infrawise 0.7.2 → 0.8.0

package/README.md

@@ -173,8 +173,9 @@ To let Claude Code manage the server lifecycle automatically:
 | `get_topic_details`          | SNS topics — subscription counts and protocols                                                              |
 | `get_secrets_overview`       | Secrets Manager — names and rotation status (values never included)                                         |
 | `get_parameter_overview`     | SSM Parameter Store — names, types, tiers (values never included)                                           |
-| `get_lambda_overview`        | Lambda functions — runtime, memory, timeout, triggers (SQS/DynamoDB/Kinesis/EventBridge), env var key names |
+| `get_lambda_overview`        | Lambda functions — runtime, memory, timeout, triggers (SQS/DynamoDB/Kinesis/EventBridge/S3), env var key names |
 | `get_eventbridge_details`    | EventBridge rules — name, state, schedule/event pattern, target functions                                   |
+| `get_s3_overview`            | S3 buckets — versioning, encryption, public access, event notifications                                     |
 | `get_log_errors`             | CloudWatch error patterns and counts (no raw log messages)                                                  |
 
 ---
@@ -198,7 +199,7 @@ To let Claude Code manage the server lifecycle automatically:
 | `-r, --repo <path>`   | Repository to scan (default: current directory)                        |
 | `--no-cache`          | Skip reading/writing the cache                                         |
 | `-o, --output <path>` | Save findings as a markdown report, e.g. `report.md`                   |
-| `--severity <level>`  | Only show findings at or above this level: `high` \| `medium` \| `low` |
+| `--severity <level>`  | Only show findings at or above this level: `high` \| `medium` \| `low` \| `verify` |
 
 ```bash
 # Export a shareable findings report
@@ -277,6 +278,9 @@ eventbridge:
 rds:
   enabled: false
 
+s3:
+  enabled: false
+
 kafka:
   enabled: false
 
@@ -343,7 +347,8 @@ Works from AWS APIs, database schema introspection, and IaC files — no depende
 | SQS                              | Missing DLQs, unencrypted queues, large backlogs                                                                   |
 | Kafka (kafkajs)                  | Producer/consumer topic mapping from code                                                                          |
 | Secrets Manager                  | Missing secret rotation                                                                                            |
-| Lambda                           | Default memory (128 MB), high timeouts, triggers (SQS/DynamoDB/Kinesis/EventBridge), missing DLQ on trigger source |
+| Lambda                           | Default memory (128 MB), high timeouts, triggers (SQS/DynamoDB/Kinesis/EventBridge/S3), missing DLQ on trigger source |
+| S3                               | Public access blocking (verify), missing versioning, missing encryption                                            |
 | EventBridge                      | Rules, schedules, event patterns, target Lambda functions                                                          |
 | RDS                              | Publicly accessible, no backups, unencrypted, no deletion protection, single-AZ                                    |
 | CloudWatch Logs                  | Log groups with no retention policy                                                                                |

package/dist/adapters/aws/index.js

@@ -1,3 +1,4 @@
 export * from './services.js';
 export * from './dynamodb.js';
 export * from './logs.js';
+export * from './s3.js';

package/dist/adapters/aws/s3.js

@@ -0,0 +1,72 @@
+import { S3Client, ListBucketsCommand, GetBucketNotificationConfigurationCommand, GetBucketVersioningCommand, GetBucketEncryptionCommand, GetPublicAccessBlockCommand, } from '@aws-sdk/client-s3';
+import { fromIni } from '@aws-sdk/credential-providers';
+import { logger } from '../../core/index.js';
+function clientConfig(cfg) {
+    const region = cfg.region ?? 'us-east-1';
+    const base = { region };
+    if (cfg.endpoint)
+        base.endpoint = cfg.endpoint;
+    if (cfg.profile)
+        base.credentials = fromIni({ profile: cfg.profile });
+    return base;
+}
+export async function extractS3Metadata(cfg = {}) {
+    const client = new S3Client(clientConfig(cfg));
+    const buckets = [];
+    try {
+        const listRes = await client.send(new ListBucketsCommand({}));
+        const rawBuckets = (listRes.Buckets ?? []).slice(0, 200);
+        for (const bucket of rawBuckets) {
+            const name = bucket.Name ?? '';
+            if (!name)
+                continue;
+            const arn = `arn:aws:s3:::${name}`;
+            const createdAt = bucket.CreationDate?.toISOString();
+            const [notifResult, versionResult, encryptResult, pabResult] = await Promise.allSettled([
+                client.send(new GetBucketNotificationConfigurationCommand({ Bucket: name })),
+                client.send(new GetBucketVersioningCommand({ Bucket: name })),
+                client.send(new GetBucketEncryptionCommand({ Bucket: name })),
+                client.send(new GetPublicAccessBlockCommand({ Bucket: name })),
+            ]);
+            const notifications = [];
+            if (notifResult.status === 'fulfilled') {
+                for (const config of notifResult.value.LambdaFunctionConfigurations ?? []) {
+                    const lambdaArn = config.LambdaFunctionArn ?? '';
+                    const lambdaName = lambdaArn.split(':').pop() ?? lambdaArn;
+                    const rules = config.Filter?.Key?.FilterRules ?? [];
+                    const prefix = rules.find((r) => r.Name?.toLowerCase() === 'prefix')?.Value;
+                    const suffix = rules.find((r) => r.Name?.toLowerCase() === 'suffix')?.Value;
+                    const notification = {
+                        events: config.Events ?? [],
+                        lambdaArn,
+                        lambdaName,
+                    };
+                    if (prefix !== undefined)
+                        notification.prefix = prefix;
+                    if (suffix !== undefined)
+                        notification.suffix = suffix;
+                    notifications.push(notification);
+                }
+            }
+            const versioned = versionResult.status === 'fulfilled'
+                ? versionResult.value.Status === 'Enabled'
+                : false;
+            const encrypted = encryptResult.status === 'fulfilled'
+                ? (encryptResult.value.ServerSideEncryptionConfiguration?.Rules?.length ?? 0) > 0
+                : false;
+            let publicAccessBlocked = false;
+            if (pabResult.status === 'fulfilled') {
+                const pab = pabResult.value.PublicAccessBlockConfiguration ?? {};
+                publicAccessBlocked = !!(pab.BlockPublicAcls && pab.IgnorePublicAcls && pab.BlockPublicPolicy && pab.RestrictPublicBuckets);
+            }
+            buckets.push({ name, arn, createdAt, versioned, encrypted, publicAccessBlocked, notifications });
+        }
+    }
+    catch (err) {
+        logger.warn(`S3 list failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    return buckets;
+}
+export async function validateS3Access(cfg = {}) {
+    await new S3Client(clientConfig(cfg)).send(new ListBucketsCommand({}));
+}

package/dist/analyzers/aws-services.js

@@ -183,3 +183,64 @@ export class LambdaHighTimeoutAnalyzer {
         return findings;
     }
 }
+// ─── S3 ──────────────────────────────────────────────────────────────────────
+export class S3PublicAccessAnalyzer {
+    name = 'S3PublicAccessAnalyzer';
+    async analyze(graph) {
+        const findings = [];
+        for (const node of graph.nodes) {
+            if (node.type !== 'bucket')
+                continue;
+            if (node.publicAccessBlocked === false) {
+                findings.push({
+                    severity: 'verify',
+                    issue: `S3 bucket "${node.name}" has public access blocking disabled`,
+                    description: `Public access blocking is disabled on "${node.name}". This is expected for static website hosting and public asset buckets. Confirm this is intentional before treating it as a security issue.`,
+                    recommendation: `If "${node.name}" is not intentionally public, enable all four S3 Block Public Access settings: BlockPublicAcls, IgnorePublicAcls, BlockPublicPolicy, RestrictPublicBuckets.`,
+                    metadata: { bucketName: node.name, provider: node.provider },
+                });
+            }
+        }
+        return findings;
+    }
+}
+export class S3MissingVersioningAnalyzer {
+    name = 'S3MissingVersioningAnalyzer';
+    async analyze(graph) {
+        const findings = [];
+        for (const node of graph.nodes) {
+            if (node.type !== 'bucket')
+                continue;
+            if (node.versioned === false) {
+                findings.push({
+                    severity: 'medium',
+                    issue: `S3 bucket "${node.name}" does not have versioning enabled`,
+                    description: `"${node.name}" has versioning disabled. Without versioning, accidental deletes or overwrites are unrecoverable. Versioning is required for cross-region replication and Object Lock.`,
+                    recommendation: `Enable versioning on "${node.name}" via the S3 console or IaC. Consider adding a lifecycle rule to expire old versions and manage storage costs.`,
+                    metadata: { bucketName: node.name, provider: node.provider },
+                });
+            }
+        }
+        return findings;
+    }
+}
+export class S3UnencryptedAnalyzer {
+    name = 'S3UnencryptedAnalyzer';
+    async analyze(graph) {
+        const findings = [];
+        for (const node of graph.nodes) {
+            if (node.type !== 'bucket')
+                continue;
+            if (node.encrypted === false) {
+                findings.push({
+                    severity: 'medium',
+                    issue: `S3 bucket "${node.name}" does not have server-side encryption configured`,
+                    description: `"${node.name}" has no SSE (Server-Side Encryption) configuration. Data at rest is unencrypted. AWS S3 has enabled SSE-S3 by default since January 2023 for new buckets, but older buckets or those without explicit config should be verified.`,
+                    recommendation: `Enable SSE on "${node.name}" using SSE-S3 (AES-256) or SSE-KMS. Specify the encryption configuration in your IaC to make it explicit.`,
+                    metadata: { bucketName: node.name, provider: node.provider },
+                });
+            }
+        }
+        return findings;
+    }
+}

package/dist/analyzers/index.js

@@ -4,7 +4,7 @@ export { MissingIndexAnalyzer, NplusOneAnalyzer, LargeSelectAnalyzer } from './p
 export { MissingMySQLIndexAnalyzer, MySQLFullTableScanAnalyzer } from './mysql.js';
 export { MissingMongoIndexAnalyzer, MongoCollectionScanAnalyzer } from './mongodb.js';
 export { IaCDriftAnalyzer } from './terraform.js';
-export { MissingDLQAnalyzer, UnencryptedQueueAnalyzer, LargeQueueBacklogAnalyzer, MissingSecretRotationAnalyzer, MissingLogRetentionAnalyzer, LambdaDefaultMemoryAnalyzer, LambdaHighTimeoutAnalyzer, LambdaMissingTriggerDLQAnalyzer, } from './aws-services.js';
+export { MissingDLQAnalyzer, UnencryptedQueueAnalyzer, LargeQueueBacklogAnalyzer, MissingSecretRotationAnalyzer, MissingLogRetentionAnalyzer, LambdaDefaultMemoryAnalyzer, LambdaHighTimeoutAnalyzer, LambdaMissingTriggerDLQAnalyzer, S3PublicAccessAnalyzer, S3MissingVersioningAnalyzer, S3UnencryptedAnalyzer, } from './aws-services.js';
 export { RDSPubliclyAccessibleAnalyzer, RDSNoBackupAnalyzer, RDSUnencryptedAnalyzer, RDSNoDeletionProtectionAnalyzer, RDSNoMultiAZAnalyzer, } from './rds.js';
 export async function runAllAnalyzers(graph, analyzers) {
     const allFindings = [];
@@ -19,12 +19,12 @@ export async function runAllAnalyzers(graph, analyzers) {
             logger.warn(`Analyzer "${analyzer.name}" failed: ${err instanceof Error ? err.message : String(err)}`);
         }
     }
-    const severityOrder = { high: 0, medium: 1, low: 2 };
+    const severityOrder = { high: 0, medium: 1, low: 2, verify: 3 };
     allFindings.sort((a, b) => severityOrder[a.severity] - severityOrder[b.severity]);
     return allFindings;
 }
 export function summarizeFindings(findings) {
-    const counts = { total: findings.length, high: 0, medium: 0, low: 0 };
+    const counts = { total: findings.length, high: 0, medium: 0, low: 0, verify: 0 };
     for (const f of findings)
         counts[f.severity]++;
     return counts;

package/dist/cli/commands/analyze.js

@@ -10,16 +10,18 @@ import { extractMongoMetadata } from '../../adapters/db/mongodb.js';
 import { extractIaCSchema } from '../../adapters/iac/terraform.js';
 import { extractSQSMetadata, extractSNSMetadata, extractSSMMetadata, extractSecretsMetadata, extractLambdaMetadata, extractEventBridgeMetadata, extractRDSMetadata, } from '../../adapters/aws/services.js';
 import { extractLogsMetadata } from '../../adapters/aws/logs.js';
+import { extractS3Metadata } from '../../adapters/aws/s3.js';
 import { scanRepository } from '../../context/index.js';
 import { buildGraph } from '../../graph/index.js';
-import { runAllAnalyzers, IaCDriftAnalyzer, FullTableScanAnalyzer, MissingGSIAnalyzer, HotPartitionAnalyzer, MissingIndexAnalyzer, NplusOneAnalyzer, LargeSelectAnalyzer, MissingMySQLIndexAnalyzer, MySQLFullTableScanAnalyzer, MissingMongoIndexAnalyzer, MongoCollectionScanAnalyzer, MissingDLQAnalyzer, UnencryptedQueueAnalyzer, LargeQueueBacklogAnalyzer, MissingSecretRotationAnalyzer, MissingLogRetentionAnalyzer, LambdaDefaultMemoryAnalyzer, LambdaHighTimeoutAnalyzer, LambdaMissingTriggerDLQAnalyzer, RDSPubliclyAccessibleAnalyzer, RDSNoBackupAnalyzer, RDSUnencryptedAnalyzer, RDSNoDeletionProtectionAnalyzer, RDSNoMultiAZAnalyzer, } from '../../analyzers/index.js';
+import { runAllAnalyzers, IaCDriftAnalyzer, FullTableScanAnalyzer, MissingGSIAnalyzer, HotPartitionAnalyzer, MissingIndexAnalyzer, NplusOneAnalyzer, LargeSelectAnalyzer, MissingMySQLIndexAnalyzer, MySQLFullTableScanAnalyzer, MissingMongoIndexAnalyzer, MongoCollectionScanAnalyzer, MissingDLQAnalyzer, UnencryptedQueueAnalyzer, LargeQueueBacklogAnalyzer, MissingSecretRotationAnalyzer, MissingLogRetentionAnalyzer, LambdaDefaultMemoryAnalyzer, LambdaHighTimeoutAnalyzer, LambdaMissingTriggerDLQAnalyzer, RDSPubliclyAccessibleAnalyzer, RDSNoBackupAnalyzer, RDSUnencryptedAnalyzer, RDSNoDeletionProtectionAnalyzer, RDSNoMultiAZAnalyzer, S3PublicAccessAnalyzer, S3MissingVersioningAnalyzer, S3UnencryptedAnalyzer, } from '../../analyzers/index.js';
 import { printFinding, printSummaryBox, log, printHeader } from '../utils.js';
-const SEVERITY_ORDER = { high: 3, medium: 2, low: 1 };
+const SEVERITY_ORDER = { high: 3, medium: 2, low: 1, verify: 0 };
 function buildMarkdownReport(findings, projectName) {
     const date = new Date().toISOString().split('T')[0];
     const high = findings.filter((f) => f.severity === 'high');
     const medium = findings.filter((f) => f.severity === 'medium');
     const low = findings.filter((f) => f.severity === 'low');
+    const verify = findings.filter((f) => f.severity === 'verify');
     const renderGroup = (label, emoji, group) => {
         if (group.length === 0)
             return '';
@@ -30,10 +32,11 @@ function buildMarkdownReport(findings, projectName) {
         `# infrawise report — ${projectName}`,
         `_Generated: ${date}_`,
         '',
-        `**${findings.length} finding(s)**: ${high.length} high · ${medium.length} medium · ${low.length} low`,
+        `**${findings.length} finding(s)**: ${high.length} high · ${medium.length} medium · ${low.length} low · ${verify.length} verify`,
         renderGroup('High severity', '🔴', high),
         renderGroup('Medium severity', '🟡', medium),
         renderGroup('Low severity', '🟢', low),
+        renderGroup('Verify (check intent)', '🔵', verify),
         '',
         '_Generated by [infrawise](https://github.com/Sidd27/infrawise) — MCP server for AWS infrastructure analysis_',
     ].filter((l) => l !== undefined).join('\n');
@@ -192,6 +195,18 @@ export async function runAnalyze(options = {}) {
             s.warn(chalk.yellow('RDS skipped') + chalk.dim(`  ${err instanceof Error ? err.message : String(err)}`));
         }
     }
+    // ── S3 ────────────────────────────────────────────────────────────────────────
+    if (config.s3?.enabled === true) {
+        const s = mkSpinner('Extracting S3 buckets...');
+        try {
+            const result = await extractS3Metadata(awsCfg);
+            servicesMeta.s3 = result;
+            s.succeed(chalk.green('S3') + chalk.dim(`  ${result.length} bucket(s)`));
+        }
+        catch (err) {
+            s.warn(chalk.yellow('S3 skipped') + chalk.dim(`  ${err instanceof Error ? err.message : String(err)}`));
+        }
+    }
     // ── CloudWatch Logs ──────────────────────────────────────────────────────────
     if (config.cloudwatchLogs?.enabled) {
         const s = mkSpinner('Sampling CloudWatch Logs (errors only, max 50 groups)...');
@@ -293,6 +308,11 @@ export async function runAnalyze(options = {}) {
                 new RDSNoDeletionProtectionAnalyzer(),
                 new RDSNoMultiAZAnalyzer(),
             ] : []),
+            ...(config.s3?.enabled === true ? [
+                new S3PublicAccessAnalyzer(),
+                new S3MissingVersioningAnalyzer(),
+                new S3UnencryptedAnalyzer(),
+            ] : []),
             ...(iacDriftAnalyzer ? [iacDriftAnalyzer] : []),
         ];
         findings = await runAllAnalyzers(graph, analyzers);
@@ -384,6 +404,11 @@ export async function runCodeRefresh(repoPath, config) {
             new RDSPubliclyAccessibleAnalyzer(), new RDSNoBackupAnalyzer(), new RDSUnencryptedAnalyzer(),
             new RDSNoDeletionProtectionAnalyzer(), new RDSNoMultiAZAnalyzer(),
         ] : []),
+        ...(config.s3?.enabled === true ? [
+            new S3PublicAccessAnalyzer(),
+            new S3MissingVersioningAnalyzer(),
+            new S3UnencryptedAnalyzer(),
+        ] : []),
         ...(iacDriftAnalyzer ? [iacDriftAnalyzer] : []),
     ];
     const findings = await runAllAnalyzers(graph, analyzers);

package/dist/cli/commands/doctor.js

@@ -10,6 +10,7 @@ import { validateMySQLAccess } from '../../adapters/db/mysql.js';
 import { validateMongoAccess } from '../../adapters/db/mongodb.js';
 import { validateSQSAccess, validateSNSAccess, validateSSMAccess, validateSecretsAccess, validateLambdaAccess, validateEventBridgeAccess, } from '../../adapters/aws/services.js';
 import { validateLogsAccess } from '../../adapters/aws/logs.js';
+import { validateS3Access } from '../../adapters/aws/s3.js';
 import { printHeader } from '../utils.js';
 async function runCheck(label, fn) {
     const spin = ora({ text: chalk.dim(label), color: 'cyan' }).start();
@@ -189,6 +190,22 @@ export async function runDoctor(options = {}) {
             };
         }
     }));
+    // S3
+    results.push(await runCheck('Testing S3 access...', async () => {
+        if (config?.s3?.enabled !== true)
+            return { name: 'S3', status: 'skip', message: 'Disabled in config' };
+        try {
+            await validateS3Access(awsCfg);
+            return { name: 'S3', status: 'pass', message: 'Connected' };
+        }
+        catch (err) {
+            return {
+                name: 'S3', status: 'warn',
+                message: err instanceof Error ? err.message : String(err),
+                detail: 'Check IAM: s3:ListBuckets, s3:GetBucketNotificationConfiguration, s3:GetBucketVersioning, s3:GetBucketEncryption, s3:GetPublicAccessBlock',
+            };
+        }
+    }));
     // CloudWatch Logs
     results.push(await runCheck('Testing CloudWatch Logs access...', async () => {
         if (!config?.cloudwatchLogs?.enabled)

package/dist/cli/utils.js

@@ -93,6 +93,7 @@ function severityBadge(severity) {
         case 'high': return chalk.bgRed.white.bold(` HIGH `);
         case 'medium': return chalk.bgYellow.black.bold(` MED  `);
         case 'low': return chalk.bgCyan.black.bold(` LOW  `);
+        case 'verify': return chalk.bgBlue.white.bold(` VER? `);
     }
 }
 export function printFinding(finding, index) {
@@ -106,6 +107,7 @@ export function printSummaryBox(findings) {
     const high = findings.filter((f) => f.severity === 'high').length;
     const medium = findings.filter((f) => f.severity === 'medium').length;
     const low = findings.filter((f) => f.severity === 'low').length;
+    const verify = findings.filter((f) => f.severity === 'verify').length;
     console.log('');
     console.log(chalk.dim('  ┌─────────────────────────────┐'));
     console.log(chalk.dim('  │') + chalk.bold('  Analysis Summary             ') + chalk.dim('│'));
@@ -113,6 +115,7 @@ export function printSummaryBox(findings) {
     console.log(chalk.dim('  │') + `  ${chalk.red('●')} High     ${chalk.red.bold(String(high).padStart(3))}                 ` + chalk.dim('│'));
     console.log(chalk.dim('  │') + `  ${chalk.yellow('●')} Medium   ${chalk.yellow.bold(String(medium).padStart(3))}                 ` + chalk.dim('│'));
     console.log(chalk.dim('  │') + `  ${chalk.cyan('●')} Low      ${chalk.cyan.bold(String(low).padStart(3))}                 ` + chalk.dim('│'));
+    console.log(chalk.dim('  │') + `  ${chalk.blue('●')} Verify   ${chalk.blue.bold(String(verify).padStart(3))}                 ` + chalk.dim('│'));
     console.log(chalk.dim('  ├─────────────────────────────┤'));
     console.log(chalk.dim('  │') + `  Total    ${chalk.bold(String(findings.length).padStart(3))}                 ` + chalk.dim('│'));
     console.log(chalk.dim('  └─────────────────────────────┘'));

package/dist/core/config.js

@@ -40,6 +40,7 @@ export const InfrawiseConfigSchema = z.object({
     }).optional(),
     eventbridge: z.object({ enabled: z.boolean().optional().default(true) }).optional(),
     rds: z.object({ enabled: z.boolean().optional().default(false) }).optional(),
+    s3: z.object({ enabled: z.boolean().optional().default(false) }).optional(),
     kafka: z.object({ enabled: z.boolean().optional().default(false) }).optional(),
     cloudwatchLogs: z.object({
         enabled: z.boolean().optional().default(false),

package/dist/graph/index.js

@@ -2,10 +2,12 @@ export function buildGraph(operations, dynamoMeta, postgresMeta, mysqlMeta = [],
     const nodes = [];
     const edges = [];
     const nodeIds = new Set();
+    const nodeMap = new Map();
     function addNode(node) {
         if (!nodeIds.has(node.id)) {
             nodes.push(node);
             nodeIds.add(node.id);
+            nodeMap.set(node.id, node);
         }
     }
     // ── Database tables ──────────────────────────────────────────────────────
@@ -152,7 +154,7 @@ export function buildGraph(operations, dynamoMeta, postgresMeta, mysqlMeta = [],
             if (!nodeIds.has(lambdaId))
                 continue;
             edges.push({ from: ruleId, to: lambdaId, type: 'triggers' });
-            const lambdaNodeRef = nodes.find((n) => n.id === lambdaId);
+            const lambdaNodeRef = nodeMap.get(lambdaId);
             if (lambdaNodeRef && lambdaNodeRef.type === 'lambda') {
                 const trigger = {
                     type: 'eventbridge',
@@ -182,13 +184,42 @@ export function buildGraph(operations, dynamoMeta, postgresMeta, mysqlMeta = [],
             multiAZ: db.multiAZ,
         });
     }
+    // ── S3 Buckets ────────────────────────────────────────────────────────────────
+    for (const bucket of servicesMeta.s3 ?? []) {
+        const bucketId = `bucket:aws:${bucket.name}`;
+        addNode({
+            id: bucketId,
+            type: 'bucket',
+            name: bucket.name,
+            provider: 'aws',
+            versioned: bucket.versioned,
+            encrypted: bucket.encrypted,
+            publicAccessBlocked: bucket.publicAccessBlocked,
+        });
+        for (const notification of bucket.notifications) {
+            const lambdaId = `lambda:aws:${notification.lambdaName}`;
+            if (!nodeMap.has(lambdaId))
+                continue;
+            edges.push({ from: bucketId, to: lambdaId, type: 'triggers' });
+            const lambdaNode = nodeMap.get(lambdaId);
+            if (lambdaNode && lambdaNode.type === 'lambda') {
+                lambdaNode.triggers = [
+                    ...(lambdaNode.triggers ?? []),
+                    {
+                        type: 's3',
+                        sourceArn: bucket.arn,
+                        sourceName: bucket.name,
+                        eventShape: 'event.Records[0].s3.object.key',
+                        events: notification.events,
+                    },
+                ];
+            }
+        }
+    }
     // ── Code operations (functions + edges) ───────────────────────────────────
     for (const op of operations) {
         const funcNodeId = `function:${op.filePath}:${op.functionName}`;
-        if (!nodeIds.has(funcNodeId)) {
-            nodes.push({ id: funcNodeId, type: 'function', name: op.functionName, file: op.filePath });
-            nodeIds.add(funcNodeId);
-        }
+        addNode({ id: funcNodeId, type: 'function', name: op.functionName, file: op.filePath });
         // AWS service operations create edges to service nodes
         if (op.serviceType === 'sqs') {
             const queueId = `queue:aws:${op.target}`;
@@ -293,6 +324,9 @@ export function getLambdaNodes(graph) {
 export function getEventBridgeRuleNodes(graph) {
     return graph.nodes.filter((n) => n.type === 'eventbridge_rule');
 }
+export function getBucketNodes(graph) {
+    return graph.nodes.filter((n) => n.type === 'bucket');
+}
 export function getEdgesForNode(graph, nodeId) {
     return graph.edges.filter((e) => e.from === nodeId || e.to === nodeId);
 }

package/dist/server/index.js

@@ -8,7 +8,7 @@ import { z } from 'zod';
 import { logger } from '../core/index.js';
 const { version } = JSON.parse(readFileSync(join(import.meta.dirname, '../../package.json'), 'utf8'));
 import { summarizeFindings } from '../analyzers/index.js';
-import { getTableNodes, getFunctionNodes, getQueueNodes, getTopicNodes, getSecretNodes, getParameterNodes, getLogGroupNodes, getLambdaNodes, getEventBridgeRuleNodes, getScanEdges, getOutgoingEdges, } from '../graph/index.js';
+import { getTableNodes, getFunctionNodes, getQueueNodes, getTopicNodes, getSecretNodes, getParameterNodes, getLogGroupNodes, getLambdaNodes, getEventBridgeRuleNodes, getBucketNodes, getScanEdges, getOutgoingEdges, } from '../graph/index.js';
 // ── State ────────────────────────────────────────────────────────────────────
 let currentGraph = { nodes: [], edges: [] };
 let currentFindings = [];
@@ -42,12 +42,14 @@ export function createMcpServer() {
         const logGroups = getLogGroupNodes(currentGraph);
         const lambdas = getLambdaNodes(currentGraph);
         const functions = getFunctionNodes(currentGraph);
+        const buckets = getBucketNodes(currentGraph);
         return toText({
             summary: {
                 tables: tables.length, functions: functions.length,
                 queues: queues.length, topics: topics.length,
                 secrets: secrets.length, parameters: parameters.length,
                 logGroups: logGroups.length, lambdas: lambdas.length,
+                buckets: buckets.length,
                 totalNodes: currentGraph.nodes.length, totalEdges: currentGraph.edges.length,
                 findings: summarizeFindings(currentFindings),
             },
@@ -58,6 +60,7 @@ export function createMcpServer() {
             parameters: parameters.map((p) => ({ name: p.name, type: p.paramType, tier: p.tier })),
             lambdas: lambdas.map((l) => ({ name: l.name, runtime: l.runtime, memoryMB: l.memoryMB })),
             logGroups: logGroups.map((lg) => ({ name: lg.name, retentionDays: lg.retentionDays ?? 'never', errorCount: lg.errorCount })),
+            buckets: buckets.map((b) => ({ name: b.name, versioned: b.versioned, publicAccessBlocked: b.publicAccessBlocked })),
             highFindings: currentFindings.filter((f) => f.severity === 'high').map((f) => ({ issue: f.issue, recommendation: f.recommendation })),
         });
     }));
@@ -262,6 +265,27 @@ export function createMcpServer() {
             })),
         });
     }));
+    mcp.registerTool('get_s3_overview', {
+        description: 'Returns all S3 buckets with versioning status, encryption, public access configuration, and security findings. Call this when checking which S3 buckets exist, reviewing bucket security posture, or before writing S3 upload/delete handlers to confirm the bucket name. Do NOT call when you only need a quick infrastructure count — use get_infra_overview for that. Object contents are never included.',
+        inputSchema: z.object({}),
+    }, logged('get_s3_overview', async () => {
+        const buckets = getBucketNodes(currentGraph);
+        const bucketFindings = currentFindings.filter((f) => f.metadata?.bucketName);
+        return toText({
+            total: buckets.length,
+            note: 'Object contents are never included.',
+            buckets: buckets.map((b) => ({
+                name: b.name,
+                provider: b.provider,
+                versioned: b.versioned,
+                encrypted: b.encrypted,
+                publicAccessBlocked: b.publicAccessBlocked,
+                findings: bucketFindings
+                    .filter((f) => f.metadata.bucketName === b.name)
+                    .map((f) => ({ severity: f.severity, issue: f.issue })),
+            })),
+        });
+    }));
     mcp.registerTool('get_log_errors', {
         description: 'Returns recent error pattern summaries from CloudWatch log groups: pattern counts and frequencies grouped by log group. Raw log messages are never returned. Use the optional logGroup filter to scope to one group by name substring. Call this when investigating errors or identifying log groups with no retention policy.',
         inputSchema: z.object({ logGroup: z.string().describe('Filter to a specific log group name (optional)').optional() }),
@@ -291,7 +315,7 @@ export function createServer(port = 3000) {
         name: 'io.github.Sidd27/infrawise',
         display_name: 'Infrawise',
         version,
-        description: 'Infrastructure analysis MCP server — scans DynamoDB, PostgreSQL, MySQL, MongoDB, Lambda, SQS, SNS, EventBridge, Secrets Manager, SSM, CloudWatch, Terraform, CDK, and source code. Surfaces missing indexes, DLQ gaps, Lambda misconfig, and correct trigger event shapes.',
+        description: 'Infrastructure analysis MCP server — scans DynamoDB, PostgreSQL, MySQL, MongoDB, S3, Lambda, SQS, SNS, EventBridge, Secrets Manager, SSM, CloudWatch, Terraform, CDK, and source code. Surfaces missing indexes, DLQ gaps, Lambda misconfig, S3 security posture, and correct trigger event shapes.',
         homepage: 'https://github.com/Sidd27/infrawise',
         repository: 'https://github.com/Sidd27/infrawise',
         transports: [{ type: 'streamable-http', url: `http://localhost:${port}/mcp` }],
@@ -299,7 +323,7 @@ export function createServer(port = 3000) {
             'get_infra_overview', 'get_graph_summary', 'analyze_function',
             'suggest_gsi', 'postgres_index_suggestions', 'suggest_mongo_index', 'mysql_index_suggestions',
             'get_queue_details', 'get_topic_details', 'get_secrets_overview', 'get_parameter_overview',
-            'get_lambda_overview', 'get_eventbridge_details', 'get_log_errors',
+            'get_lambda_overview', 'get_eventbridge_details', 'get_s3_overview', 'get_log_errors',
         ],
     }));
     fastify.post('/mcp', async (request, reply) => {

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "infrawise",
-  "version": "0.7.2",
+  "version": "0.8.0",
   "mcpName": "io.github.Sidd27/infrawise",
-  "description": "CLI-first infrastructure intelligence platform — analyzes DynamoDB, PostgreSQL, MySQL, MongoDB, SQS, SNS, SSM, Secrets Manager, Lambda, CloudWatch Logs and exposes findings as an MCP server for Claude Code",
+  "description": "CLI-first infrastructure intelligence platform — analyzes DynamoDB, PostgreSQL, MySQL, MongoDB, SQS, SNS, SSM, Secrets Manager, Lambda, S3, CloudWatch Logs and exposes findings as an MCP server for Claude Code",
   "keywords": [
     "mcp",
     "mcp-server",
@@ -14,6 +14,7 @@
     "sqs",
     "sns",
     "lambda",
+    "s3",
     "eventbridge",
     "cloudwatch",
     "secrets-manager",
@@ -63,6 +64,7 @@
   },
   "dependencies": {
     "@aws-sdk/client-cloudwatch-logs": "^3.1048.0",
+    "@aws-sdk/client-s3": "^3.1048.0",
     "@aws-sdk/client-dynamodb": "^3.1048.0",
     "@aws-sdk/client-eventbridge": "^3.1051.0",
     "@aws-sdk/client-lambda": "^3.1048.0",
@@ -74,9 +76,9 @@
     "@aws-sdk/credential-providers": "^3.1048.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "chalk": "^5.6.2",
-    "commander": "^14.0.3",
+    "commander": "^15.0.0",
     "fastify": "^5.8.5",
-    "inquirer": "^13.4.3",
+    "inquirer": "^14.0.2",
     "js-yaml": "^4.1.0",
     "mongodb": "^7.2.0",
     "mysql2": "^3.9.0",