🔬 sudiviz

X-ray vision for your cloud infrastructure

sudiviz visualizes your live AWS infrastructure as an interactive graph — across multiple regions. Auto-detects misconfigurations, unhealthy targets, and orphan resources — then fixes them with one command.

🚀 Zero AI tokens | 💸 Zero cost | 🐍 Pure Python | 🌍 Multi-region

📦 Quick Start

pip install 'sudiviz[all]'

# Diagnose your infrastructure
sudiviz diagnose

# Explain findings in plain English (via Bedrock)
sudiviz explain

# Interactive web visualization
sudiviz graph --output web --open

# Auto-fix issues
sudiviz fix --apply

Auth: Uses standard boto3 credentials (~/.aws/credentials, env vars, SSO, or instance profile)

✨ Features

🎨 Visualization Modes

Terminal

sudiviz diagnose --region us-east-1

TUI (Interactive Terminal)

sudiviz tui

Web (Cytoscape.js)

sudiviz graph --output web --port 8000 --open

# Specify a default region (switch regions live from the UI dropdown)
sudiviz graph --output web --region us-east-1 --port 8000 --open

PNG Export

sudiviz graph --output png --file topology.png

🔧 Auto-Fix

sudiviz fix                    # Preview fixes (dry-run)
sudiviz fix --apply            # Apply all fixes
sudiviz fix 1 --apply          # Apply specific fix
sudiviz fix --apply --force    # Include destructive operations

Supported fixes:

• Security group missing ingress rules
• S3 public access / encryption
• RDS public accessibility
• Orphan target groups (with --force)
• Unused security groups (with --force)

🧠 Explain (Amazon Bedrock)

Sends diagnostic findings to Amazon Bedrock (Nova Lite) for holistic, AI-powered analysis — root causes, connected dots across findings, and a prioritised action plan.

# General analysis of all findings
sudiviz explain

# Ask a specific question
sudiviz explain "why is my target group unhealthy?"
sudiviz explain "why do I have no resources in us-east-2?"

# With AWS options
sudiviz explain --region us-east-1 --profile prod

Requirements:

• AWS credentials with bedrock:InvokeModelWithResponseStream permission (or AmazonBedrockFullAccess managed policy)
• Amazon Nova Lite model access enabled in your region

Cost: ~$0.0001–0.0004 per invocation (Amazon Nova Lite pricing: $0.06/1M input tokens, $0.24/1M output tokens)

🤖 MCP Server (Agentic AI)

sudiviz ships an MCP server so AI agents (Claude Desktop, Claude Code, Cursor, etc.) can discover, diagnose, and remediate your infrastructure via natural language.

pip install 'sudiviz[mcp]'

# Start the MCP server (stdio transport)
sudiviz-mcp

Add to Claude Desktop (~/Library/Application Support/Claude/claude_desktop_config.json):

{
  "mcpServers": {
    "sudiviz": {
      "command": "sudiviz-mcp",
      "env": { "AWS_PROFILE": "production" }
    }
  }
}

Add to Claude Code (.mcp.json in your project root):

{
  "mcpServers": {
    "sudiviz": {
      "command": "sudiviz-mcp"
    }
  }
}

Available MCP tools:

MCP Resources (read live data without calling a tool):

MCP Prompts (guided multi-step workflows):

Example conversations with your AI agent:

• "Show me all orphan resources in us-east-1"
• "What's our estimated monthly spend?"
• "Fix the unhealthy targets on my ALB"
• "Check for Terraform drift against my state file"
• "Run a security audit on eu-west-1"
• "Triage the incident — what's unhealthy and why?"

🔒 Security

sudiviz is built with security in mind. Every release is scanned for vulnerabilities.

Run security scan locally:

pip install bandit[toml]
bandit -c pyproject.toml -r sudiviz/

🔄 Terraform Drift

terraform show -json > tfstate.json
sudiviz drift --tfstate tfstate.json

📊 CI Integration

# Fail CI on critical issues
sudiviz diagnose --json | jq '.diagnosis.fixes[] | select(.severity=="critical")'

# Drift detection gate
sudiviz drift --tfstate tfstate.json --json

📸 More Screenshots

🆚 Comparison

🔐 IAM Permissions

Read-only (sudiviz diagnose):

• ReadOnlyAccess AWS managed policy

AI Explain (sudiviz explain):

• AmazonBedrockFullAccess (or a scoped inline policy for bedrock:InvokeModel + bedrock:InvokeModelWithResponseStream)

Write (sudiviz fix --apply):

• AmazonEC2FullAccess
• ElasticLoadBalancingFullAccess
• AmazonS3FullAccess
• AmazonRDSFullAccess

📖 Documentation

sudiviz/
├── cli.py           # Typer commands
├── mcp_server.py    # MCP server for AI agents
├── tui.py           # Textual TUI
├── web.py           # FastAPI + WebSocket
├── discovery/       # AWS discovery (boto3)
├── graph/           # NetworkX + analyzers
├── remediation/     # Auto-fix engine
└── web_templates/   # Cytoscape.js UI

📝 License

GPL-3.0-or-later — see LICENSE

Built by @pydevsg