLED/DISABLED state, schedule expression (rate/cron rules), event pattern (event-driven rules), and target Lambda function names. Call this when checking what schedule or event triggers a Lambda, or when reviewing rule coverage across the account.',
         inputSchema: z.object({}),
     }, logged('get_eventbridge_details', async () => {
         const rules = getEventBridgeRuleNodes(currentGraph);
@@ -263,7 +263,7 @@ export function createMcpServer() {
         });
     }));
     mcp.registerTool('get_log_errors', {
-        description: 'Returns recent error patterns from CloudWatch log groups. Returns pattern counts and frequencies — never raw log messages.',
+        description: 'Returns recent error pattern summaries from CloudWatch log groups: pattern counts and frequencies grouped by log group. Raw log messages are never returned. Use the optional logGroup filter to scope to one group by name substring. Call this when investigating errors or identifying log groups with no retention policy.',
         inputSchema: z.object({ logGroup: z.string().describe('Filter to a specific log group name (optional)').optional() }),
     }, logged('get_log_errors', async ({ logGroup: filterName }) => {
         const logGroups = getLogGroupNodes(currentGraph).filter((lg) => !filterName || lg.name.includes(filterName));
@@ -286,6 +286,22 @@ export function createServer(port = 3000) {
         graphEdges: currentGraph.edges.length,
         findings: currentFindings.length,
     }));
+    fastify.get('/.well-known/mcp/server-card.json', async () => ({
+        schema_version: '2026-01',
+        name: 'io.github.Sidd27/infrawise',
+        display_name: 'Infrawise',
+        version,
+        description: 'Infrastructure analysis MCP server — scans DynamoDB, PostgreSQL, MySQL, MongoDB, Lambda, SQS, SNS, EventBridge, Secrets Manager, SSM, CloudWatch, Terraform, CDK, and source code. Surfaces missing indexes, DLQ gaps, Lambda misconfig, and correct trigger event shapes.',
+        homepage: 'https://github.com/Sidd27/infrawise',
+        repository: 'https://github.com/Sidd27/infrawise',
+        transports: [{ type: 'streamable-http', url: `http://localhost:${port}/mcp` }],
+        tools: [
+            'get_infra_overview', 'get_graph_summary', 'analyze_function',
+            'suggest_gsi', 'postgres_index_suggestions', 'suggest_mongo_index', 'mysql_index_suggestions',
+            'get_queue_details', 'get_topic_details', 'get_secrets_overview', 'get_parameter_overview',
+            'get_lambda_overview', 'get_eventbridge_details', 'get_log_errors',
+        ],
+    }));
     fastify.post('/mcp', async (request, reply) => {
         const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: undefined });
         reply.raw.on('close', () => transport.close());

package/package.json

@@ -1,31 +1,41 @@
 {
   "name": "infrawise",
-  "version": "0.7.0",
+  "version": "0.7.2",
   "mcpName": "io.github.Sidd27/infrawise",
   "description": "CLI-first infrastructure intelligence platform — analyzes DynamoDB, PostgreSQL, MySQL, MongoDB, SQS, SNS, SSM, Secrets Manager, Lambda, CloudWatch Logs and exposes findings as an MCP server for Claude Code",
   "keywords": [
+    "mcp",
+    "mcp-server",
+    "model-context-protocol",
     "infrastructure",
+    "infrastructure-analysis",
     "aws",
     "dynamodb",
     "sqs",
     "sns",
     "lambda",
+    "eventbridge",
     "cloudwatch",
     "secrets-manager",
     "ssm",
     "postgresql",
     "mysql",
     "mongodb",
-    "mcp",
+    "serverless",
     "claude",
     "claude-code",
-    "analysis",
-    "cli",
+    "cursor",
+    "ai-coding",
+    "ai-tools",
     "devtools",
+    "cli",
     "terraform",
     "cloudformation",
     "cdk"
   ],
+  "agentskills": {
+    "infrawise": "./AGENTS.md"
+  },
   "homepage": "https://github.com/Sidd27/infrawise#readme",
   "repository": {
     "type": "git",
@@ -97,5 +107,10 @@
   ],
   "publishConfig": {
     "access": "public"
+  },
+  "pnpm": {
+    "overrides": {
+      "qs": ">=6.15.2"
+    }
   }
 }