CLI Commands

cnspec shell

Open an interactive MQL query shell to explore and test queries against assets.

Open an interactive MQL shell to explore and test queries against a target asset in real time. This is useful for developing and debugging queries before using them in policies, letting you quickly iterate and see results as you type.

cnspec shell local

You can also connect to remote targets:

cnspec shell ssh user@HOST

cnspec shell connects to one asset at a time. To open a shell on an asset that an inventory file defines, using the credentials in that file, pass --inventory-file instead of a provider subcommand. The inventory must define exactly one asset. Once cnspec connects, it offers the assets it discovers below that asset for selection:

cnspec shell --inventory-file inventory.yml

To scan many assets at once instead, define them in an inventory file and use cnspec scan --inventory-file.

cnspec shell [flags]

Options

  -c, --command string                MQL query to execute in the shell
      --discover strings              Enable the discovery of nested assets. Supports: all, auto, container, container-images, mcp-servers
  -h, --help                          help for shell
      --inventory-file string         Set the path to an inventory file that defines exactly one asset to connect to, with its credentials
      --inventory-format-ansible      Set the inventory format to Ansible
      --inventory-format-domainlist   Set the inventory format to domain list
      --platform-id string            Select a specific target asset by providing its platform ID
      --record string                 Record all resource calls and use resources in the recording
      --sudo                          Elevate privileges with sudo
      --use-recording string          Use a recording to inject resource data (read-only)

Options inherited from parent commands

      --api-proxy string        Set the proxy for communications with Mondoo Platform API
      --auto-update             Enable automatic updates of cnspec and its providers; overrides auto_update in the config file (default true)
      --config string           Set config file path (default $HOME/.config/mondoo/mondoo.yml)
      --log-level string        Set the log level: error, warn, info, debug, trace (default "info")
      --logging-config string   Path to a logging configuration file (YAML or JSON) that selects the log writer, level, and writer-specific options
      --strict                  Default MQL strict mode for policies that do not declare one: every link in an MQL chain must resolve
  -v, --verbose                 Enable verbose output

SEE ALSO

cnspec serve

Start cnspec in background mode to run scheduled security scans.

cnspec status

Verify cnspec access to Mondoo Platform by sending a ping to check credentials.

On this page

OptionsOptions inherited from parent commandsSEE ALSO