CDK-native evidence
Trace findings back to the code you wrote
Move from a generated CloudFormation resource to its construct path, source file, and line without searching the synth output.
Construct → logical ID → source
AWS CDK analysis before deploy
See what your CDK will do.Fix what it shouldn't.
Find security, cost, reliability, and operational risks in your AWS CDK stacks. Get source-level evidence and practical fixes before a change reaches AWS.
your project
$
npx cdk-insights scanNo account. No card. No source upload.
cdk-insights scan
$ npx cdk-insights scan --diff
◇ Synthesising CheckoutStack
✓ 48 resources mapped to CDK source
✓ 145 static checks complete
▲ 1 new finding · opening review
Review ready
CheckoutStack · 48 resources
checkout-stack.ts
38 new s3.Bucket(this,
39'Receipts', {
40publicReadAccess: true,
41 });
S3 public read access
Customer receipts can be read publicly
This bucket stores receipt data but allows anonymous reads. Anyone who discovers an object URL could access customer documents outside your application.
Recommended CDK change
blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALLExact source linePR-ready output
Built for CDK, not retrofitted
Less noise between finding and fix.
Generic scanners stop at generated infrastructure. CDK Insights keeps the CDK context attached, so developers can understand a problem and act on it without becoming CloudFormation detectives.
Useful AI, by choice
Add context when static rules stop being enough
Use the rich default model for clear explanations, or choose a deeper model for complex architecture reviews with the credit cost shown first.
5 models · transparent rates
Adoptable controls
Protect new work without blocking on old debt
Baseline existing findings, review only the diff, and gate a pull request by severity or Well-Architected pillar.
Baseline · diff · suppressions
From change to confidence
One repeatable loop for local development and CI
- 01
Scan locally
Synthesize and analyse every stack without uploading your CDK source.
- 02
Understand the risk
See why it matters, where it came from, and the smallest safe change.
- 03
Fix with confidence
Apply deterministic fixes or carry the same evidence into review and CI.
- 04
Keep it fixed
Track only new regressions and preserve a clean, explainable audit trail.
AI with a visible price tag
Use the right depth for each review.
Start with a rich, economical default. Switch models only when the problem deserves more reasoning, with the credit rate shown before the scan starts.
Predictable monthly credits
Cached results do not spend credits again.
Five available models
Compare routine and premium analysis per scan.
choose analysis depth
GLM 4.7 Flash
Rich defaultDetailed explanations and concrete fixes for everyday scans.
0.5credits / resource
Nova Lite
Fast alternativeA cost-efficient AWS-native second view for routine checks.
0.5credits / resource
Haiku 4.5
Deeper reviewMore reasoning depth when an architecture needs a closer look.
4credits / resource
$ npx cdk-insights scan --model haiku-4-5
Built for Codebases
That Already Exist
Most IaC scanners hand you 200 findings on day one and tell you to fix them all. CDK Insights gives you a baseline, a diff, and an auto-fix command - so you can turn it on this afternoon without blocking every PR for a month.
Step 1
Baseline what you have
cdk-insights scan --writeBaselineSnapshot every existing finding in one file you commit to git. The starting line is whatever your codebase already looks like - no need to fix anything first.
Step 2
Diff on every PR
cdk-insights scan --diffCI fails only on findings that did not exist in the baseline. Pre-existing tech debt stays visible in the summary but never blocks a merge - so you can adopt the tool today without churn.
Step 3
Auto-fix the boring stuff
cdk-insights fix --applyMechanical remediations write themselves: enforceSSL, point-in-time recovery, KMS encryption, current Lambda runtimes. Reviewers spend their time on the judgment calls, not the boilerplate.
The whole loop runs locally, in seconds.
Auto-fix today handles seven mechanical rules - enforceSSL, versioning, point-in-time recovery, KMS encryption (S3 + DynamoDB), Lambda tracing and runtime upgrades. It refuses to touch anything ambiguous. The rest stays in the report for a human to triage.
data boundary
1
Your CDK project
Synthesis and 145 static checks execute locally
2
Opt-in AI context
Relevant infrastructure facts are sent for explanation
3
Actionable result
Explanation, exact source location, and recommended change
No source upload required for static analysis
Designed for real codebases
Useful enough to adopt. Clear enough to trust.
CDK Insights keeps the fast path local, makes cloud analysis a deliberate choice, and carries the same evidence from a laptop into pull-request review.
Static analysis stays local
Your CDK source and synthesised templates remain on your machine for static scans.
AI is explicit and scoped
AI analysis is opt-in and sends infrastructure context, never your entire source repository.
The same evidence in CI
PR comments, SARIF, severity gates, baselines, and diff mode keep reviews focused.
One result model · six useful views
The right evidence, where your team works.
Every format carries the same rule, severity, source location, explanation, and fix. Move from local development to CI and reporting without losing context.
- Exact CDK file and line attribution
- Stable identifiers for deduplication and baselines
- Human explanation plus machine-readable evidence
github preview
CDK Insights1 new finding
checkout-stack.ts · line 40
Public read access exposes customer receipt objects.
+ blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL
Same finding. Choose the view that makes it easiest to act.
Simple monthly plans
Static analysis stays free.
Upgrade for more AI depth and team workflows. Every plan keeps static scans unlimited, with no usage-based overage charges.
Free
£0forever
Start locally and keep static analysis unlimited.
- 145 static rules
- Unlimited static scans
- 500 AI credits / month
- 30-day scan history
Pro
Most popular£9.99per month
Rich AI analysis for independent developers and consultants.
- Everything in Free
- 10,000 AI credits / month
- All five AI models
- 90-day scan history
Team
£12.99per seat / month
Shared governance and visibility across delivery teams.
- Everything in Pro
- 20,000 credits / seat
- Roles and shared configuration
- 365-day scan history
Team has a two-seat minimum. Prices are in GBP. Cancel any time.
Static analysis is free forever
Give your next CDK change a better review.
Start locally without an account. Create a free account when you want AI explanations, scan history, and 500 monthly credits.
Included from the first scan
- 145 CDK security, cost, and reliability rules
- Source-level findings across every stack
- Table, Markdown, JSON, CSV, SARIF, and GitHub output
- Baseline and diff mode for existing codebases