cnspec

What cnspec scans

cnspec is an open source, cloud native security and policy project. It assesses the security and compliance of an entire infrastructure and finds vulnerabilities and misconfigurations across public and private cloud environments, Kubernetes clusters, containers, container registries, servers, endpoints, SaaS products, infrastructure as code, APIs, and more. At its center is a policy as code engine built on Mondoo's security data fabric, and it ships with default security policies that run out of the box, so a first scan needs little configuration. The README emphasizes that the tool is both fast and simple to use, which is the usual promise of policy as code done well. The quick start is a single install command followed by cnspec scan local. The repository metrics at the time of writing show 442 stars, 41 forks, and 123 open issues, a sign of an active project with a broad surface of supported platforms. The homepage is cnspec.ai. The license field in the metadata is not a standard SPDX identifier, which reflects that the repository carries Mondoo's own licensing terms rather than a common open source license. For operators, the value is that one engine and one policy language cover a wide range of targets, so a team can express its rules once and apply them from a laptop to a production fleet without swapping tools for each environment they run.

Running scans and the shell

Using cnspec starts with an install script for Linux and macOS, or a PowerShell sequence for Windows, and the packages are also available from the releases page for manual installs. The scan subcommand checks local and remote targets for misconfigurations and vulnerabilities. A local scan is just cnspec scan local. Remote targets are addressed by provider: you can scan a docker image such as ubuntu 22.04, an AWS account using the local AWS CLI config, an EC2 instance through EC2 Instance Connect, a Kubernetes cluster through the local kubectl config or a manifest file, or a GitHub repository by exporting a token and pointing at org and repo. Vulnerability scanning spans many platforms and works for build and runtime, but the README notes it requires the client to be logged into Mondoo Platform. Beyond one off scans, cnspec provides an interactive shell, started with cnspec shell local, that helps you explore the assertions behind policies and write your own. Inside the shell, a help command lists the available resources and their fields, and you can enter MQL assertions such as checking that no listening port equals 23. Auto complete makes exploration easier, and the shell is presented as a good way to understand both local and remote targets on the fly before committing a policy to a file.

Targets and custom policies

The range of supported targets is one of cnspec's defining traits. The README's table lists providers from major clouds such as AWS, Azure, Google Cloud, and Alibaba Cloud to Kubernetes, GitHub, GitLab, DNS records, and a long set of databases including PostgreSQL, MySQL and MariaDB, MongoDB, Microsoft SQL Server, and others. Network devices appear too, with vendors such as Cisco, Arista, Fortinet, Juniper, and MikroTik, and there is even support for Model Context Protocol servers, Hugging Face namespaces, and AI platform accounts. This breadth means a single tool can report across an organization's stack. Policies themselves are plain YAML files that express any security rule or best practice for a fleet, and a few examples live in the examples folder of the repository and can be run directly. With a Mondoo Platform account, policies can be uploaded as bundles, and Mondoo publishes a Policy Authoring Guide for anyone who wants to write or contribute policies back to the community. The README also explains how cnspec returns scan results to standard output and to Mondoo Platform, and how the platform prioritizes the findings that pose the highest risk in the context of your infrastructure rather than flooding you with every alert at once. The practical result is a scanner that scales from a quick local check to fleet wide compliance reporting.

Editorial conclusion

cnspec is written in Go and was last updated on 2026-08-24, with 442 stars and 123 open issues recorded in the repository at that time.