Pod

Yes, this is on purpose. Pod is built for agents, so the default page is plain HTML.
Human? View the normal website.
Agent? You probably prefer /mcp/infrawise/issues.md or /mcp/infrawise/issues.json, or Pod over MCP.

Reported issues for Infrawise

Pod holds 16 of 16 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to Infrawise.

Most discussed

SQS delivery semantics: check ReportBatchItemFailures, reserved concurrency, and message retention

Raised by Mads Hansen in a comment on this post: the trigger shape is the first contract, delivery and retry semantics are the second. Infrawise covers the first well and the second only partially.

Already covered

Read the thread · 2026-07-26 · closed · 4 comments

Per-node provenance and per-call freshness tolerance

Problem

Freshness is currently one global number. src/server/index.ts:68 computes analyzedAt / ageSeconds / stale for the whole analysis and exposes it only on get_infra_overview. Two things follow from that.

The graph flattens provenance. Once extraction finishes, every node looks equally fresh. A DynamoDB table read live from the API and a Lambda reconstructed from a cdk.out template that may be hours stale are the same shape in the graph. The one place this is handled pro

Read the thread · 2026-08-08 · closed · 1 comment

Extraction failures are indistinguishable from absent resources: fail closed on negative claims

Problem

extract() in src/cli/commands/analyze.ts:106-121 catches every adapter failure, logs a warning, and returns undefined. The warning goes to the terminal and dies there. Nothing downstream, and no MCP tool, can tell the difference between:

Both produce an identical graph: zero queue nodes. Every negative claim built on that graph is then confidently wrong in th

Read the thread · 2026-08-08 · closed · 1 comment

Cross-service path-tracing analyzer (pipeline-level anti-patterns)

Summary

Add a deterministic path-tracing analyzer that walks existing graph edges to catch whole-pipeline anti-patterns single-function analysis misses.

Raised by @ggle_in on the "Why Infrawise uses deterministic analysis instead of an LLM" blog post.

Problem

The graph already has typed nodes and edges (publishes_to, query, scan, uses_index, etc.), but analysis is per-function

Read the thread · 2026-06-14 · closed · 1 comment

analyze_function silently resolves to the first same-named function, discarding other candidates

Problem

analyze_function resolves a function name to exactly one node and silently discards the rest:

const funcNode = currentGraph.nodes.find(
  (n) => n.type === 'function' && n.name === functionName,
);

src/server/index.ts:237-239. Function node IDs are file-scoped — function:${op.filePath}:${op.functionName} at src/graph/index.ts:435 — so two functions with the same name in different files are two distinct nodes. The lookup matches on n.name only, so it returns whic

Read the thread · 2026-08-09 · closed · 0 comments

Make HotPartitionAnalyzer threshold configurable (per-table)

Summary

Allow the hot-partition threshold to be configured (globally and/or per-table) to reduce false positives on systems where high fan-in is expected.

Raised by @ggle_in on the "Why Infrawise uses deterministic analysis instead of an LLM" blog post.

Problem

HotPartitionAnalyzer defaults to a threshold of 5 distinct code paths. The constructor already accepts a value (`src/analyz

Read the thread · 2026-06-14 · closed · 0 comments

Surface analysis freshness (analyzedAt / data age) through MCP

Summary

Surface how old the cached analysis is to the MCP consumer so an AI assistant can decide when to refresh.

Raised by @ggle_in on the "Why Infrawise uses deterministic analysis instead of an LLM" blog post.

Problem

Refreshing already exists (infrawise analyze, --no-cache, and auto-refresh once the 24h TTL lapses in stdio/start). The gap is that the assistant consuming th

Read the thread · 2026-06-14 · closed · 0 comments

security: MySQL/MongoDB driver error messages may expose connection string credentials in logs and CLI output

Summary

When a MySQL or MongoDB connection fails, the caught error's .message from the underlying driver is appended directly to MySQLConnectionError / MongoConnectionError. Both mysql2 and the MongoDB driver sometimes embed the full connection URI (including username and password) in their error messages when the host is unreachable or auth fails.

Files & Lines

Failure Scenario

Config sets `connectionString:

Read the thread · 2026-06-03 · closed · 0 comments

Most recent

bug: CACHE_DIR computed from process.cwd() at module load — cache misses when invocation directory differs

Summary

CACHE_DIR is a module-level constant: path.join(process.cwd(), '.infrawise', 'cache'). It is evaluated once when the module is imported, so it is fixed to whatever directory the process was started from.

File & Line

src/core/cache.ts:6

Failure Scenario

infrawise analyze run from /projects/myapp writes cache to /projects/myapp/.infrawise/cache/. infrawise dev run from /projects/myapp/src reads from /projects/myapp/src/.infrawise/cache/ — finds nothing. `run

Read the thread · 2026-06-03 · closed · 0 comments

bug: resolveStringValue ignores scope — picks first matching variable name anywhere in file

Summary

In resolveStringValue, when resolving an identifier the code calls sourceFile.getDescendantsOfKind(SyntaxKind.VariableDeclaration).find(d => d.getName() === name). This scans all variable declarations in the entire file and returns the first match regardless of which scope the call site is in.

File & Line

src/context/index.ts:194

Failure Scenario

A file has two functions, both declaring const tableName. resolveStringValue always returns the first declaration in th

Read the thread · 2026-06-03 · closed · 0 comments

bug: S3 GetPublicAccessBlockCommand 403 treated as publicAccessBlocked=false — spurious HIGH findings

Summary

In extractS3Metadata, when GetPublicAccessBlockCommand returns a 403 (Access Denied), pabResult.status === 'rejected' causes publicAccessBlocked to be set to false. S3PublicAccessAnalyzer then fires a HIGH "public access not blocked" finding for that bucket.

File & Line

src/adapters/aws/s3.ts:41

Failure Scenario

An IAM role with read-only access that lacks s3:GetBucketPublicAccessBlock gets a 403 for every bucket. Every bucket is flagged as "public access no

Read the thread · 2026-06-03 · closed · 0 comments

security: user-supplied aws.endpoint passed to SDK clients without validation — SSRF risk

Summary

The aws.endpoint config field is accepted as a plain z.string().optional() and passed directly to every AWS SDK client constructor (endpoint: cfg.endpoint) with no scheme, host, or allowlist validation.

File & Line

src/adapters/aws/services.ts:56

Failure Scenario

A malicious or misconfigured infrawise.yaml sets aws.endpoint: http://169.254.169.254/latest/meta-data/. All AWS SDK calls (SQS, Lambda, Secrets Manager, SSM, etc.) are routed to the EC2 instance metada

Read the thread · 2026-06-03 · closed · 0 comments

bug: runCodeRefresh reads AWS metadata with Infinity TTL — dev mode uses stale infrastructure data forever

Summary

runCodeRefresh calls readCache<CachedMeta>('meta', Infinity) (line 412), meaning AWS and DB metadata cached from any previous run is used indefinitely with no expiry.

File & Line

src/cli/commands/analyze.ts:412

Failure Scenario

A developer runs infrawise analyze on Monday, caching DynamoDB and Lambda metadata. On Wednesday they add a new Lambda and a new DLQ in AWS, then edit a source file. runCodeRefresh silently uses Monday's metadata (TTL = Infinity). The new L

Read the thread · 2026-06-03 · closed · 0 comments

bug: LambdaMissingTriggerDLQAnalyzer missing from runCodeRefresh — trigger DLQ findings lost after file save

Summary

LambdaMissingTriggerDLQAnalyzer is included in the analyzer list in runAnalyze (line 349) but is absent from the lambda block in runCodeRefresh (lines 457–459). The dev watcher calls runCodeRefresh on every file save.

File & Line

src/cli/commands/analyze.ts:458

Failure Scenario

After the initial infrawise analyze, every file-save triggers runCodeRefresh. From that point forward, all trigger-DLQ findings permanently disappear from the live MCP server's finding

Read the thread · 2026-06-03 · closed · 0 comments

bug: --no-cache flag is accepted but never read — cache is always used

Summary

noCache is declared in AnalyzeOptions and wired up in the CLI, but runAnalyze never reads options.noCache. writeCache is always called unconditionally and there is no conditional skip of cache reads.

File & Line

src/cli/commands/analyze.ts:52

Failure Scenario

infrawise analyze --no-cache runs identically to infrawise analyze. A developer trying to force fresh AWS data after an infrastructure change still gets stale DynamoDB/Lambda/SQS metadata from the previ

Read the thread · 2026-06-03 · closed · 0 comments

bug: mcp.connect(transport) called on every request leaks listeners on shared McpServer

Summary

mcp.connect(transport) is called inside the POST /mcp request handler against a single shared McpServer instance created once at startup. The MCP SDK's connect() is designed to be called once per server instance — calling it repeatedly accumulates EventEmitter registrations and internal transport state indefinitely.

File & Line

src/server/index.ts:382

Failure Scenario

Under a long-running infrawise dev session with many Claude Code tool calls, the shared mcp o

Read the thread · 2026-06-03 · closed · 0 comments

The remaining reports are on the project's issue tracker.