CLI Commands

cnspec policy lint

Lint a policy bundle to check for errors and ensure it compiles correctly.

Validate a policy bundle to ensure it compiles correctly and all queries and references are valid. Run this before uploading a policy to catch errors early. To learn more about managing policies, read Manage Policies with cnspec.

cnspec policy lint my-policy.mql.yaml

Output results in SARIF format for CI integration:

cnspec policy lint my-policy.mql.yaml --output sarif --output-file results.sarif

The linter warns when a query or a filter uses a resource or field that is marked deprecated. To make those warnings fail the lint, promote them to errors with --strict-rule. When cnspec writes the results to the terminal, any error makes the command exit with a non-zero code. Pass the flag once per rule ID, or use all to promote every warning:

cnspec policy lint --strict-rule query-deprecated-symbol --strict-rule filter-deprecated-symbol ./policies
cnspec policy lint --strict-rule all ./policies

To also warn about policies that don't declare MQL strict mode, add --require-strict-declaration. It's off by default.

Options

  -h, --help                                help for lint
  -o, --output string                       Set the output format: compact, sarif (default "cli")
      --output-file string                  Set the output file
      --require-strict-declaration strict   Warn about policies that don't declare strict. Off by default while content is migrated; becomes the default in v14.
      --strict-rule strings                 Treat warnings from these rule IDs as errors (repeatable). Use 'all' to promote every warning to an error.

Options inherited from parent commands

      --api-proxy string        Set the proxy for communications with Mondoo Platform API
      --auto-update             Enable automatic provider installation and update (default true)
      --config string           Set config file path (default $HOME/.config/mondoo/mondoo.yml)
      --log-level string        Set the log level: error, warn, info, debug, trace (default "info")
      --logging-config string   Path to a logging configuration file (YAML or JSON) that selects the log writer, level, and writer-specific options
      --strict                  Default MQL strict mode for policies that do not declare one: every link in an MQL chain must resolve
  -v, --verbose                 Enable verbose output

SEE ALSO

cnspec policy init

Create an example policy bundle file as a starting point for writing custom policies.

cnspec policy list

List enabled policies in the connected Mondoo Platform space.

On this page

OptionsOptions inherited from parent commandsSEE ALSO