infrawise 0.7.1 → 0.8.0

package/dist/cli/commands/analyze.js

@@ -1,18 +1,46 @@
+import * as fs from 'fs';
 import * as path from 'path';
 import chalk from 'chalk';
 import ora from 'ora';
 import { loadConfig, formatError, writeCache, readCache } from '../../core/index.js';
-import { extractDynamoMetadata } from '../../adapters/dynamodb.js';
-import { extractPostgresMetadata } from '../../adapters/postgres.js';
-import { extractMySQLMetadata } from '../../adapters/mysql.js';
-import { extractMongoMetadata } from '../../adapters/mongodb.js';
-import { extractIaCSchema } from '../../adapters/terraform.js';
-import { extractSQSMetadata, extractSNSMetadata, extractSSMMetadata, extractSecretsMetadata, extractLambdaMetadata, extractEventBridgeMetadata, extractRDSMetadata, } from '../../adapters/aws.js';
-import { extractLogsMetadata } from '../../adapters/logs.js';
+import { extractDynamoMetadata } from '../../adapters/aws/dynamodb.js';
+import { extractPostgresMetadata } from '../../adapters/db/postgres.js';
+import { extractMySQLMetadata } from '../../adapters/db/mysql.js';
+import { extractMongoMetadata } from '../../adapters/db/mongodb.js';
+import { extractIaCSchema } from '../../adapters/iac/terraform.js';
+import { extractSQSMetadata, extractSNSMetadata, extractSSMMetadata, extractSecretsMetadata, extractLambdaMetadata, extractEventBridgeMetadata, extractRDSMetadata, } from '../../adapters/aws/services.js';
+import { extractLogsMetadata } from '../../adapters/aws/logs.js';
+import { extractS3Metadata } from '../../adapters/aws/s3.js';
 import { scanRepository } from '../../context/index.js';
 import { buildGraph } from '../../graph/index.js';
-import { runAllAnalyzers, IaCDriftAnalyzer, FullTableScanAnalyzer, MissingGSIAnalyzer, HotPartitionAnalyzer, MissingIndexAnalyzer, NplusOneAnalyzer, LargeSelectAnalyzer, MissingMySQLIndexAnalyzer, MySQLFullTableScanAnalyzer, MissingMongoIndexAnalyzer, MongoCollectionScanAnalyzer, MissingDLQAnalyzer, UnencryptedQueueAnalyzer, LargeQueueBacklogAnalyzer, MissingSecretRotationAnalyzer, MissingLogRetentionAnalyzer, LambdaDefaultMemoryAnalyzer, LambdaHighTimeoutAnalyzer, LambdaMissingTriggerDLQAnalyzer, RDSPubliclyAccessibleAnalyzer, RDSNoBackupAnalyzer, RDSUnencryptedAnalyzer, RDSNoDeletionProtectionAnalyzer, RDSNoMultiAZAnalyzer, } from '../../analyzers/index.js';
+import { runAllAnalyzers, IaCDriftAnalyzer, FullTableScanAnalyzer, MissingGSIAnalyzer, HotPartitionAnalyzer, MissingIndexAnalyzer, NplusOneAnalyzer, LargeSelectAnalyzer, MissingMySQLIndexAnalyzer, MySQLFullTableScanAnalyzer, MissingMongoIndexAnalyzer, MongoCollectionScanAnalyzer, MissingDLQAnalyzer, UnencryptedQueueAnalyzer, LargeQueueBacklogAnalyzer, MissingSecretRotationAnalyzer, MissingLogRetentionAnalyzer, LambdaDefaultMemoryAnalyzer, LambdaHighTimeoutAnalyzer, LambdaMissingTriggerDLQAnalyzer, RDSPubliclyAccessibleAnalyzer, RDSNoBackupAnalyzer, RDSUnencryptedAnalyzer, RDSNoDeletionProtectionAnalyzer, RDSNoMultiAZAnalyzer, S3PublicAccessAnalyzer, S3MissingVersioningAnalyzer, S3UnencryptedAnalyzer, } from '../../analyzers/index.js';
 import { printFinding, printSummaryBox, log, printHeader } from '../utils.js';
+const SEVERITY_ORDER = { high: 3, medium: 2, low: 1, verify: 0 };
+function buildMarkdownReport(findings, projectName) {
+    const date = new Date().toISOString().split('T')[0];
+    const high = findings.filter((f) => f.severity === 'high');
+    const medium = findings.filter((f) => f.severity === 'medium');
+    const low = findings.filter((f) => f.severity === 'low');
+    const verify = findings.filter((f) => f.severity === 'verify');
+    const renderGroup = (label, emoji, group) => {
+        if (group.length === 0)
+            return '';
+        const rows = group.map((f) => `| ${f.issue} | ${f.recommendation} |`).join('\n');
+        return `\n## ${emoji} ${label} (${group.length})\n\n| Issue | Recommendation |\n|---|---|\n${rows}\n`;
+    };
+    return [
+        `# infrawise report — ${projectName}`,
+        `_Generated: ${date}_`,
+        '',
+        `**${findings.length} finding(s)**: ${high.length} high · ${medium.length} medium · ${low.length} low · ${verify.length} verify`,
+        renderGroup('High severity', '🔴', high),
+        renderGroup('Medium severity', '🟡', medium),
+        renderGroup('Low severity', '🟢', low),
+        renderGroup('Verify (check intent)', '🔵', verify),
+        '',
+        '_Generated by [infrawise](https://github.com/Sidd27/infrawise) — MCP server for AWS infrastructure analysis_',
+    ].filter((l) => l !== undefined).join('\n');
+}
 function mkSpinner(text) {
     return ora({ text: chalk.dim(text), color: 'cyan' }).start();
 }
@@ -28,6 +56,7 @@ export async function runAnalyze(options = {}) {
         process.exit(1);
     }
     const repoPath = options.repo ?? process.cwd();
+    const minSeverity = options.severity ? SEVERITY_ORDER[options.severity] ?? 1 : 0;
     const awsCfg = { region: config.aws?.region, profile: config.aws?.profile, endpoint: config.aws?.endpoint };
     const dynamoMeta = [];
     const postgresMeta = [];
@@ -166,6 +195,18 @@ export async function runAnalyze(options = {}) {
             s.warn(chalk.yellow('RDS skipped') + chalk.dim(`  ${err instanceof Error ? err.message : String(err)}`));
         }
     }
+    // ── S3 ────────────────────────────────────────────────────────────────────────
+    if (config.s3?.enabled === true) {
+        const s = mkSpinner('Extracting S3 buckets...');
+        try {
+            const result = await extractS3Metadata(awsCfg);
+            servicesMeta.s3 = result;
+            s.succeed(chalk.green('S3') + chalk.dim(`  ${result.length} bucket(s)`));
+        }
+        catch (err) {
+            s.warn(chalk.yellow('S3 skipped') + chalk.dim(`  ${err instanceof Error ? err.message : String(err)}`));
+        }
+    }
     // ── CloudWatch Logs ──────────────────────────────────────────────────────────
     if (config.cloudwatchLogs?.enabled) {
         const s = mkSpinner('Sampling CloudWatch Logs (errors only, max 50 groups)...');
@@ -267,6 +308,11 @@ export async function runAnalyze(options = {}) {
                 new RDSNoDeletionProtectionAnalyzer(),
                 new RDSNoMultiAZAnalyzer(),
             ] : []),
+            ...(config.s3?.enabled === true ? [
+                new S3PublicAccessAnalyzer(),
+                new S3MissingVersioningAnalyzer(),
+                new S3UnencryptedAnalyzer(),
+            ] : []),
             ...(iacDriftAnalyzer ? [iacDriftAnalyzer] : []),
         ];
         findings = await runAllAnalyzers(graph, analyzers);
@@ -278,18 +324,30 @@ export async function runAnalyze(options = {}) {
     writeCache('operations', operations);
     writeCache('meta', { dynamoMeta, postgresMeta, mysqlMeta, mongoMeta, servicesMeta });
     // ── Output ────────────────────────────────────────────────────────────────────
+    const displayFindings = minSeverity > 0
+        ? findings.filter((f) => (SEVERITY_ORDER[f.severity] ?? 0) >= minSeverity)
+        : findings;
     console.log('');
-    if (findings.length === 0) {
-        console.log(`  ${chalk.green.bold('✓ No issues found!')}  ${chalk.dim('Your infrastructure looks clean.')}`);
+    if (displayFindings.length === 0) {
+        const msg = minSeverity > 0 ? `No ${options.severity} (or higher) severity issues found.` : 'Your infrastructure looks clean.';
+        console.log(`  ${chalk.green.bold('✓ No issues found!')}  ${chalk.dim(msg)}`);
     }
     else {
-        console.log(chalk.bold(`  Findings`) + chalk.dim(`  ${findings.length} total`));
-        findings.forEach((f, i) => printFinding(f, i));
-        printSummaryBox(findings);
-        if (findings.some((f) => f.severity === 'high')) {
+        const filterNote = minSeverity > 0 ? chalk.dim(` (${options.severity}+ only)`) : '';
+        console.log(chalk.bold(`  Findings`) + chalk.dim(`  ${displayFindings.length} total`) + filterNote);
+        displayFindings.forEach((f, i) => printFinding(f, i));
+        printSummaryBox(displayFindings);
+        if (displayFindings.some((f) => f.severity === 'high')) {
             console.log(`\n  ${chalk.red.bold('Action required:')} ${chalk.red('High severity issues detected.')}`);
         }
     }
+    if (options.output) {
+        const report = buildMarkdownReport(displayFindings, config.project);
+        const outPath = path.resolve(options.output);
+        fs.writeFileSync(outPath, report, 'utf8');
+        console.log('');
+        log.success('Report saved', outPath);
+    }
     console.log('');
     log.dim(`Results cached in .infrawise/cache/`);
     log.info(`Run ${chalk.cyan('infrawise dev')} to explore via the MCP server`);
@@ -346,6 +404,11 @@ export async function runCodeRefresh(repoPath, config) {
             new RDSPubliclyAccessibleAnalyzer(), new RDSNoBackupAnalyzer(), new RDSUnencryptedAnalyzer(),
             new RDSNoDeletionProtectionAnalyzer(), new RDSNoMultiAZAnalyzer(),
         ] : []),
+        ...(config.s3?.enabled === true ? [
+            new S3PublicAccessAnalyzer(),
+            new S3MissingVersioningAnalyzer(),
+            new S3UnencryptedAnalyzer(),
+        ] : []),
         ...(iacDriftAnalyzer ? [iacDriftAnalyzer] : []),
     ];
     const findings = await runAllAnalyzers(graph, analyzers);

package/dist/cli/commands/auth.js

@@ -2,7 +2,7 @@ import chalk from 'chalk';
 import inquirer from 'inquirer';
 import ora from 'ora';
 import { readAWSProfiles, log, printHeader } from '../utils.js';
-import { validateDynamoAccess } from '../../adapters/dynamodb.js';
+import { validateDynamoAccess } from '../../adapters/aws/dynamodb.js';
 export async function runAuth() {
     printHeader('AWS Authentication');
     const profiles = readAWSProfiles();

package/dist/cli/commands/dev.js

@@ -54,7 +54,7 @@ function groupTools(tools) {
     return lines;
 }
 export async function runDev(options = {}) {
-    const port = options.port ?? 3000;
+    const port = options.port ?? (process.env.PORT ? parseInt(process.env.PORT, 10) : 3000);
     printHeader('MCP Server');
     let config;
     try {

package/dist/cli/commands/doctor.js

@@ -4,12 +4,13 @@ import * as os from 'os';
 import chalk from 'chalk';
 import ora from 'ora';
 import { loadConfig } from '../../core/index.js';
-import { probeDynamoAccess } from '../../adapters/dynamodb.js';
-import { validatePostgresAccess } from '../../adapters/postgres.js';
-import { validateMySQLAccess } from '../../adapters/mysql.js';
-import { validateMongoAccess } from '../../adapters/mongodb.js';
-import { validateSQSAccess, validateSNSAccess, validateSSMAccess, validateSecretsAccess, validateLambdaAccess, validateEventBridgeAccess, } from '../../adapters/aws.js';
-import { validateLogsAccess } from '../../adapters/logs.js';
+import { probeDynamoAccess } from '../../adapters/aws/dynamodb.js';
+import { validatePostgresAccess } from '../../adapters/db/postgres.js';
+import { validateMySQLAccess } from '../../adapters/db/mysql.js';
+import { validateMongoAccess } from '../../adapters/db/mongodb.js';
+import { validateSQSAccess, validateSNSAccess, validateSSMAccess, validateSecretsAccess, validateLambdaAccess, validateEventBridgeAccess, } from '../../adapters/aws/services.js';
+import { validateLogsAccess } from '../../adapters/aws/logs.js';
+import { validateS3Access } from '../../adapters/aws/s3.js';
 import { printHeader } from '../utils.js';
 async function runCheck(label, fn) {
     const spin = ora({ text: chalk.dim(label), color: 'cyan' }).start();
@@ -189,6 +190,22 @@ export async function runDoctor(options = {}) {
             };
         }
     }));
+    // S3
+    results.push(await runCheck('Testing S3 access...', async () => {
+        if (config?.s3?.enabled !== true)
+            return { name: 'S3', status: 'skip', message: 'Disabled in config' };
+        try {
+            await validateS3Access(awsCfg);
+            return { name: 'S3', status: 'pass', message: 'Connected' };
+        }
+        catch (err) {
+            return {
+                name: 'S3', status: 'warn',
+                message: err instanceof Error ? err.message : String(err),
+                detail: 'Check IAM: s3:ListBuckets, s3:GetBucketNotificationConfiguration, s3:GetBucketVersioning, s3:GetBucketEncryption, s3:GetPublicAccessBlock',
+            };
+        }
+    }));
     // CloudWatch Logs
     results.push(await runCheck('Testing CloudWatch Logs access...', async () => {
         if (!config?.cloudwatchLogs?.enabled)

package/dist/cli/commands/stdio.js

@@ -0,0 +1,28 @@
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { loadConfig, formatError, readCache } from '../../core/index.js';
+import { createMcpServer, setGraphState } from '../../server/index.js';
+import { runAnalyze } from './analyze.js';
+export async function runStdio(configPath) {
+    let config;
+    try {
+        config = loadConfig(configPath);
+    }
+    catch (err) {
+        process.stderr.write(formatError(err) + '\n');
+        process.exit(1);
+    }
+    const cachedGraph = readCache('graph');
+    const cachedFindings = readCache('findings');
+    if (cachedGraph && cachedFindings) {
+        setGraphState(cachedGraph, cachedFindings, config);
+    }
+    else {
+        await runAnalyze({ config: configPath });
+        const graph = readCache('graph') ?? { nodes: [], edges: [] };
+        const findings = readCache('findings') ?? [];
+        setGraphState(graph, findings, config);
+    }
+    const mcp = createMcpServer();
+    const transport = new StdioServerTransport();
+    await mcp.connect(transport);
+}

package/dist/cli/index.js

@@ -8,6 +8,7 @@ import { runAuth } from './commands/auth.js';
 import { runAnalyze } from './commands/analyze.js';
 import { runDev } from './commands/dev.js';
 import { runDoctor } from './commands/doctor.js';
+import { runStdio } from './commands/stdio.js';
 const { version } = JSON.parse(readFileSync(join(import.meta.dirname, '../../package.json'), 'utf8'));
 const program = new Command();
 program
@@ -35,12 +36,16 @@ program
     .option('-c, --config <path>', 'Path to infrawise.yaml', 'infrawise.yaml')
     .option('-r, --repo <path>', 'Path to repository to scan', process.cwd())
     .option('--no-cache', 'Skip reading/writing the cache')
+    .option('-o, --output <path>', 'Save findings as a markdown report (e.g. report.md)')
+    .option('--severity <level>', 'Only show findings at or above this level: high | medium | low')
     .action(async (options) => {
     printBanner();
     await runAnalyze({
         config: options.config !== 'infrawise.yaml' ? options.config : undefined,
         repo: options.repo,
         noCache: !options.cache,
+        output: options.output,
+        severity: options.severity,
     });
 });
 program
@@ -55,6 +60,13 @@ program
         port: parseInt(options.port, 10),
     });
 });
+program
+    .command('stdio')
+    .description('Start MCP server on stdio transport (for Claude Desktop and Glama)')
+    .option('-c, --config <path>', 'Path to infrawise.yaml', 'infrawise.yaml')
+    .action(async (options) => {
+    await runStdio(options.config !== 'infrawise.yaml' ? options.config : undefined);
+});
 program
     .command('doctor')
     .description('Validate AWS access, postgres connectivity, config, and repo scan')

package/dist/cli/utils.js

@@ -93,6 +93,7 @@ function severityBadge(severity) {
         case 'high': return chalk.bgRed.white.bold(` HIGH `);
         case 'medium': return chalk.bgYellow.black.bold(` MED  `);
         case 'low': return chalk.bgCyan.black.bold(` LOW  `);
+        case 'verify': return chalk.bgBlue.white.bold(` VER? `);
     }
 }
 export function printFinding(finding, index) {
@@ -106,6 +107,7 @@ export function printSummaryBox(findings) {
     const high = findings.filter((f) => f.severity === 'high').length;
     const medium = findings.filter((f) => f.severity === 'medium').length;
     const low = findings.filter((f) => f.severity === 'low').length;
+    const verify = findings.filter((f) => f.severity === 'verify').length;
     console.log('');
     console.log(chalk.dim('  ┌─────────────────────────────┐'));
     console.log(chalk.dim('  │') + chalk.bold('  Analysis Summary             ') + chalk.dim('│'));
@@ -113,6 +115,7 @@ export function printSummaryBox(findings) {
     console.log(chalk.dim('  │') + `  ${chalk.red('●')} High     ${chalk.red.bold(String(high).padStart(3))}                 ` + chalk.dim('│'));
     console.log(chalk.dim('  │') + `  ${chalk.yellow('●')} Medium   ${chalk.yellow.bold(String(medium).padStart(3))}                 ` + chalk.dim('│'));
     console.log(chalk.dim('  │') + `  ${chalk.cyan('●')} Low      ${chalk.cyan.bold(String(low).padStart(3))}                 ` + chalk.dim('│'));
+    console.log(chalk.dim('  │') + `  ${chalk.blue('●')} Verify   ${chalk.blue.bold(String(verify).padStart(3))}                 ` + chalk.dim('│'));
     console.log(chalk.dim('  ├─────────────────────────────┤'));
     console.log(chalk.dim('  │') + `  Total    ${chalk.bold(String(findings.length).padStart(3))}                 ` + chalk.dim('│'));
     console.log(chalk.dim('  └─────────────────────────────┘'));

package/dist/core/config.js

@@ -40,6 +40,7 @@ export const InfrawiseConfigSchema = z.object({
     }).optional(),
     eventbridge: z.object({ enabled: z.boolean().optional().default(true) }).optional(),
     rds: z.object({ enabled: z.boolean().optional().default(false) }).optional(),
+    s3: z.object({ enabled: z.boolean().optional().default(false) }).optional(),
     kafka: z.object({ enabled: z.boolean().optional().default(false) }).optional(),
     cloudwatchLogs: z.object({
         enabled: z.boolean().optional().default(false),

package/dist/graph/index.js

@@ -2,10 +2,12 @@ export function buildGraph(operations, dynamoMeta, postgresMeta, mysqlMeta = [],
     const nodes = [];
     const edges = [];
     const nodeIds = new Set();
+    const nodeMap = new Map();
     function addNode(node) {
         if (!nodeIds.has(node.id)) {
             nodes.push(node);
             nodeIds.add(node.id);
+            nodeMap.set(node.id, node);
         }
     }
     // ── Database tables ──────────────────────────────────────────────────────
@@ -152,7 +154,7 @@ export function buildGraph(operations, dynamoMeta, postgresMeta, mysqlMeta = [],
             if (!nodeIds.has(lambdaId))
                 continue;
             edges.push({ from: ruleId, to: lambdaId, type: 'triggers' });
-            const lambdaNodeRef = nodes.find((n) => n.id === lambdaId);
+            const lambdaNodeRef = nodeMap.get(lambdaId);
             if (lambdaNodeRef && lambdaNodeRef.type === 'lambda') {
                 const trigger = {
                     type: 'eventbridge',
@@ -182,13 +184,42 @@ export function buildGraph(operations, dynamoMeta, postgresMeta, mysqlMeta = [],
             multiAZ: db.multiAZ,
         });
     }
+    // ── S3 Buckets ────────────────────────────────────────────────────────────────
+    for (const bucket of servicesMeta.s3 ?? []) {
+        const bucketId = `bucket:aws:${bucket.name}`;
+        addNode({
+            id: bucketId,
+            type: 'bucket',
+            name: bucket.name,
+            provider: 'aws',
+            versioned: bucket.versioned,
+            encrypted: bucket.encrypted,
+            publicAccessBlocked: bucket.publicAccessBlocked,
+        });
+        for (const notification of bucket.notifications) {
+            const lambdaId = `lambda:aws:${notification.lambdaName}`;
+            if (!nodeMap.has(lambdaId))
+                continue;
+            edges.push({ from: bucketId, to: lambdaId, type: 'triggers' });
+            const lambdaNode = nodeMap.get(lambdaId);
+            if (lambdaNode && lambdaNode.type === 'lambda') {
+                lambdaNode.triggers = [
+                    ...(lambdaNode.triggers ?? []),
+                    {
+                        type: 's3',
+                        sourceArn: bucket.arn,
+                        sourceName: bucket.name,
+                        eventShape: 'event.Records[0].s3.object.key',
+                        events: notification.events,
+                    },
+                ];
+            }
+        }
+    }
     // ── Code operations (functions + edges) ───────────────────────────────────
     for (const op of operations) {
         const funcNodeId = `function:${op.filePath}:${op.functionName}`;
-        if (!nodeIds.has(funcNodeId)) {
-            nodes.push({ id: funcNodeId, type: 'function', name: op.functionName, file: op.filePath });
-            nodeIds.add(funcNodeId);
-        }
+        addNode({ id: funcNodeId, type: 'function', name: op.functionName, file: op.filePath });
         // AWS service operations create edges to service nodes
         if (op.serviceType === 'sqs') {
             const queueId = `queue:aws:${op.target}`;
@@ -293,6 +324,9 @@ export function getLambdaNodes(graph) {
 export function getEventBridgeRuleNodes(graph) {
     return graph.nodes.filter((n) => n.type === 'eventbridge_rule');
 }
+export function getBucketNodes(graph) {
+    return graph.nodes.filter((n) => n.type === 'bucket');
+}
 export function getEdgesForNode(graph, nodeId) {
     return graph.edges.filter((e) => e.from === nodeId || e.to === nodeId);
 }

package/dist/server/index.js

@@ -8,7 +8,7 @@ import { z } from 'zod';
 import { logger } from '../core/index.js';
 const { version } = JSON.parse(readFileSync(join(import.meta.dirname, '../../package.json'), 'utf8'));
 import { summarizeFindings } from '../analyzers/index.js';
-import { getTableNodes, getFunctionNodes, getQueueNodes, getTopicNodes, getSecretNodes, getParameterNodes, getLogGroupNodes, getLambdaNodes, getEventBridgeRuleNodes, getScanEdges, getOutgoingEdges, } from '../graph/index.js';
+import { getTableNodes, getFunctionNodes, getQueueNodes, getTopicNodes, getSecretNodes, getParameterNodes, getLogGroupNodes, getLambdaNodes, getEventBridgeRuleNodes, getBucketNodes, getScanEdges, getOutgoingEdges, } from '../graph/index.js';
 // ── State ────────────────────────────────────────────────────────────────────
 let currentGraph = { nodes: [], edges: [] };
 let currentFindings = [];
@@ -31,7 +31,7 @@ function logged(name, fn) {
 export function createMcpServer() {
     const mcp = new McpServer({ name: 'infrawise', version });
     mcp.registerTool('get_infra_overview', {
-        description: 'Returns a complete snapshot of all infrastructure: databases, queues, topics, secrets, parameters, log groups, lambdas, and all findings. Start here for a full picture.',
+        description: 'Returns a compact infrastructure snapshot: service counts, all databases, queues, topics, secrets, lambdas, and high-severity findings. Call this first at the start of any database or infrastructure task to understand what services are in scope. Prefer this over get_graph_summary for quick orientation; use get_graph_summary only when you need every node, edge, and finding in full.',
         inputSchema: z.object({}),
     }, logged('get_infra_overview', async () => {
         const tables = getTableNodes(currentGraph);
@@ -42,12 +42,14 @@ export function createMcpServer() {
         const logGroups = getLogGroupNodes(currentGraph);
         const lambdas = getLambdaNodes(currentGraph);
         const functions = getFunctionNodes(currentGraph);
+        const buckets = getBucketNodes(currentGraph);
         return toText({
             summary: {
                 tables: tables.length, functions: functions.length,
                 queues: queues.length, topics: topics.length,
                 secrets: secrets.length, parameters: parameters.length,
                 logGroups: logGroups.length, lambdas: lambdas.length,
+                buckets: buckets.length,
                 totalNodes: currentGraph.nodes.length, totalEdges: currentGraph.edges.length,
                 findings: summarizeFindings(currentFindings),
             },
@@ -58,11 +60,12 @@ export function createMcpServer() {
             parameters: parameters.map((p) => ({ name: p.name, type: p.paramType, tier: p.tier })),
             lambdas: lambdas.map((l) => ({ name: l.name, runtime: l.runtime, memoryMB: l.memoryMB })),
             logGroups: logGroups.map((lg) => ({ name: lg.name, retentionDays: lg.retentionDays ?? 'never', errorCount: lg.errorCount })),
+            buckets: buckets.map((b) => ({ name: b.name, versioned: b.versioned, publicAccessBlocked: b.publicAccessBlocked })),
             highFindings: currentFindings.filter((f) => f.severity === 'high').map((f) => ({ issue: f.issue, recommendation: f.recommendation })),
         });
     }));
     mcp.registerTool('get_graph_summary', {
-        description: 'Returns the full infrastructure graph (all nodes and edges) plus findings summary.',
+        description: 'Returns every node (tables, functions, lambdas, queues, etc.), every edge (query, scan, triggers, publishes_to), and all findings. Use this when you need to trace relationships across multiple services or require the complete finding set — not just high-severity ones. For a quick overview use get_infra_overview instead.',
         inputSchema: z.object({}),
     }, logged('get_graph_summary', async () => toText({
         nodes: currentGraph.nodes,
@@ -76,7 +79,7 @@ export function createMcpServer() {
         },
     })));
     mcp.registerTool('analyze_function', {
-        description: 'Analyze a specific function for all infrastructure issues: DB queries, queue publishing, secret access, trigger event shapes, etc.',
+        description: 'Analyzes a single named function or Lambda handler for infrastructure issues: which tables it queries, how it queries them (scan vs query), queue publishing, secret access, and the correct event shape for each trigger (SQS, DynamoDB Streams, Kinesis, EventBridge). Call this before writing or reviewing a Lambda handler to get the exact trigger event shape and all findings scoped to this function. Returns found: false if the function name was not discovered during analysis.',
         inputSchema: z.object({ function: z.string().describe('Function name to analyze') }),
     }, logged('analyze_function', async ({ function: functionName }) => {
         const funcNode = currentGraph.nodes.find((n) => n.type === 'function' && n.name === functionName);
@@ -107,7 +110,7 @@ export function createMcpServer() {
         });
     }));
     mcp.registerTool('suggest_gsi', {
-        description: 'Get GSI suggestions for a DynamoDB table and attribute',
+        description: 'Generates a ready-to-use DynamoDB GSI definition — index name, partition key, projection type, billing mode — for a given table and attribute. Call this when a query pattern needs an index that does not exist yet, or when the analyzer flags a missing GSI finding. Does not verify whether the GSI already exists; check the table schema in get_infra_overview first.',
         inputSchema: z.object({
             table: z.string().describe('DynamoDB table name'),
             attribute: z.string().describe('Attribute to create the GSI on'),
@@ -125,7 +128,7 @@ export function createMcpServer() {
         });
     }));
     mcp.registerTool('postgres_index_suggestions', {
-        description: 'Get PostgreSQL index suggestions for a table column',
+        description: 'Generates the exact CREATE INDEX CONCURRENTLY SQL for a PostgreSQL table column, including a partial index variant and a post-creation ANALYZE reminder. Call this when the analyzer flags a missing index finding or when writing a query that filters on a column without an existing index. Does not verify whether the index already exists.',
         inputSchema: z.object({
             table: z.string().describe('PostgreSQL table name'),
             column: z.string().describe('Column name to index'),
@@ -143,7 +146,7 @@ export function createMcpServer() {
         });
     }));
     mcp.registerTool('suggest_mongo_index', {
-        description: 'Get index suggestions for a MongoDB collection field',
+        description: 'Generates the exact db.collection.createIndex() command for a MongoDB field, plus compound and text index variants and an explain query to verify. Call this when a collection scan is flagged by the analyzer or when writing a query that filters on an unindexed field. Does not check whether the index already exists.',
         inputSchema: z.object({
             collection: z.string().describe('MongoDB collection name'),
             field: z.string().describe('Field name to index'),
@@ -163,7 +166,7 @@ export function createMcpServer() {
         });
     }));
     mcp.registerTool('mysql_index_suggestions', {
-        description: 'Get MySQL index suggestions for a table column',
+        description: 'Generates the exact ALTER TABLE ADD INDEX SQL for a MySQL table column, including a composite variant and EXPLAIN guidance to verify the index is used. Call this when the analyzer flags a missing MySQL index or full table scan finding. Does not verify whether the index already exists.',
         inputSchema: z.object({
             table: z.string().describe('MySQL table name'),
             column: z.string().describe('Column name to index'),
@@ -181,7 +184,7 @@ export function createMcpServer() {
         });
     }));
     mcp.registerTool('get_queue_details', {
-        description: 'Returns all SQS queues with DLQ status, encryption, message counts, and retention.',
+        description: 'Returns all SQS queues with DLQ presence, encryption status, approximate message count, and retention days. Call this when reviewing messaging architecture, investigating a message backlog, or checking DLQ coverage before adding a new consumer. Use get_infra_overview for a quick queue count only.',
         inputSchema: z.object({}),
     }, logged('get_queue_details', async () => {
         const queues = getQueueNodes(currentGraph);
@@ -196,14 +199,14 @@ export function createMcpServer() {
         });
     }));
     mcp.registerTool('get_topic_details', {
-        description: 'Returns all SNS topics with subscription counts and protocols.',
+        description: 'Returns all SNS topics with subscription count and encryption status. Call this when reviewing event fan-out patterns or checking whether a topic has the expected number of subscribers.',
         inputSchema: z.object({}),
     }, logged('get_topic_details', async () => {
         const topics = getTopicNodes(currentGraph);
         return toText({ total: topics.length, topics: topics.map((t) => ({ name: t.name, provider: t.provider, subscriptionCount: t.subscriptionCount, encrypted: t.encrypted })) });
     }));
     mcp.registerTool('get_secrets_overview', {
-        description: 'Returns all Secrets Manager secrets: names, rotation status. Secret VALUES are never included.',
+        description: 'Returns all Secrets Manager secrets with rotation status and rotation interval. Secret values are never returned. Call this when checking which secrets exist, confirming rotation is enabled before a security review, or identifying secrets that lack rotation.',
         inputSchema: z.object({}),
     }, logged('get_secrets_overview', async () => {
         const secrets = getSecretNodes(currentGraph);
@@ -217,7 +220,7 @@ export function createMcpServer() {
         });
     }));
     mcp.registerTool('get_parameter_overview', {
-        description: 'Returns all SSM Parameter Store parameters: names, types, tiers. Parameter VALUES are never included.',
+        description: 'Returns all SSM Parameter Store parameters with type (String, SecureString, StringList) and tier (Standard, Advanced). Parameter values are never returned. Call this when checking which config parameters exist for a service or verifying parameter types.',
         inputSchema: z.object({}),
     }, logged('get_parameter_overview', async () => {
         const parameters = getParameterNodes(currentGraph);
@@ -227,7 +230,7 @@ export function createMcpServer() {
         });
     }));
     mcp.registerTool('get_lambda_overview', {
-        description: 'Returns all Lambda functions: runtime, memory, timeout, env var key names (values never included), and known event source triggers with correct handler event shapes.',
+        description: 'Returns all Lambda functions with runtime, memory (MB), timeout (sec), environment variable key names (values never returned), and event source triggers with the correct handler event shape for each. Call this when auditing Lambda configuration for default memory (128 MB) or high timeouts, or when you need the trigger event shape for a specific function without running analyze_function.',
         inputSchema: z.object({}),
     }, logged('get_lambda_overview', async () => {
         const lambdas = getLambdaNodes(currentGraph);
@@ -243,7 +246,7 @@ export function createMcpServer() {
         });
     }));
     mcp.registerTool('get_eventbridge_details', {
-        description: 'Returns all EventBridge rules: name, state, schedule expression or event pattern, and target Lambda functions.',
+        description: 'Returns all EventBridge rules with name, ENABLED/DISABLED state, schedule expression (rate/cron rules), event pattern (event-driven rules), and target Lambda function names. Call this when checking what schedule or event triggers a Lambda, or when reviewing rule coverage across the account.',
         inputSchema: z.object({}),
     }, logged('get_eventbridge_details', async () => {
         const rules = getEventBridgeRuleNodes(currentGraph);
@@ -262,8 +265,29 @@ export function createMcpServer() {
             })),
         });
     }));
+    mcp.registerTool('get_s3_overview', {
+        description: 'Returns all S3 buckets with versioning status, encryption, public access configuration, and security findings. Call this when checking which S3 buckets exist, reviewing bucket security posture, or before writing S3 upload/delete handlers to confirm the bucket name. Do NOT call when you only need a quick infrastructure count — use get_infra_overview for that. Object contents are never included.',
+        inputSchema: z.object({}),
+    }, logged('get_s3_overview', async () => {
+        const buckets = getBucketNodes(currentGraph);
+        const bucketFindings = currentFindings.filter((f) => f.metadata?.bucketName);
+        return toText({
+            total: buckets.length,
+            note: 'Object contents are never included.',
+            buckets: buckets.map((b) => ({
+                name: b.name,
+                provider: b.provider,
+                versioned: b.versioned,
+                encrypted: b.encrypted,
+                publicAccessBlocked: b.publicAccessBlocked,
+                findings: bucketFindings
+                    .filter((f) => f.metadata.bucketName === b.name)
+                    .map((f) => ({ severity: f.severity, issue: f.issue })),
+            })),
+        });
+    }));
     mcp.registerTool('get_log_errors', {
-        description: 'Returns recent error patterns from CloudWatch log groups. Returns pattern counts and frequencies — never raw log messages.',
+        description: 'Returns recent error pattern summaries from CloudWatch log groups: pattern counts and frequencies grouped by log group. Raw log messages are never returned. Use the optional logGroup filter to scope to one group by name substring. Call this when investigating errors or identifying log groups with no retention policy.',
         inputSchema: z.object({ logGroup: z.string().describe('Filter to a specific log group name (optional)').optional() }),
     }, logged('get_log_errors', async ({ logGroup: filterName }) => {
         const logGroups = getLogGroupNodes(currentGraph).filter((lg) => !filterName || lg.name.includes(filterName));
@@ -291,7 +315,7 @@ export function createServer(port = 3000) {
         name: 'io.github.Sidd27/infrawise',
         display_name: 'Infrawise',
         version,
-        description: 'Infrastructure analysis MCP server — scans DynamoDB, PostgreSQL, MySQL, MongoDB, Lambda, SQS, SNS, EventBridge, Secrets Manager, SSM, CloudWatch, Terraform, CDK, and source code. Surfaces missing indexes, DLQ gaps, Lambda misconfig, and correct trigger event shapes.',
+        description: 'Infrastructure analysis MCP server — scans DynamoDB, PostgreSQL, MySQL, MongoDB, S3, Lambda, SQS, SNS, EventBridge, Secrets Manager, SSM, CloudWatch, Terraform, CDK, and source code. Surfaces missing indexes, DLQ gaps, Lambda misconfig, S3 security posture, and correct trigger event shapes.',
         homepage: 'https://github.com/Sidd27/infrawise',
         repository: 'https://github.com/Sidd27/infrawise',
         transports: [{ type: 'streamable-http', url: `http://localhost:${port}/mcp` }],
@@ -299,7 +323,7 @@ export function createServer(port = 3000) {
             'get_infra_overview', 'get_graph_summary', 'analyze_function',
             'suggest_gsi', 'postgres_index_suggestions', 'suggest_mongo_index', 'mysql_index_suggestions',
             'get_queue_details', 'get_topic_details', 'get_secrets_overview', 'get_parameter_overview',
-            'get_lambda_overview', 'get_eventbridge_details', 'get_log_errors',
+            'get_lambda_overview', 'get_eventbridge_details', 'get_s3_overview', 'get_log_errors',
         ],
     }));
     fastify.post('/mcp', async (request, reply) => {

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "infrawise",
-  "version": "0.7.1",
+  "version": "0.8.0",
   "mcpName": "io.github.Sidd27/infrawise",
-  "description": "CLI-first infrastructure intelligence platform — analyzes DynamoDB, PostgreSQL, MySQL, MongoDB, SQS, SNS, SSM, Secrets Manager, Lambda, CloudWatch Logs and exposes findings as an MCP server for Claude Code",
+  "description": "CLI-first infrastructure intelligence platform — analyzes DynamoDB, PostgreSQL, MySQL, MongoDB, SQS, SNS, SSM, Secrets Manager, Lambda, S3, CloudWatch Logs and exposes findings as an MCP server for Claude Code",
   "keywords": [
     "mcp",
     "mcp-server",
@@ -14,6 +14,7 @@
     "sqs",
     "sns",
     "lambda",
+    "s3",
     "eventbridge",
     "cloudwatch",
     "secrets-manager",
@@ -63,6 +64,7 @@
   },
   "dependencies": {
     "@aws-sdk/client-cloudwatch-logs": "^3.1048.0",
+    "@aws-sdk/client-s3": "^3.1048.0",
     "@aws-sdk/client-dynamodb": "^3.1048.0",
     "@aws-sdk/client-eventbridge": "^3.1051.0",
     "@aws-sdk/client-lambda": "^3.1048.0",
@@ -74,9 +76,9 @@
     "@aws-sdk/credential-providers": "^3.1048.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "chalk": "^5.6.2",
-    "commander": "^14.0.3",
+    "commander": "^15.0.0",
     "fastify": "^5.8.5",
-    "inquirer": "^13.4.3",
+    "inquirer": "^14.0.2",
     "js-yaml": "^4.1.0",
     "mongodb": "^7.2.0",
     "mysql2": "^3.9.0",
@@ -107,5 +109,10 @@
   ],
   "publishConfig": {
     "access": "public"
+  },
+  "pnpm": {
+    "overrides": {
+      "qs": ">=6.15.2"
+    }
   }
 }