# Reported issues for Infrawise

Pod holds 16 of 16 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to [Infrawise](/mcp/infrawise).

## Most discussed

### SQS delivery semantics: check ReportBatchItemFailures, reserved concurrency, and message retention

Raised by [Mads Hansen](https://dev.to/mads_hansen_27b33ebfee4c9) in a comment on [this post](https://dev.to/siddharth_pandey_27/how-i-solved-claude-code-silently-missing-the-sqs-trigger-on-my-lambda-5a): the trigger shape is the first contract, delivery and retry semantics are the second. Infrawise covers the first well and the second only partially.

## Already covered

- Visibility timeout vs function timeout — `VisibilityTimeoutMismatchAnalyzer`, high below 1x and medium below the recommende

[Read the thread](https://github.com/Sidd27/infrawise/issues/87) · 2026-07-26 · closed · 4 comments

### Per-node provenance and per-call freshness tolerance

## Problem

Freshness is currently one global number. `src/server/index.ts:68` computes `analyzedAt` / `ageSeconds` / `stale` for the whole analysis and exposes it only on `get_infra_overview`. Two things follow from that.

**The graph flattens provenance.** Once extraction finishes, every node looks equally fresh. A DynamoDB table read live from the API and a Lambda reconstructed from a `cdk.out` template that may be hours stale are the same shape in the graph. The one place this is handled pro

[Read the thread](https://github.com/Sidd27/infrawise/issues/102) · 2026-08-08 · closed · 1 comment

### Extraction failures are indistinguishable from absent resources: fail closed on negative claims

## Problem

`extract()` in `src/cli/commands/analyze.ts:106-121` catches every adapter failure, logs a warning, and returns `undefined`. The warning goes to the terminal and dies there. Nothing downstream, and no MCP tool, can tell the difference between:

- "this account has no SQS queues"
- "the SQS adapter threw AccessDenied because the principal lacks `sqs:ListQueues`"

Both produce an identical graph: zero queue nodes. Every negative claim built on that graph is then confidently wrong in th

[Read the thread](https://github.com/Sidd27/infrawise/issues/101) · 2026-08-08 · closed · 1 comment

### Cross-service path-tracing analyzer (pipeline-level anti-patterns)

## Summary

Add a deterministic path-tracing analyzer that walks existing graph edges to catch whole-pipeline anti-patterns single-function analysis misses.

Raised by @ggle_in on the ["Why Infrawise uses deterministic analysis instead of an LLM"](https://dev.to/siddharth_pandey_27/why-infrawise-uses-deterministic-analysis-instead-of-an-llm-15fk) blog post.

## Problem

The graph already has typed nodes and edges (`publishes_to`, `query`, `scan`, `uses_index`, etc.), but analysis is per-function

[Read the thread](https://github.com/Sidd27/infrawise/issues/56) · 2026-06-14 · closed · 1 comment

### analyze_function silently resolves to the first same-named function, discarding other candidates

## Problem

`analyze_function` resolves a function name to exactly one node and silently discards the rest:

```ts
const funcNode = currentGraph.nodes.find(
  (n) => n.type === 'function' && n.name === functionName,
);
```

`src/server/index.ts:237-239`. Function node IDs are file-scoped — `function:${op.filePath}:${op.functionName}` at `src/graph/index.ts:435` — so two functions with the same name in different files are two distinct nodes. The lookup matches on `n.name` only, so it returns whic

[Read the thread](https://github.com/Sidd27/infrawise/issues/103) · 2026-08-09 · closed · 0 comments

### Make HotPartitionAnalyzer threshold configurable (per-table)

## Summary

Allow the hot-partition threshold to be configured (globally and/or per-table) to reduce false positives on systems where high fan-in is expected.

Raised by @ggle_in on the ["Why Infrawise uses deterministic analysis instead of an LLM"](https://dev.to/siddharth_pandey_27/why-infrawise-uses-deterministic-analysis-instead-of-an-llm-15fk) blog post.

## Problem

`HotPartitionAnalyzer` defaults to a threshold of 5 distinct code paths. The constructor already accepts a value (`src/analyz

[Read the thread](https://github.com/Sidd27/infrawise/issues/57) · 2026-06-14 · closed · 0 comments

### Surface analysis freshness (analyzedAt / data age) through MCP

## Summary

Surface how old the cached analysis is to the MCP consumer so an AI assistant can decide when to refresh.

Raised by @ggle_in on the ["Why Infrawise uses deterministic analysis instead of an LLM"](https://dev.to/siddharth_pandey_27/why-infrawise-uses-deterministic-analysis-instead-of-an-llm-15fk) blog post.

## Problem

Refreshing already exists (`infrawise analyze`, `--no-cache`, and auto-refresh once the 24h TTL lapses in `stdio`/`start`). The gap is that the assistant consuming th

[Read the thread](https://github.com/Sidd27/infrawise/issues/55) · 2026-06-14 · closed · 0 comments

### security: MySQL/MongoDB driver error messages may expose connection string credentials in logs and CLI output

## Summary

When a MySQL or MongoDB connection fails, the caught error's `.message` from the underlying driver is appended directly to `MySQLConnectionError` / `MongoConnectionError`. Both mysql2 and the MongoDB driver sometimes embed the full connection URI (including username and password) in their error messages when the host is unreachable or auth fails.

## Files & Lines

- `src/adapters/db/mysql.ts:115`
- `src/adapters/db/mongodb.ts:100`

## Failure Scenario

Config sets `connectionString:

[Read the thread](https://github.com/Sidd27/infrawise/issues/46) · 2026-06-03 · closed · 0 comments

## Most recent

### bug: CACHE_DIR computed from process.cwd() at module load — cache misses when invocation directory differs

## Summary

`CACHE_DIR` is a module-level constant: `path.join(process.cwd(), '.infrawise', 'cache')`. It is evaluated once when the module is imported, so it is fixed to whatever directory the process was started from.

## File & Line

`src/core/cache.ts:6`

## Failure Scenario

`infrawise analyze` run from `/projects/myapp` writes cache to `/projects/myapp/.infrawise/cache/`. `infrawise dev` run from `/projects/myapp/src` reads from `/projects/myapp/src/.infrawise/cache/` — finds nothing. `run

[Read the thread](https://github.com/Sidd27/infrawise/issues/45) · 2026-06-03 · closed · 0 comments

### bug: resolveStringValue ignores scope — picks first matching variable name anywhere in file

## Summary

In `resolveStringValue`, when resolving an identifier the code calls `sourceFile.getDescendantsOfKind(SyntaxKind.VariableDeclaration).find(d => d.getName() === name)`. This scans all variable declarations in the entire file and returns the first match regardless of which scope the call site is in.

## File & Line

`src/context/index.ts:194`

## Failure Scenario

A file has two functions, both declaring `const tableName`. `resolveStringValue` always returns the first declaration in th

[Read the thread](https://github.com/Sidd27/infrawise/issues/44) · 2026-06-03 · closed · 0 comments

### bug: S3 GetPublicAccessBlockCommand 403 treated as publicAccessBlocked=false — spurious HIGH findings

## Summary

In `extractS3Metadata`, when `GetPublicAccessBlockCommand` returns a 403 (Access Denied), `pabResult.status === 'rejected'` causes `publicAccessBlocked` to be set to `false`. `S3PublicAccessAnalyzer` then fires a HIGH "public access not blocked" finding for that bucket.

## File & Line

`src/adapters/aws/s3.ts:41`

## Failure Scenario

An IAM role with read-only access that lacks `s3:GetBucketPublicAccessBlock` gets a 403 for every bucket. Every bucket is flagged as "public access no

[Read the thread](https://github.com/Sidd27/infrawise/issues/43) · 2026-06-03 · closed · 0 comments

### security: user-supplied aws.endpoint passed to SDK clients without validation — SSRF risk

## Summary

The `aws.endpoint` config field is accepted as a plain `z.string().optional()` and passed directly to every AWS SDK client constructor (`endpoint: cfg.endpoint`) with no scheme, host, or allowlist validation.

## File & Line

`src/adapters/aws/services.ts:56`

## Failure Scenario

A malicious or misconfigured `infrawise.yaml` sets `aws.endpoint: http://169.254.169.254/latest/meta-data/`. All AWS SDK calls (SQS, Lambda, Secrets Manager, SSM, etc.) are routed to the EC2 instance metada

[Read the thread](https://github.com/Sidd27/infrawise/issues/42) · 2026-06-03 · closed · 0 comments

### bug: runCodeRefresh reads AWS metadata with Infinity TTL — dev mode uses stale infrastructure data forever

## Summary

`runCodeRefresh` calls `readCache<CachedMeta>('meta', Infinity)` (line 412), meaning AWS and DB metadata cached from any previous run is used indefinitely with no expiry.

## File & Line

`src/cli/commands/analyze.ts:412`

## Failure Scenario

A developer runs `infrawise analyze` on Monday, caching DynamoDB and Lambda metadata. On Wednesday they add a new Lambda and a new DLQ in AWS, then edit a source file. `runCodeRefresh` silently uses Monday's metadata (TTL = Infinity). The new L

[Read the thread](https://github.com/Sidd27/infrawise/issues/41) · 2026-06-03 · closed · 0 comments

### bug: LambdaMissingTriggerDLQAnalyzer missing from runCodeRefresh — trigger DLQ findings lost after file save

## Summary

`LambdaMissingTriggerDLQAnalyzer` is included in the analyzer list in `runAnalyze` (line 349) but is absent from the lambda block in `runCodeRefresh` (lines 457–459). The dev watcher calls `runCodeRefresh` on every file save.

## File & Line

`src/cli/commands/analyze.ts:458`

## Failure Scenario

After the initial `infrawise analyze`, every file-save triggers `runCodeRefresh`. From that point forward, all trigger-DLQ findings permanently disappear from the live MCP server's finding 

[Read the thread](https://github.com/Sidd27/infrawise/issues/39) · 2026-06-03 · closed · 0 comments

### bug: --no-cache flag is accepted but never read — cache is always used

## Summary

`noCache` is declared in `AnalyzeOptions` and wired up in the CLI, but `runAnalyze` never reads `options.noCache`. `writeCache` is always called unconditionally and there is no conditional skip of cache reads.

## File & Line

`src/cli/commands/analyze.ts:52`

## Failure Scenario

`infrawise analyze --no-cache` runs identically to `infrawise analyze`. A developer trying to force fresh AWS data after an infrastructure change still gets stale DynamoDB/Lambda/SQS metadata from the previ

[Read the thread](https://github.com/Sidd27/infrawise/issues/38) · 2026-06-03 · closed · 0 comments

### bug: mcp.connect(transport) called on every request leaks listeners on shared McpServer

## Summary

`mcp.connect(transport)` is called inside the `POST /mcp` request handler against a single shared `McpServer` instance created once at startup. The MCP SDK's `connect()` is designed to be called once per server instance — calling it repeatedly accumulates EventEmitter registrations and internal transport state indefinitely.

## File & Line

`src/server/index.ts:382`

## Failure Scenario

Under a long-running `infrawise dev` session with many Claude Code tool calls, the shared `mcp` o

[Read the thread](https://github.com/Sidd27/infrawise/issues/37) · 2026-06-03 · closed · 0 comments

The remaining reports are on [the project's issue tracker](https://github.com/Sidd27/infrawise/issues).