Thirteen analyzers. Blast radius, security, cost, drift, policy, and more — running on every infrastructure PR before it merges.
Runs via the same prkitchen CLI, right in your CI job or locally:
terraform show -json tfplan > plan.json && prkitchen terraform plan.json.
Your plan never leaves your pipeline — only summary numbers reach the dashboard.
Every check runs in parallel on every infrastructure PR — one CI step, no plugins, and your plan never leaves the job.
Creates, updates, deletes, replaces — laid bare. Overall risk level surfaced before a reviewer opens the PR.
Scores 0–100 how much is actually at stake. Maps the full blast zone: networking, compute, storage, IAM.
Blocks RDS replacements, VPC deletions, and data-loss operations. Checks backup posture before any deletion.
IAM wildcards, open ports, unencrypted buckets, hardcoded secrets — caught at PR time, not after an incident.
Mandatory tags, approved regions, encryption requirements. Every violation surfaces with its policy ID and a fix.
Monthly cost before, after, and delta per resource. Tag compliance score. No more PRs that silently double your bill.
Resources that drifted from declared state are surfaced before you apply more changes on top of them.
count→for_each migrations, module extraction, variable hygiene — with suggested code attached.
Maps the full dependency tree. High-impact nodes — resources many others depend on — are flagged for extra review.
Flags broken output references and sensitive value exposure before downstream terraform_remote_state consumers break.
Catches timestamp(), uuid(), and other patterns that cause perpetual plan noise on every apply.
Verifies all module sources pin an explicit version. Floating references are flagged before a registry update breaks your plan.
For orgs that manage GitHub in Terraform: admin grants, repos made public, and weakened branch protection, read from the resolved plan.