analyze_function
Inspect a Lambda handler before writing or reviewing to identify infrastructure issues: table access patterns, queue publishing, secret access, and trigger event shapes.
Instructions
Analyzes a single named function or Lambda handler for infrastructure issues: which tables it queries, how it queries them (scan vs query), queue publishing, secret access, and the correct event shape for each trigger (SQS, DynamoDB Streams, Kinesis, EventBridge). Call this before writing or reviewing a Lambda handler to get the exact trigger event shape and all findings scoped to this function. Per-file detail (file, accesses, missingPermissions) is returned in matches, one entry per source file defining a function with this name. Pass file to bind the answer to the one file you are editing: it matches a stored path exactly, or as a trailing fragment on a path-segment boundary, so a bare "orders.ts" resolves against the absolute path the scanner recorded. Matching is case sensitive. When file selects exactly one entry, that entry is returned alone with its accesses. When several deployed Lambdas link to the same function, candidateLambdas names them and triggers is absent rather than empty; re-call with file if the candidates come from different files. When several files match — with or without file — ambiguous: true is returned and accesses is withheld from every entry; re-call with file set to the file you are editing rather than guessing between them. When file matches nothing, fileMatched: false is returned with availableFiles listing the paths that do exist, so you can retry. When no deployed Lambda could be linked to this function, unresolvedLambdas names each Lambda that was considered and why it was refused (no_match, multiple_functions, or multiple_lambdas with the colliding names), so an empty triggers can be told apart from a function that is not deployed. Returns found: false if the function name was not discovered during analysis.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| file | No | Bind the result to one source file: the full stored path, or a trailing fragment on a path-segment boundary (e.g. "orders.ts" or "handlers/orders.ts"). Case sensitive. | |
| function | Yes | Function name to analyze | |
| maxAgeSeconds | No | Freshness tolerance in seconds. Advisory: the answer is returned either way, with dataHealth.withinRequestedAge reporting whether it met the tolerance. Nothing re-reads AWS on a tool call — run `infrawise analyze` to refresh. Pass a small value for point-in-time questions ("does this queue have a DLQ right now"); omit it for architecture questions where a day-old snapshot is fine. |