apisec-code-bolt 0.1.0__py3-none-any.whl

apisec_code_bolt/analysis/integration_detector.py

@@ -0,0 +1,1399 @@
+"""
+Integration detection and fingerprinting.
+
+Detects external integrations (databases, caches, message queues, HTTP clients,
+cloud services, etc.) used by the codebase through three complementary signals:
+
+1. **Import analysis** – which libraries are imported.
+2. **Usage-location tracking** – which files/functions actually call the library.
+3. **SDK usage-pattern extraction** – service-specific info from SDK init calls
+   (e.g. ``boto3.client("s3")`` → AWS S3).
+
+All detection is data-driven via catalogs, making it trivial to add new
+libraries or languages without changing logic.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, Any
+
+from ..core.manifest import stable_id
+
+if TYPE_CHECKING:
+    from ..core.manifest import IntegrationModel
+    from ..parsing.base import ParsedFile
+
+
+# ============================================================================
+# Integration catalog (data-driven)
+# ============================================================================
+
+
+@dataclass(frozen=True)
+class LibraryEntry:
+    """A known library/module that indicates an integration."""
+
+    import_pattern: str  # Matched against import module names
+    integration_type: str  # database, cache, http_client, cloud_service, etc.
+    integration_name: str  # Human-readable name (PostgreSQL, Redis, AWS S3, etc.)
+    call_prefixes: tuple[str, ...] = ()  # Call-site prefixes to track usage locations
+
+
+_LIBRARY_CATALOG: list[LibraryEntry] = [
+    # ── Databases ──────────────────────────────────────────────────────
+    LibraryEntry(
+        "sqlalchemy", "database", "SQLAlchemy", ("engine.", "session.", "create_engine", "text(")
+    ),
+    LibraryEntry("psycopg", "database", "PostgreSQL (psycopg)", ("cursor.", "conn.", "psycopg")),
+    LibraryEntry(
+        "psycopg2",
+        "database",
+        "PostgreSQL (psycopg2)",
+        (
+            "cursor.",
+            "conn.",
+        ),
+    ),
+    LibraryEntry("asyncpg", "database", "PostgreSQL (asyncpg)", ("asyncpg.",)),
+    LibraryEntry("pymysql", "database", "MySQL (PyMySQL)", ("cursor.", "pymysql.")),
+    LibraryEntry("mysqlclient", "database", "MySQL (mysqlclient)", ("cursor.",)),
+    LibraryEntry(
+        "mysql.connector", "database", "MySQL (Connector)", ("cursor.", "mysql.connector.")
+    ),
+    LibraryEntry("pymongo", "database", "MongoDB", ("pymongo.", "collection.", "MongoClient")),
+    LibraryEntry("motor", "database", "MongoDB (Motor)", ("motor.",)),
+    LibraryEntry("sqlite3", "database", "SQLite", ("cursor.", "sqlite3.")),
+    LibraryEntry(
+        "peewee",
+        "database",
+        "Peewee ORM",
+        ("peewee.", ".select(", ".insert(", ".update(", ".delete("),
+    ),
+    LibraryEntry("tortoise", "database", "Tortoise ORM", ("tortoise.",)),
+    LibraryEntry(
+        "sqlmodel",
+        "database",
+        "SQLModel",
+        (
+            "sqlmodel.",
+            "SQLModel",
+        ),
+    ),
+    LibraryEntry("databases", "database", "encode/databases", ("databases.",)),
+    LibraryEntry("aiosqlite", "database", "SQLite (async)", ("aiosqlite.",)),
+    # ── Caches ─────────────────────────────────────────────────────────
+    LibraryEntry("redis", "cache", "Redis", ("redis.", "Redis(", ".set(", ".get(", ".hset(")),
+    LibraryEntry("aioredis", "cache", "Redis (aioredis)", ("aioredis.",)),
+    LibraryEntry("memcache", "cache", "Memcached", ("memcache.",)),
+    LibraryEntry("pymemcache", "cache", "Memcached (pymemcache)", ("pymemcache.",)),
+    LibraryEntry("cachetools", "cache", "cachetools", ("cachetools.",)),
+    # ── Message queues ─────────────────────────────────────────────────
+    LibraryEntry(
+        "celery", "message_queue", "Celery", ("celery.", "Celery(", ".delay(", ".apply_async(")
+    ),
+    LibraryEntry(
+        "pika", "message_queue", "RabbitMQ (pika)", ("pika.", "BlockingConnection", "channel.")
+    ),
+    LibraryEntry("aio_pika", "message_queue", "RabbitMQ (aio-pika)", ("aio_pika.",)),
+    LibraryEntry(
+        "confluent_kafka",
+        "message_queue",
+        "Kafka (confluent)",
+        ("confluent_kafka.", "Producer(", "Consumer("),
+    ),
+    LibraryEntry("aiokafka", "message_queue", "Kafka (aiokafka)", ("aiokafka.",)),
+    LibraryEntry(
+        "kafka",
+        "message_queue",
+        "Kafka (kafka-python)",
+        ("kafka.", "KafkaProducer", "KafkaConsumer"),
+    ),
+    LibraryEntry("kombu", "message_queue", "Kombu", ("kombu.",)),
+    LibraryEntry("rq", "message_queue", "RQ (Redis Queue)", ("rq.", "Queue(")),
+    LibraryEntry("dramatiq", "message_queue", "Dramatiq", ("dramatiq.",)),
+    LibraryEntry("nats", "message_queue", "NATS", ("nats.",)),
+    # ── HTTP clients ───────────────────────────────────────────────────
+    LibraryEntry("httpx", "http_client", "httpx", ("httpx.", "AsyncClient(", "Client(")),
+    LibraryEntry(
+        "requests", "http_client", "requests", ("requests.", ".get(", ".post(", ".put(", ".delete(")
+    ),
+    LibraryEntry("aiohttp", "http_client", "aiohttp", ("aiohttp.", "ClientSession(")),
+    LibraryEntry("urllib3", "http_client", "urllib3", ("urllib3.",)),
+    LibraryEntry("urllib.request", "http_client", "urllib", ("urllib.request.",)),
+    # ── Cloud: AWS ─────────────────────────────────────────────────────
+    LibraryEntry("boto3", "cloud_service", "AWS", ("boto3.", ".client(", ".resource(")),
+    LibraryEntry("botocore", "cloud_service", "AWS (botocore)", ("botocore.",)),
+    # ── Cloud: GCP ─────────────────────────────────────────────────────
+    LibraryEntry("google.cloud", "cloud_service", "GCP", ("google.cloud.",)),
+    LibraryEntry("google.auth", "cloud_service", "GCP (Auth)", ("google.auth.",)),
+    # ── Cloud: Azure ───────────────────────────────────────────────────
+    LibraryEntry("azure", "cloud_service", "Azure", ("azure.",)),
+    # ── Serialization (security-sensitive) ─────────────────────────────
+    LibraryEntry("pickle", "serialization", "pickle", ("pickle.", "pickle.loads", "pickle.load")),
+    LibraryEntry("marshal", "serialization", "marshal", ("marshal.",)),
+    LibraryEntry("jsonpickle", "serialization", "jsonpickle", ("jsonpickle.",)),
+    LibraryEntry("dill", "serialization", "dill", ("dill.",)),
+    LibraryEntry("yaml", "serialization", "PyYAML", ("yaml.", "yaml.load", "yaml.safe_load")),
+    LibraryEntry("ruamel", "serialization", "ruamel.yaml", ("ruamel.",)),
+    # ── XML (XXE-relevant) ─────────────────────────────────────────────
+    LibraryEntry(
+        "xml.etree", "xml_parser", "xml.etree", ("etree.", "ElementTree.", "parse(", "fromstring(")
+    ),
+    LibraryEntry("lxml", "xml_parser", "lxml", ("lxml.", "etree.")),
+    LibraryEntry("defusedxml", "xml_parser", "defusedxml (safe)", ("defusedxml.",)),
+    LibraryEntry("xml.sax", "xml_parser", "xml.sax", ("xml.sax.",)),
+    LibraryEntry("xml.dom", "xml_parser", "xml.dom", ("xml.dom.",)),
+    # ── Templating (SSTI-relevant) ─────────────────────────────────────
+    LibraryEntry("jinja2", "template_engine", "Jinja2", ("jinja2.", "Template(", "Environment(")),
+    LibraryEntry("mako", "template_engine", "Mako", ("mako.",)),
+    LibraryEntry("chameleon", "template_engine", "Chameleon", ("chameleon.",)),
+    # ── Cryptography ───────────────────────────────────────────────────
+    LibraryEntry("cryptography", "crypto", "cryptography", ("cryptography.",)),
+    LibraryEntry("Crypto", "crypto", "PyCryptodome", ("Crypto.",)),
+    LibraryEntry("hashlib", "crypto", "hashlib", ("hashlib.", "hashlib.md5", "hashlib.sha")),
+    LibraryEntry("hmac", "crypto", "hmac", ("hmac.",)),
+    LibraryEntry("bcrypt", "crypto", "bcrypt", ("bcrypt.",)),
+    LibraryEntry("passlib", "crypto", "passlib", ("passlib.",)),
+    LibraryEntry("jwt", "crypto", "PyJWT", ("jwt.", "jwt.decode", "jwt.encode")),
+    LibraryEntry("jose", "crypto", "python-jose", ("jose.",)),
+    LibraryEntry("itsdangerous", "crypto", "itsdangerous", ("itsdangerous.",)),
+    # ── LDAP ───────────────────────────────────────────────────────────
+    LibraryEntry(
+        "ldap3", "directory_service", "LDAP (ldap3)", ("ldap3.", "Connection(", "Server(")
+    ),
+    LibraryEntry("ldap", "directory_service", "LDAP (python-ldap)", ("ldap.",)),
+    # ── Email ──────────────────────────────────────────────────────────
+    LibraryEntry("smtplib", "email", "SMTP", ("smtplib.", "SMTP(")),
+    LibraryEntry("sendgrid", "email", "SendGrid", ("sendgrid.",)),
+    LibraryEntry("mailgun", "email", "Mailgun", ("mailgun.",)),
+    # ── File storage ───────────────────────────────────────────────────
+    LibraryEntry("pathlib", "file_system", "pathlib", ()),  # too common for call tracking
+    LibraryEntry("shutil", "file_system", "shutil", ("shutil.",)),
+    # ── Subprocess / OS (command injection relevant) ───────────────────
+    LibraryEntry(
+        "subprocess", "os_command", "subprocess", ("subprocess.", "Popen(", "run(", "call(")
+    ),
+    LibraryEntry("os", "os_command", "os (system/exec)", ("os.system", "os.popen", "os.exec")),
+    # ── Logging ────────────────────────────────────────────────────────
+    LibraryEntry("sentry_sdk", "monitoring", "Sentry", ("sentry_sdk.",)),
+    LibraryEntry("structlog", "logging", "structlog", ("structlog.",)),
+    LibraryEntry("loguru", "logging", "loguru", ("loguru.",)),
+    # ── Auth providers ─────────────────────────────────────────────────
+    LibraryEntry("authlib", "auth_provider", "Authlib", ("authlib.",)),
+    # ==========================================================================
+    # JVM / Java libraries
+    # ==========================================================================
+    # ── JVM Databases ──────────────────────────────────────────────────
+    # JPA / Hibernate (ORM)
+    LibraryEntry(
+        "javax.persistence",
+        "database",
+        "JPA",
+        ("entityManager.", "em.", "createQuery", "persist(", "merge("),
+    ),
+    LibraryEntry(
+        "jakarta.persistence",
+        "database",
+        "JPA",
+        ("entityManager.", "em.", "createQuery", "persist(", "merge("),
+    ),
+    LibraryEntry(
+        "org.hibernate",
+        "database",
+        "Hibernate ORM",
+        ("session.", "sessionFactory.", "HibernateTemplate"),
+    ),
+    LibraryEntry(
+        "org.springframework.data",
+        "database",
+        "Spring Data",
+        ("repository.", "findById", "findAll", "save(", "deleteById"),
+    ),
+    LibraryEntry(
+        "org.jooq",
+        "database",
+        "jOOQ",
+        ("dslContext.", "DSL.", ".select(", ".insertInto(", ".update("),
+    ),
+    LibraryEntry("org.mybatis", "database", "MyBatis", ("sqlSession.", "mapper.")),
+    LibraryEntry("io.r2dbc", "database", "R2DBC", ("connection.", "statement.", "r2dbc")),
+    # JDBC drivers
+    LibraryEntry(
+        "org.postgresql", "database", "PostgreSQL (JDBC)", ("DriverManager.", "prepareStatement(")
+    ),
+    LibraryEntry("com.mysql", "database", "MySQL (JDBC)", ("DriverManager.", "prepareStatement(")),
+    LibraryEntry("com.h2database", "database", "H2 (in-memory)", ("H2ConsoleServlet",)),
+    LibraryEntry("org.hsqldb", "database", "HSQLDB", ()),
+    LibraryEntry("com.zaxxer.hikari", "database", "HikariCP", ("HikariDataSource", "HikariConfig")),
+    LibraryEntry("org.apache.commons.dbcp", "database", "Apache DBCP", ("BasicDataSource",)),
+    # NoSQL
+    LibraryEntry(
+        "com.mongodb",
+        "database",
+        "MongoDB (Java Driver)",
+        ("MongoClient", "collection.", "find(", "insertOne(", "updateOne("),
+    ),
+    LibraryEntry(
+        "org.springframework.data.mongodb",
+        "database",
+        "Spring Data MongoDB",
+        ("mongoTemplate.", "repository."),
+    ),
+    LibraryEntry("com.datastax", "database", "Cassandra", ("CqlSession", "session.execute(")),
+    LibraryEntry(
+        "redis.clients.jedis", "cache", "Redis (Jedis)", ("jedis.", "Jedis(", ".get(", ".set(")
+    ),
+    LibraryEntry(
+        "io.lettuce.core", "cache", "Redis (Lettuce)", ("RedisClient", "connection.", "commands.")
+    ),
+    LibraryEntry("net.spy.memcached", "cache", "Memcached (spymemcached)", ("MemcachedClient",)),
+    # ── JVM Message queues ─────────────────────────────────────────────
+    LibraryEntry(
+        "org.apache.kafka",
+        "message_queue",
+        "Kafka",
+        ("KafkaProducer", "KafkaConsumer", "producer.send(", "consumer.poll("),
+    ),
+    LibraryEntry(
+        "org.springframework.kafka",
+        "message_queue",
+        "Kafka (Spring)",
+        ("KafkaTemplate", "kafkaTemplate.", "@KafkaListener"),
+    ),
+    LibraryEntry(
+        "com.rabbitmq",
+        "message_queue",
+        "RabbitMQ (AMQP)",
+        ("channel.", "ConnectionFactory", "basicPublish(", "basicConsume("),
+    ),
+    LibraryEntry(
+        "org.springframework.amqp",
+        "message_queue",
+        "RabbitMQ (Spring)",
+        ("rabbitTemplate.", "RabbitTemplate", "@RabbitListener"),
+    ),
+    LibraryEntry(
+        "io.nats.client",
+        "message_queue",
+        "NATS",
+        ("Nats.connect", "connection.publish(", "connection.subscribe("),
+    ),
+    LibraryEntry(
+        "javax.jms",
+        "message_queue",
+        "JMS",
+        ("jmsTemplate.", "session.createQueue(", "producer.send("),
+    ),
+    LibraryEntry(
+        "jakarta.jms",
+        "message_queue",
+        "JMS",
+        ("jmsTemplate.", "session.createQueue(", "producer.send("),
+    ),
+    LibraryEntry(
+        "org.apache.activemq", "message_queue", "ActiveMQ", ("ActiveMQConnectionFactory",)
+    ),
+    LibraryEntry(
+        "com.amazonaws.services.sqs",
+        "message_queue",
+        "AWS SQS",
+        ("SqsClient", "sendMessage(", "receiveMessage("),
+    ),
+    # ── JVM HTTP clients ───────────────────────────────────────────────
+    LibraryEntry(
+        "org.springframework.web.client",
+        "http_client",
+        "Spring RestTemplate",
+        ("restTemplate.", "exchange(", "getForObject(", "postForObject("),
+    ),
+    LibraryEntry(
+        "org.springframework.web.reactive.function.client",
+        "http_client",
+        "Spring WebClient",
+        ("WebClient", "webClient.", ".retrieve(", ".bodyToMono("),
+    ),
+    LibraryEntry(
+        "com.squareup.okhttp3",
+        "http_client",
+        "OkHttp",
+        ("OkHttpClient", "okHttpClient.", "newCall(", ".execute("),
+    ),
+    LibraryEntry(
+        "org.apache.http",
+        "http_client",
+        "Apache HttpClient",
+        ("HttpClient", "httpClient.", "execute(", "CloseableHttpClient"),
+    ),
+    LibraryEntry(
+        "org.apache.hc",
+        "http_client",
+        "Apache HttpClient 5",
+        ("HttpClient", "CloseableHttpClient", "execute("),
+    ),
+    LibraryEntry("feign", "http_client", "OpenFeign", ("Feign.builder(", "@FeignClient")),
+    LibraryEntry("retrofit2", "http_client", "Retrofit", ("Retrofit.Builder(", "retrofit.create(")),
+    LibraryEntry(
+        "java.net.http",
+        "http_client",
+        "Java HttpClient",
+        ("HttpClient.newHttpClient(", "HttpRequest.newBuilder(", "client.send("),
+    ),
+    # ── JVM Cloud: AWS ─────────────────────────────────────────────────
+    LibraryEntry(
+        "com.amazonaws",
+        "cloud_service",
+        "AWS SDK v1",
+        ("AmazonS3", "AmazonDynamoDB", "AWSLambda", "AmazonSNS", "AmazonSQS"),
+    ),
+    LibraryEntry(
+        "software.amazon.awssdk",
+        "cloud_service",
+        "AWS SDK v2",
+        ("S3Client", "DynamoDbClient", "LambdaClient", "SnsClient", "SqsClient"),
+    ),
+    # ── JVM Cloud: GCP ─────────────────────────────────────────────────
+    LibraryEntry(
+        "com.google.cloud",
+        "cloud_service",
+        "GCP Java SDK",
+        ("Storage", "Firestore", "BigQuery", "PubSub", "Spanner"),
+    ),
+    LibraryEntry("com.google.auth", "cloud_service", "GCP Auth", ("GoogleCredentials",)),
+    # ── JVM Cloud: Azure ───────────────────────────────────────────────
+    LibraryEntry(
+        "com.azure",
+        "cloud_service",
+        "Azure SDK",
+        ("BlobClient", "QueueClient", "SecretClient", "CosmosClient"),
+    ),
+    LibraryEntry("com.microsoft.azure", "cloud_service", "Azure SDK (legacy)", ()),
+    # ── JVM Serialization ──────────────────────────────────────────────
+    LibraryEntry(
+        "com.fasterxml.jackson",
+        "serialization",
+        "Jackson",
+        ("objectMapper.", "ObjectMapper(", "readValue(", "writeValueAsString("),
+    ),
+    LibraryEntry(
+        "com.google.gson", "serialization", "Gson", ("gson.", "Gson(", "fromJson(", "toJson(")
+    ),
+    LibraryEntry(
+        "org.json", "serialization", "JSON.org", ("JSONObject(", "JSONArray(", "new JSONObject")
+    ),
+    LibraryEntry(
+        "com.fasterxml.jackson.dataformat.xml", "xml_parser", "Jackson XML", ("XmlMapper",)
+    ),
+    LibraryEntry(
+        "javax.xml",
+        "xml_parser",
+        "JAXB / Java XML",
+        ("JAXBContext", "Marshaller", "Unmarshaller", "DocumentBuilder"),
+    ),
+    LibraryEntry(
+        "jakarta.xml",
+        "xml_parser",
+        "JAXB / Jakarta XML",
+        ("JAXBContext", "Marshaller", "Unmarshaller"),
+    ),
+    LibraryEntry(
+        "org.w3c.dom", "xml_parser", "W3C DOM", ("DocumentBuilder", "Document", "Element")
+    ),
+    LibraryEntry(
+        "javax.xml.parsers",
+        "xml_parser",
+        "SAX/DOM Parser",
+        ("DocumentBuilderFactory", "SAXParserFactory"),
+    ),
+    # ── JVM Cryptography ───────────────────────────────────────────────
+    LibraryEntry(
+        "javax.crypto",
+        "crypto",
+        "Java Crypto (JCE)",
+        ("Cipher.", "SecretKey", "KeyGenerator", "Mac.", "MessageDigest"),
+    ),
+    LibraryEntry(
+        "java.security",
+        "crypto",
+        "Java Security (JCA)",
+        ("MessageDigest", "Signature", "KeyPair", "KeyStore"),
+    ),
+    LibraryEntry(
+        "org.bouncycastle", "crypto", "Bouncy Castle", ("BCProvider", "Cipher", "KeyPairGenerator")
+    ),
+    LibraryEntry(
+        "io.jsonwebtoken", "crypto", "jjwt", ("Jwts.", "JwtBuilder", "parseClaimsJws(", "signWith(")
+    ),
+    LibraryEntry(
+        "com.nimbusds",
+        "crypto",
+        "Nimbus JOSE+JWT",
+        ("JWTParser", "SignedJWT", "JWSObject", "NimbusJwtDecoder"),
+    ),
+    LibraryEntry(
+        "org.springframework.security.crypto",
+        "crypto",
+        "Spring Security Crypto",
+        ("BCryptPasswordEncoder", "passwordEncoder.", "encode(", "matches("),
+    ),
+    # ── JVM LDAP / Directory ───────────────────────────────────────────
+    LibraryEntry(
+        "org.springframework.ldap",
+        "directory_service",
+        "Spring LDAP",
+        ("ldapTemplate.", "LdapTemplate"),
+    ),
+    LibraryEntry(
+        "javax.naming",
+        "directory_service",
+        "JNDI / LDAP",
+        ("InitialDirContext", "DirContext", "NamingEnumeration"),
+    ),
+    # ── JVM Email ──────────────────────────────────────────────────────
+    LibraryEntry(
+        "javax.mail", "email", "JavaMail", ("Session.getInstance", "Transport.send(", "MimeMessage")
+    ),
+    LibraryEntry(
+        "jakarta.mail",
+        "email",
+        "Jakarta Mail",
+        ("Session.getInstance", "Transport.send(", "MimeMessage"),
+    ),
+    LibraryEntry(
+        "org.springframework.mail",
+        "email",
+        "Spring Mail",
+        ("mailSender.", "JavaMailSender", "SimpleMailMessage"),
+    ),
+    LibraryEntry("com.sendgrid", "email", "SendGrid Java", ("SendGrid(", "sg.api(", "Mail(")),
+    # ── JVM File / OS ──────────────────────────────────────────────────
+    LibraryEntry(
+        "java.lang.Runtime", "os_command", "Runtime.exec", ("Runtime.getRuntime(", ".exec(")
+    ),
+    LibraryEntry(
+        "java.lang.ProcessBuilder", "os_command", "ProcessBuilder", ("ProcessBuilder(", ".start(")
+    ),
+    LibraryEntry("java.nio.file", "file_system", "Java NIO File", ("Files.", "Paths.", "Path.of(")),
+    LibraryEntry(
+        "java.io",
+        "file_system",
+        "Java IO",
+        ("FileInputStream", "FileOutputStream", "BufferedReader", "FileWriter"),
+    ),
+    # ── JVM Monitoring / Logging ───────────────────────────────────────
+    LibraryEntry(
+        "io.micrometer",
+        "monitoring",
+        "Micrometer",
+        ("meterRegistry.", "Counter.", "Timer.", "Gauge."),
+    ),
+    LibraryEntry(
+        "io.opentelemetry", "monitoring", "OpenTelemetry", ("Tracer", "Span", "openTelemetry.")
+    ),
+    LibraryEntry(
+        "io.sentry", "monitoring", "Sentry", ("Sentry.captureException(", "Sentry.captureMessage(")
+    ),
+    LibraryEntry("org.slf4j", "logging", "SLF4J", ("LoggerFactory.getLogger(", "log.", "logger.")),
+    LibraryEntry(
+        "org.apache.logging.log4j",
+        "logging",
+        "Log4j2",
+        ("LogManager.getLogger(", "logger.", "log4j"),
+    ),
+    LibraryEntry("ch.qos.logback", "logging", "Logback", ("LoggerFactory.getLogger(",)),
+    # ── JVM Auth providers ─────────────────────────────────────────────
+    LibraryEntry(
+        "org.springframework.security",
+        "auth_provider",
+        "Spring Security",
+        ("SecurityContextHolder", "Authentication", "UserDetails", "WebSecurityConfigurerAdapter"),
+    ),
+    LibraryEntry("com.okta", "auth_provider", "Okta Java SDK", ("OktaClient", "okta.")),
+    LibraryEntry("com.auth0", "auth_provider", "Auth0 Java SDK", ("AuthAPI", "mgmtAPI.", "auth0.")),
+    # ── JavaScript / TypeScript — Databases ───────────────────────────────
+    # Call prefixes use library-specific tokens to avoid collisions;
+    # generic names like "query(", "db.", "Client(" are omitted.
+    LibraryEntry("mongoose", "database", "MongoDB (Mongoose)", ("mongoose.", "mongoose.model(")),
+    LibraryEntry(
+        "mongodb", "database", "MongoDB (Node driver)", ("MongoClient(", "collection.find(")
+    ),
+    LibraryEntry("pg", "database", "PostgreSQL (node-postgres)", ("pg.Pool(", "pg.Client(")),
+    LibraryEntry("mysql", "database", "MySQL (mysql)", ("mysql.createConnection(",)),
+    LibraryEntry("mysql2", "database", "MySQL (mysql2)", ("mysql2.createConnection(",)),
+    LibraryEntry(
+        "mssql", "database", "MS SQL Server (mssql)", ("mssql.", "sql.connect(", "ConnectionPool(")
+    ),
+    LibraryEntry(
+        "tedious", "database", "MS SQL Server (tedious)", ("tedious.", "Connection(", "Request(")
+    ),
+    LibraryEntry("oracledb", "database", "Oracle DB", ("oracledb.", "getConnection(", "execute(")),
+    LibraryEntry("sqlite3", "database", "SQLite (node)", ("db.run(", "db.get(", "db.all(")),
+    # Note: "redis" npm package is already covered by the Python redis entry above.
+    LibraryEntry("ioredis", "cache", "Redis (ioredis)", ("ioredis.", "new Redis(")),
+    LibraryEntry(
+        "@prisma/client", "database", "Prisma ORM", ("PrismaClient(", "prisma.", "prisma.$connect(")
+    ),
+    LibraryEntry("typeorm", "database", "TypeORM", ("DataSource(", "typeorm.", "getRepository(")),
+    LibraryEntry("sequelize", "database", "Sequelize", ("Sequelize(", "sequelize.define(")),
+    LibraryEntry("knex", "database", "Knex.js", ("knex(", "knex.schema.", "trx.")),
+    # ── JavaScript / TypeScript — HTTP Clients ────────────────────────────
+    # Avoid generic prefixes like "get(", "post(", "request(", "fetch(" — use
+    # library-specific tokens only.
+    LibraryEntry("axios", "http_client", "Axios", ("axios.", "axios.create(")),
+    LibraryEntry("node-fetch", "http_client", "node-fetch", ("node-fetch",)),
+    LibraryEntry("got", "http_client", "Got", ("got.get(", "got.post(", "got.extend(")),
+    LibraryEntry("superagent", "http_client", "SuperAgent", ("superagent.",)),
+    LibraryEntry("undici", "http_client", "Undici", ("undici.", "undici.fetch(")),
+    LibraryEntry(
+        "@nestjs/axios", "http_client", "NestJS HttpModule", ("httpService.", "httpService.get(")
+    ),
+    # ── JavaScript / TypeScript — Message Queues ──────────────────────────
+    LibraryEntry(
+        "kafkajs",
+        "message_queue",
+        "Kafka (kafkajs)",
+        ("Kafka(", "kafka.producer(", "kafka.consumer("),
+    ),
+    LibraryEntry(
+        "amqplib",
+        "message_queue",
+        "RabbitMQ (amqplib)",
+        ("amqplib.connect(", "channel.assertQueue("),
+    ),
+    LibraryEntry("bull", "message_queue", "Bull Queue", ("new Queue(", "queue.process(")),
+    LibraryEntry("bullmq", "message_queue", "BullMQ", ("new Queue(", "new Worker(")),
+    LibraryEntry("@nestjs/bull", "message_queue", "NestJS Bull", ("InjectQueue(", "InjectQueue")),
+    # ── JavaScript / TypeScript — Cloud ───────────────────────────────────
+    LibraryEntry(
+        "aws-sdk", "cloud_service", "AWS SDK v2", ("AWS.", "new AWS.S3(", "new AWS.DynamoDB(")
+    ),
+    LibraryEntry(
+        "@aws-sdk/client-s3", "cloud_service", "AWS S3", ("S3Client(", "PutObjectCommand(")
+    ),
+    LibraryEntry(
+        "@aws-sdk/client-dynamodb",
+        "cloud_service",
+        "AWS DynamoDB",
+        ("DynamoDBClient(", "GetItemCommand("),
+    ),
+    LibraryEntry(
+        "@aws-sdk/lib-dynamodb",
+        "cloud_service",
+        "AWS DynamoDB (DocumentClient)",
+        ("DynamoDBDocumentClient(", "GetCommand("),
+    ),
+    LibraryEntry(
+        "@aws-sdk/client-sqs", "cloud_service", "AWS SQS", ("SQSClient(", "SendMessageCommand(")
+    ),
+    LibraryEntry(
+        "@aws-sdk/client-secretsmanager",
+        "cloud_service",
+        "AWS Secrets Manager",
+        ("SecretsManagerClient(", "GetSecretValueCommand("),
+    ),
+    LibraryEntry("@google-cloud/storage", "cloud_service", "GCS", ("Storage(", "bucket(", "gcs.")),
+    LibraryEntry(
+        "@azure/storage-blob",
+        "cloud_service",
+        "Azure Blob",
+        ("BlobServiceClient(", "containerClient."),
+    ),
+    # ── JavaScript / TypeScript — Email / Notification ────────────────────
+    LibraryEntry(
+        "nodemailer",
+        "email",
+        "Nodemailer",
+        ("createTransport(", "transporter.", "transporter.sendMail("),
+    ),
+    LibraryEntry("@sendgrid/mail", "email", "SendGrid (JS)", ("sgMail.", "sgMail.send(")),
+    LibraryEntry("twilio", "sms", "Twilio", ("Twilio(", "client.messages.create(")),
+    LibraryEntry("stripe", "payments", "Stripe", ("Stripe(", "stripe.", "stripe.charges.")),
+    # ── JavaScript / TypeScript — Auth Providers ──────────────────────────
+    LibraryEntry(
+        "passport",
+        "auth_provider",
+        "Passport.js",
+        ("passport.", "passport.use(", "passport.authenticate("),
+    ),
+    LibraryEntry("passport-jwt", "auth_provider", "Passport JWT", ("JwtStrategy(", "ExtractJwt.")),
+    LibraryEntry("passport-saml", "auth_provider", "Passport SAML", ("SamlStrategy(",)),
+    LibraryEntry(
+        "@nestjs/jwt", "auth_provider", "NestJS JWT", ("JwtService(", "jwtService.", "JwtModule.")
+    ),
+    LibraryEntry(
+        "@nestjs/passport", "auth_provider", "NestJS Passport", ("AuthGuard(", "PassportStrategy(")
+    ),
+    LibraryEntry(
+        "jsonwebtoken",
+        "auth_provider",
+        "JWT (jsonwebtoken)",
+        ("jwt.sign(", "jwt.verify(", "jwt.decode("),
+    ),
+    LibraryEntry(
+        "openid-client",
+        "auth_provider",
+        "OIDC (openid-client)",
+        ("Issuer.", "Client(", "generators."),
+    ),
+    LibraryEntry("keycloak-connect", "auth_provider", "Keycloak", ("Keycloak(", "keycloak.")),
+    LibraryEntry(
+        "@auth0/auth0-spa-js", "auth_provider", "Auth0 JS SDK", ("Auth0Client(", "auth0.")
+    ),
+    LibraryEntry(
+        "firebase-admin",
+        "auth_provider",
+        "Firebase Admin",
+        ("admin.", "admin.auth()", "verifyIdToken("),
+    ),
+    # ── JavaScript / TypeScript — Search ──────────────────────────────────
+    LibraryEntry(
+        "@elastic/elasticsearch",
+        "search",
+        "Elasticsearch (JS)",
+        ("client.search(", "client.index(", "new Client("),
+    ),
+    LibraryEntry("algoliasearch", "search", "Algolia", ("algoliasearch(", "index.search(")),
+    # ── JavaScript / TypeScript — Logging / Monitoring ────────────────────
+    LibraryEntry("pino", "logging", "Pino", ("pino(", "logger.info(", "logger.error(")),
+    LibraryEntry(
+        "winston", "logging", "Winston", ("winston.createLogger(", "logger.info(", "transports.")
+    ),
+    LibraryEntry("bunyan", "logging", "Bunyan", ("bunyan.createLogger(", "log.info(")),
+    LibraryEntry(
+        "@sentry/node", "monitoring", "Sentry (Node)", ("Sentry.init(", "Sentry.captureException(")
+    ),
+    LibraryEntry("dd-trace", "monitoring", "Datadog APM", ("tracer.", "dd-trace")),
+    # ── JavaScript / TypeScript — GraphQL ─────────────────────────────────
+    LibraryEntry(
+        "graphql", "api_framework", "GraphQL.js", ("graphql(", "buildSchema(", "graphqlHTTP(")
+    ),
+    LibraryEntry(
+        "apollo-server", "api_framework", "Apollo Server", ("ApolloServer(", "gql`", "typeDefs")
+    ),
+    LibraryEntry(
+        "@nestjs/graphql",
+        "api_framework",
+        "NestJS GraphQL",
+        ("GraphQLModule.", "@Resolver", "@ObjectType"),
+    ),
+    # ── JavaScript / TypeScript — File / Storage ──────────────────────────
+    LibraryEntry(
+        "multer",
+        "file_system",
+        "Multer (file upload)",
+        ("multer(", "upload.single(", "upload.array("),
+    ),
+    LibraryEntry(
+        "@nestjs/platform-express",
+        "file_system",
+        "NestJS file handling",
+        ("FileInterceptor(", "FilesInterceptor("),
+    ),
+]
+
+
+# ============================================================================
+# SDK usage-pattern catalog (for extracting service-specific info)
+# ============================================================================
+
+
+@dataclass(frozen=True)
+class SdkUsagePattern:
+    """Describes how to extract service-specific info from an SDK init call."""
+
+    library: str  # Library this pattern belongs to
+    call_pattern: str  # Callee name to match (e.g. "boto3.client")
+    service_arg_position: int | None = None  # Positional arg index
+    service_arg_keyword: str | None = None  # Keyword arg name
+    result_type_prefix: str | None = None  # Prepend to the integration name
+
+
+_SDK_PATTERNS: list[SdkUsagePattern] = [
+    # boto3.client("s3") / boto3.client(service_name="s3")
+    SdkUsagePattern(
+        "boto3",
+        "boto3.client",
+        service_arg_position=0,
+        service_arg_keyword="service_name",
+        result_type_prefix="AWS",
+    ),
+    SdkUsagePattern(
+        "boto3",
+        "boto3.resource",
+        service_arg_position=0,
+        service_arg_keyword="service_name",
+        result_type_prefix="AWS",
+    ),
+    # google.cloud.storage.Client() → GCS
+    SdkUsagePattern("google.cloud", "storage.Client", result_type_prefix="GCP"),
+    SdkUsagePattern("google.cloud", "bigquery.Client", result_type_prefix="GCP"),
+    SdkUsagePattern("google.cloud", "pubsub_v1.PublisherClient", result_type_prefix="GCP"),
+    SdkUsagePattern("google.cloud", "firestore.Client", result_type_prefix="GCP"),
+]
+
+
+# ============================================================================
+# HTTP target extraction catalog
+# ============================================================================
+
+
+@dataclass(frozen=True)
+class HttpMethodPattern:
+    """
+    Describes an HTTP client call that carries a target URL argument.
+
+    The detector scans call sites for these patterns to extract outbound
+    targets (URLs/hostnames) that the application communicates with.
+    """
+
+    callee_contains: str  # Match when callee_name contains this string
+    url_arg_position: int  # Positional index of the URL argument (0-based)
+    url_keyword: str  # Keyword argument name for the URL (fallback)
+    inferred_method: str  # HTTP verb to tag (empty = infer from first arg)
+
+
+_HTTP_TARGET_PATTERNS: list[HttpMethodPattern] = [
+    # ── requests ──────────────────────────────────────────────────────
+    HttpMethodPattern("requests.get", 0, "url", "GET"),
+    HttpMethodPattern("requests.post", 0, "url", "POST"),
+    HttpMethodPattern("requests.put", 0, "url", "PUT"),
+    HttpMethodPattern("requests.delete", 0, "url", "DELETE"),
+    HttpMethodPattern("requests.patch", 0, "url", "PATCH"),
+    HttpMethodPattern("requests.head", 0, "url", "HEAD"),
+    HttpMethodPattern("requests.options", 0, "url", "OPTIONS"),
+    HttpMethodPattern("requests.request", 1, "url", ""),
+    # ── httpx ─────────────────────────────────────────────────────────
+    HttpMethodPattern("httpx.get", 0, "url", "GET"),
+    HttpMethodPattern("httpx.post", 0, "url", "POST"),
+    HttpMethodPattern("httpx.put", 0, "url", "PUT"),
+    HttpMethodPattern("httpx.delete", 0, "url", "DELETE"),
+    HttpMethodPattern("httpx.patch", 0, "url", "PATCH"),
+    HttpMethodPattern("httpx.head", 0, "url", "HEAD"),
+    HttpMethodPattern("httpx.options", 0, "url", "OPTIONS"),
+    HttpMethodPattern("httpx.request", 1, "url", ""),
+    # ── urllib.request ────────────────────────────────────────────────
+    HttpMethodPattern("urllib.request.urlopen", 0, "url", "GET"),
+    HttpMethodPattern("urlopen", 0, "url", "GET"),
+]
+
+# Patterns matched by suffix only (for instance-method calls like
+# ``session.get(url)``).  These are only applied when the caller file
+# has already been associated with a specific http_client library through
+# Phase 1/2 detection, AND the receiver passes the blocklist check, AND
+# the URL argument passes the plausibility filter.
+_HTTP_INSTANCE_SUFFIXES: dict[str, str] = {
+    ".get": "GET",
+    ".post": "POST",
+    ".put": "PUT",
+    ".delete": "DELETE",
+    ".patch": "PATCH",
+    ".head": "HEAD",
+    ".options": "OPTIONS",
+    ".request": "",
+}
+
+# Receiver prefixes that indicate a framework/app/router object — not an
+# HTTP client.  Calls like ``app.get("/path")`` or ``router.post("/path")``
+# are route registrations (often decorators), not outbound HTTP requests.
+_RECEIVER_BLOCKLIST: set[str] = {
+    "app",
+    "router",
+    "api",
+    "api_router",
+    "self.app",
+    "self.router",
+    "self.api_router",
+    "cls.app",
+    "cls.router",
+}
+
+# Broader patterns checked via prefix/suffix matching when the exact
+# receiver isn't in the blocklist.
+_RECEIVER_BLOCKLIST_PATTERNS: tuple[str, ...] = (
+    "_app",
+    "_router",
+    "blueprint",
+    "flask_app",
+    "fastapi_app",
+)
+
+# ---------------------------------------------------------------------------
+# Receiver ALLOWLIST — positive matching for HTTP client objects.
+#
+# Instance-suffix matching (`session.get(url)`) only fires when the
+# receiver's base name appears in this set.  This prevents false positives
+# from unrelated `.get()` calls (e.g. `dict.get`, `plugins.get`,
+# `instance.get`, `headers.get`).
+# ---------------------------------------------------------------------------
+_HTTP_CLIENT_RECEIVER_NAMES: set[str] = {
+    # Library module names (for module-level calls via alias)
+    "requests",
+    "httpx",
+    "aiohttp",
+    "urllib",
+    "urllib3",
+    # Common variable names for HTTP client objects
+    "session",
+    "http_session",
+    "http",
+    "http_client",
+    "client",
+    "api_client",
+    "rest_client",
+    "web_client",
+    "conn",
+    "connection",
+    "transport",
+    "resp",
+    "response",
+}
+
+# Suffix patterns: a receiver whose last dotted segment ends with one of
+# these is treated as an HTTP client (e.g. ``self.session``,
+# ``self._http_client``, ``cls.client``).
+_HTTP_CLIENT_RECEIVER_SUFFIXES: tuple[str, ...] = (
+    "session",
+    "client",
+    "http",
+    "http_client",
+    "transport",
+    "connection",
+    "conn",
+    "requests",
+    "httpx",
+    "aiohttp",
+)
+
+
+# ============================================================================
+# Usage location tracking
+# ============================================================================
+
+
+@dataclass
+class UsageLocation:
+    """A location where an integration is actually used."""
+
+    file: str
+    line: int
+    function: str | None
+    call_expression: str
+
+
+@dataclass
+class ExtractedTarget:
+    """
+    An outbound HTTP call target extracted from a call site argument.
+
+    Represents a concrete URL/hostname the application connects to at runtime.
+    """
+
+    base_url: str
+    path_pattern: str = ""
+    http_method: str = ""
+    is_literal: bool = True
+    file: str = ""
+    line: int = 0
+    function: str | None = None
+
+
+@dataclass
+class DetectedIntegration:
+    """Full detection result for one integration."""
+
+    integration_type: str
+    name: str
+    detection_methods: list[str] = field(default_factory=list)
+    locations: list[UsageLocation] = field(default_factory=list)
+    metadata: dict[str, Any] = field(default_factory=dict)
+    sub_services: list[str] = field(default_factory=list)
+    targets: list[ExtractedTarget] = field(default_factory=list)
+
+
+# ============================================================================
+# IntegrationDetector
+# ============================================================================
+
+
+class IntegrationDetector:
+    """
+    Detects external integrations through import analysis, call-site
+    scanning, and SDK usage-pattern extraction.
+    """
+
+    def __init__(self, parsed_files: list[ParsedFile]) -> None:
+        self._parsed_files = [pf for pf in parsed_files if pf.success]
+        self._catalog = _LIBRARY_CATALOG
+        self._sdk_patterns = _SDK_PATTERNS
+
+    def detect(self) -> list[DetectedIntegration]:
+        """Run full detection pipeline and return results."""
+        results: dict[str, DetectedIntegration] = {}
+
+        # Phase 1: import-based detection
+        self._detect_from_imports(results)
+
+        # Phase 2: usage-location tracking (call-site scan)
+        self._track_usage_locations(results)
+
+        # Phase 3: SDK usage-pattern extraction
+        self._extract_sdk_services(results)
+
+        # Phase 4: HTTP target extraction (URLs/hostnames from call args)
+        self._extract_http_targets(results)
+
+        return list(results.values())
+
+    # ------------------------------------------------------------------
+    # Phase 1: import scanning
+    # ------------------------------------------------------------------
+
+    def _detect_from_imports(self, results: dict[str, DetectedIntegration]) -> None:
+        for pf in self._parsed_files:
+            for imp in pf.imports:
+                full_module = imp.module or ""
+                top_module = full_module.split(".")[0]
+                for entry in self._catalog:
+                    pat = entry.import_pattern
+                    if pat == top_module or pat in full_module or full_module.startswith(pat):
+                        key = entry.integration_name
+                        if key not in results:
+                            results[key] = DetectedIntegration(
+                                integration_type=entry.integration_type,
+                                name=entry.integration_name,
+                                detection_methods=["import"],
+                            )
+                        elif "import" not in results[key].detection_methods:
+                            results[key].detection_methods.append("import")
+
+    # ------------------------------------------------------------------
+    # Phase 2: usage-location tracking
+    # ------------------------------------------------------------------
+
+    def _track_usage_locations(self, results: dict[str, DetectedIntegration]) -> None:
+        """For each detected integration, find call sites that use it."""
+        if not results:
+            return
+
+        prefix_to_integration: dict[str, str] = {}
+        for entry in self._catalog:
+            if entry.integration_name in results:
+                for prefix in entry.call_prefixes:
+                    prefix_to_integration[prefix] = entry.integration_name
+
+        if not prefix_to_integration:
+            return
+
+        for pf in self._parsed_files:
+            file_str = str(pf.path)
+            for cs in pf.call_sites:
+                callee = cs.callee_name
+                for prefix, int_name in prefix_to_integration.items():
+                    if prefix in callee:
+                        det = results[int_name]
+                        if "sdk_usage" not in det.detection_methods:
+                            det.detection_methods.append("sdk_usage")
+                        caller = cs.caller_function.full if cs.caller_function else None
+                        det.locations.append(
+                            UsageLocation(
+                                file=file_str,
+                                line=cs.location.line,
+                                function=caller,
+                                call_expression=callee,
+                            )
+                        )
+                        break  # one match per call site is enough
+
+    # ------------------------------------------------------------------
+    # Phase 3: SDK usage-pattern extraction
+    # ------------------------------------------------------------------
+
+    def _extract_sdk_services(self, results: dict[str, DetectedIntegration]) -> None:
+        """Extract service-specific info from SDK init calls."""
+        patterns_by_lib: dict[str, list[SdkUsagePattern]] = {}
+        for sp in self._sdk_patterns:
+            patterns_by_lib.setdefault(sp.library, []).append(sp)
+
+        relevant_libs = {sp.library for sp in self._sdk_patterns} & {
+            e.import_pattern for e in self._catalog if e.integration_name in results
+        }
+        if not relevant_libs:
+            return
+
+        for pf in self._parsed_files:
+            for cs in pf.call_sites:
+                callee = cs.callee_name
+                for lib in relevant_libs:
+                    for sp in patterns_by_lib.get(lib, []):
+                        if sp.call_pattern not in callee:
+                            continue
+                        service_name = self._extract_service_arg(cs, sp)
+                        if not service_name:
+                            continue
+                        parent_name = next(
+                            (e.integration_name for e in self._catalog if e.import_pattern == lib),
+                            lib,
+                        )
+                        if parent_name not in results:
+                            continue
+                        det = results[parent_name]
+                        display = (
+                            f"{sp.result_type_prefix} {service_name}"
+                            if sp.result_type_prefix
+                            else service_name
+                        )
+                        if display not in det.sub_services:
+                            det.sub_services.append(display)
+                        det.metadata.setdefault("services", [])
+                        if service_name not in det.metadata["services"]:
+                            det.metadata["services"].append(service_name)
+
+    @staticmethod
+    def _extract_service_arg(
+        call_site: ParsedCallSite,  # noqa: F821
+        pattern: SdkUsagePattern,
+    ) -> str | None:
+        """Extract the service name from a call site's arguments."""
+
+        for arg in call_site.arguments:
+            # Match by keyword
+            if pattern.service_arg_keyword and arg.name == pattern.service_arg_keyword:
+                if arg.is_literal and isinstance(arg.literal_value, str):
+                    return arg.literal_value
+            # Match by position
+            if (
+                pattern.service_arg_position is not None
+                and arg.position == pattern.service_arg_position
+            ):
+                if arg.is_literal and isinstance(arg.literal_value, str):
+                    return arg.literal_value
+        return None
+
+    # ------------------------------------------------------------------
+    # Phase 4: HTTP target extraction
+    # ------------------------------------------------------------------
+
+    def _extract_http_targets(self, results: dict[str, DetectedIntegration]) -> None:
+        """
+        For every detected ``http_client`` integration, scan call sites to
+        extract the target URL/hostname from the first positional argument
+        (or ``url=`` keyword).
+
+        Populates ``DetectedIntegration.targets`` with :class:`ExtractedTarget`
+        instances.  Non-literal arguments (variables, f-strings) are recorded
+        with ``is_literal=False`` and the raw expression stored in
+        ``base_url`` for downstream analysis.
+        """
+        http_integrations = {
+            name: det for name, det in results.items() if det.integration_type == "http_client"
+        }
+        if not http_integrations:
+            return
+
+        http_lib_names = set(http_integrations.keys())
+        files_with_http = self._files_importing_http_client(http_lib_names)
+
+        for pf in self._parsed_files:
+            file_str = str(pf.path)
+            file_has_http = file_str in files_with_http or pf.path in files_with_http
+
+            for cs in pf.call_sites:
+                callee = cs.callee_name
+
+                target = self._try_named_pattern(cs, callee, file_str)
+
+                if target is None and file_has_http:
+                    target = self._try_instance_suffix(cs, callee, file_str)
+
+                if target is None:
+                    continue
+
+                parent = self._resolve_parent_integration(callee, http_integrations)
+                if parent is None and file_has_http:
+                    parent = next(iter(http_integrations.values()), None)
+                if parent is None:
+                    continue
+
+                if not any(
+                    t.base_url == target.base_url
+                    and t.path_pattern == target.path_pattern
+                    and t.http_method == target.http_method
+                    for t in parent.targets
+                ):
+                    parent.targets.append(target)
+
+    def _files_importing_http_client(self, http_lib_names: set[str]) -> set[str]:
+        """Return file paths that import any known HTTP client library."""
+        lib_patterns = {
+            e.import_pattern
+            for e in self._catalog
+            if e.integration_type == "http_client" and e.integration_name in http_lib_names
+        }
+        result: set[str] = set()
+        for pf in self._parsed_files:
+            for imp in pf.imports:
+                mod = imp.module or ""
+                top = mod.split(".")[0]
+                if any(pat == top or pat in mod or mod.startswith(pat) for pat in lib_patterns):
+                    result.add(str(pf.path))
+                    break
+        return result
+
+    def _try_named_pattern(
+        self,
+        cs: ParsedCallSite,
+        callee: str,
+        file_str: str,  # noqa: F821
+    ) -> ExtractedTarget | None:
+        """Try to match a fully-qualified pattern like ``requests.get``."""
+        for pat in _HTTP_TARGET_PATTERNS:
+            if pat.callee_contains not in callee:
+                continue
+            url_val = self._extract_url_arg(cs, pat.url_arg_position, pat.url_keyword)
+            if url_val is None:
+                continue
+            method = pat.inferred_method
+            if not method and pat.url_arg_position == 1:
+                method = self._infer_method_from_arg(cs, 0)
+            return self._build_target(url_val, method, cs, file_str)
+        return None
+
+    def _try_instance_suffix(
+        self,
+        cs: ParsedCallSite,
+        callee: str,
+        file_str: str,  # noqa: F821
+    ) -> ExtractedTarget | None:
+        """Match instance-method patterns like ``session.get(url)``.
+
+        Applies four layers of false-positive prevention:
+        1. Receiver blocklist — skip ``app.get``, ``router.post``, etc.
+        2. Receiver allowlist — the receiver must look like an HTTP client
+           object (e.g. ``session``, ``client``, ``self.http_client``).
+        3. URL plausibility — the argument must look like a URL or API path.
+        4. File-level HTTP import gating (enforced by the caller).
+        """
+        for suffix, method in _HTTP_INSTANCE_SUFFIXES.items():
+            if not callee.endswith(suffix):
+                continue
+            receiver = callee[: -len(suffix)]
+            if not receiver or receiver.endswith("."):
+                continue
+
+            if self._is_blocked_receiver(receiver):
+                continue
+
+            if not self._is_http_client_receiver(receiver):
+                continue
+
+            url_pos = 1 if suffix == ".request" else 0
+            url_val = self._extract_url_arg(cs, url_pos, "url")
+            if url_val is None:
+                continue
+
+            if url_val["is_literal"] and not self._is_plausible_url(url_val["value"]):
+                continue
+
+            actual_method = method
+            if not actual_method and suffix == ".request":
+                actual_method = self._infer_method_from_arg(cs, 0)
+            return self._build_target(url_val, actual_method, cs, file_str)
+        return None
+
+    @staticmethod
+    def _is_blocked_receiver(receiver: str) -> bool:
+        """Return True if the receiver looks like a framework app/router."""
+        receiver_lower = receiver.lower()
+        if receiver_lower in _RECEIVER_BLOCKLIST:
+            return True
+        for pattern in _RECEIVER_BLOCKLIST_PATTERNS:
+            if receiver_lower.startswith(pattern) or receiver_lower.endswith(pattern):
+                return True
+        return False
+
+    @staticmethod
+    def _is_http_client_receiver(receiver: str) -> bool:
+        """Return True if the receiver looks like an HTTP client object.
+
+        Uses positive matching: the receiver's base name (last dotted
+        segment, stripped of leading underscores) must be a known HTTP
+        client name or end with a known suffix.
+
+        Examples that pass:
+            ``session``, ``self.session``, ``self._http_client``,
+            ``cls.client``, ``api_client``
+
+        Examples that fail:
+            ``plugins``, ``db``, ``cache``, ``instance.instance``,
+            ``headers``, ``dict``
+        """
+        base = receiver.rsplit(".", 1)[-1].lstrip("_").lower()
+
+        if base in _HTTP_CLIENT_RECEIVER_NAMES:
+            return True
+
+        return any(base.endswith(suffix) for suffix in _HTTP_CLIENT_RECEIVER_SUFFIXES)
+
+    @staticmethod
+    def _is_plausible_url(value: str) -> bool:
+        """Return True if a literal string looks like a URL or API path.
+
+        Rejects short dict-key-like strings (``"in"``, ``"value"``,
+        ``"required"``) that get captured by ``dict.get()`` matching.
+        """
+        if "://" in value:
+            return True
+        if value.startswith("//"):
+            return True
+        if value.startswith("/") and len(value) > 1:
+            return True
+        return bool("." in value and len(value) > 4)
+
+    @staticmethod
+    def _extract_url_arg(
+        cs: ParsedCallSite,
+        position: int,
+        keyword: str,  # noqa: F821
+    ) -> dict[str, Any] | None:
+        """
+        Pull the URL value from a call site's arguments.
+
+        Returns a dict ``{"value": <str>, "is_literal": <bool>}`` or ``None``.
+        """
+        for arg in cs.arguments:
+            if arg.name == keyword:
+                if arg.is_literal and isinstance(arg.literal_value, str):
+                    return {"value": arg.literal_value, "is_literal": True}
+                expr = arg.expression_text or arg.variable_name or ""
+                if expr:
+                    return {"value": expr, "is_literal": False}
+
+        for arg in cs.arguments:
+            if arg.position == position and arg.name is None:
+                if arg.is_literal and isinstance(arg.literal_value, str):
+                    return {"value": arg.literal_value, "is_literal": True}
+                expr = arg.expression_text or arg.variable_name or ""
+                if expr:
+                    return {"value": expr, "is_literal": False}
+
+        return None
+
+    @staticmethod
+    def _infer_method_from_arg(cs: ParsedCallSite, position: int) -> str:  # noqa: F821
+        """Read position-0 argument to determine the HTTP method string."""
+        for arg in cs.arguments:
+            if arg.position == position and arg.is_literal and isinstance(arg.literal_value, str):
+                return arg.literal_value.upper()
+        return ""
+
+    @staticmethod
+    def _build_target(
+        url_info: dict[str, Any],
+        http_method: str,
+        cs: ParsedCallSite,  # noqa: F821
+        file_str: str,
+    ) -> ExtractedTarget:
+        raw_url: str = url_info["value"]
+        is_literal: bool = url_info["is_literal"]
+        caller = cs.caller_function.full if cs.caller_function else None
+
+        base_url = raw_url
+        path_pattern = ""
+
+        if is_literal and ("://" in raw_url or raw_url.startswith("//")):
+            from urllib.parse import urlparse
+
+            parsed = urlparse(raw_url)
+            scheme = parsed.scheme or "https"
+            host = parsed.hostname or ""
+            port = parsed.port
+            if host:
+                base_url = f"{scheme}://{host}"
+                if port and port not in (80, 443):
+                    base_url += f":{port}"
+                path_pattern = parsed.path or ""
+            # else: keep raw_url as base_url (e.g. malformed but still useful)
+
+        return ExtractedTarget(
+            base_url=base_url,
+            path_pattern=path_pattern,
+            http_method=http_method.upper() if http_method else "",
+            is_literal=is_literal,
+            file=file_str,
+            line=cs.location.line,
+            function=caller,
+        )
+
+    @staticmethod
+    def _resolve_parent_integration(
+        callee: str,
+        http_integrations: dict[str, DetectedIntegration],
+    ) -> DetectedIntegration | None:
+        """Map a callee back to its parent http_client integration."""
+        callee_lower = callee.lower()
+        for name, det in http_integrations.items():
+            if name.lower() in callee_lower:
+                return det
+        return None
+
+    # ------------------------------------------------------------------
+    # Conversion to manifest models
+    # ------------------------------------------------------------------
+
+    def to_manifest_models(
+        self, detections: list[DetectedIntegration] | None = None
+    ) -> list[IntegrationModel]:
+        """Convert detections to manifest IntegrationModel list."""
+        from ..core.manifest import IntegrationModel, IntegrationTargetModel, LocationModel
+
+        if detections is None:
+            detections = self.detect()
+
+        models: list[IntegrationModel] = []
+        for det in detections:
+            locations = [
+                LocationModel(file=loc.file, line=loc.line)
+                for loc in det.locations[:50]  # cap to avoid huge manifests
+            ]
+
+            metadata: dict[str, Any] = {}
+            if det.sub_services:
+                metadata["sub_services"] = det.sub_services
+            if det.metadata:
+                metadata.update(det.metadata)
+
+            name = det.name
+            if det.sub_services:
+                name = f"{det.name} ({', '.join(det.sub_services[:5])})"
+
+            targets = [
+                IntegrationTargetModel(
+                    base_url=t.base_url,
+                    path_pattern=t.path_pattern,
+                    http_method=t.http_method,
+                    is_literal=t.is_literal,
+                    called_from=LocationModel(
+                        file=t.file,
+                        line=t.line,
+                        function=t.function,
+                    )
+                    if t.file
+                    else None,
+                )
+                for t in det.targets[:100]  # cap to avoid huge manifests
+            ]
+
+            models.append(
+                IntegrationModel(
+                    id=stable_id("int", det.integration_type, det.name),
+                    type=det.integration_type,
+                    name=name,
+                    locations=locations,
+                    detection_method=", ".join(det.detection_methods),
+                    confidence="HIGH" if len(det.detection_methods) > 1 else "MEDIUM",
+                    targets=targets,
+                    metadata=metadata,
+                )
+            )
+
+        return models