Register cnspec with Mondoo Platform

You can expand your cnspec capabilities with a Mondoo Platform account. Mondoo Platform includes a web-based UI through which you can:

Continuously monitor infrastructure security and compliance
Save, review, search, and share scan results
Access over 200 free security policies, including specific compliance checks against regional and industry guidelines
Manage and share policies across your entire infrastructure
Automatically scan your infrastructure with integrations for clouds, SaaS, IaC, Kubernetes, and more
Expose vulnerabilities on systems with vendor advisory and CVE support
Take action on top findings with ticketing and automated remediations

This is just a partial list of capabilities. To learn more about what you can accomplish with Mondoo Platform, visit mondoo.com.

To get started, contact Mondoo.

Register cnspec

If you install cnspec on an asset using a system package instead of Mondoo's automated installation script, you must register the asset manually.

Log into the Mondoo Console.
Navigate to the region, organization, and space where you want to see the new asset's scan results.
In the left navigation, under Integrations, select Add New Integration.
Select your operating system and copy the registration token.
Open a terminal and run this command:
Register cnspec
```
cnspec login --token "<PASTE_YOUR_TOKEN_HERE>"
```
This command uses the token to create a service account that lets cnspec report results to Mondoo Platform.

Windows: cnspec login --token "<PASTE_YOUR_TOKEN_HERE>" --config "C:\ProgramData\Mondoo\mondoo.yml"
Linux: cnspec login --token "<PASTE_YOUR_TOKEN_HERE>" --config "/etc/opt/mondoo/mondoo.yml"

Validate registration

The cnspec status command validates cnspec registration and ensures that communication with Mondoo Platform is successful. Run it after registering to confirm everything is working:

cnspec status

Unregistered Client

If the client isn't registered, the last line of the output reads client is not registered. To fix this, follow the registration steps above.

Unregistered cnspec

cnspec status
→ loaded configuration from /Users/stella/.config/mondoo/mondoo.yml using source default
→ Platform:		macos
→ Version:		26.3
→ Hostname:		stella.home
→ IP:			172.16.1.94
→ Time:			2026-02-07T10:55:43-08:00
→ Version:		12.21.0 (API Version: 12)
→ Latest Version:	12.21.0
→ Providers URL:	https://releases.mondoo.com/providers
→ Installed Providers:	core | os | mock
→ API ConnectionConfig:	https://us.api.mondoo.com
→ API Status:		SERVING
→ API Time:		2026-02-07T18:55:43Z
→ API Version:		12
x client is not registered

Successful Registration

If registration and authentication are working correctly, the last two lines of the output confirm it:

Correctly registered client

cnspec status
→ loaded configuration from /Users/mwezi/.config/mondoo/mondoo.yml using source default
→ Platform:		macos
→ Version:		26.3
→ Hostname:		mwezi.home
→ IP:			192.168.254.21
→ Time:			2026-02-07T10:58:10-08:00
→ Version:		12.21.0 (API Version: 12)
→ Latest Version:	12.21.0
→ Providers URL:	https://releases.mondoo.com/providers
→ Installed Providers:	core | os | mock
→ API ConnectionConfig:	https://us.api.mondoo.com
→ API Status:		SERVING
→ API Time:		2026-02-07T18:58:10Z
→ API Version:		12
→ Owner:		//captain.api.mondoo.app/spaces/lunalectric-team-workstations
→ Client:		//agents.api.mondoo.app/spaces/lunalectric-team-workstations/agents/2SARlZgQnFLAzj7jfiS1Fx2HBz8
→ Service Account:      //agents.api.mondoo.app/spaces/lunalectric-team-workstations/serviceaccounts/2bMtksUk9EjrI5MC3tTf6UmhNC2
→ client is registered
→ client authenticated successfully

If cnspec is registered but can't authenticate, the output ends with an error like the one below. This typically means the service account credentials are invalid or have been revoked. To fix this, re-register cnspec using a new token.

Invalid cnspec registration

cnspec status
→ loaded configuration from /Users/cosmo/.config/mondoo/mondoo.yml using source default
→ Platform:		macos
→ Version:		26.3
→ Hostname:		cosmo.home
→ IP:			192.168.254.21
→ Time:			2026-02-07T10:58:10-08:00
→ Version:		12.21.0 (API Version: 12)
→ Latest Version:	12.21.0
→ Providers URL:	https://releases.mondoo.com/providers
→ Installed Providers:	 core | mock | os
→ API ConnectionConfig:	https://api.edge.mondoo.com
→ API Status:		SERVING
→ API Time:		2026-02-07T18:58:10Z
→ API Version:		12
→ Owner:		//captain.api.mondoo.app/spaces/lunalectric-team-workstations
→ Client:		//agents.api.mondoo.app/spaces/lunalectric-team-workstations/agents/2SARlZgQnFLAzj7jfiS1Fx2HBz8
→ Service Account:      //agents.api.mondoo.app/spaces/lunalectric-team-workstations/serviceaccounts/2bMtksUk9EjrI5MC3tTf6UmhNC2
→ client is registered
x could not connect to mondoo platform error="rpc error: code = Unauthenticated desc = request permission unauthenticated"

Clock Skew Detected

If the system clock is significantly out of sync with the Mondoo Platform API, the output includes a clock skew warning. To fix this, synchronize your system clock using NTP or your operating system's time settings.

Clock skew detected

cnspec status
→ loaded configuration from /Users/cosmo/.config/mondoo/mondoo.yml using source default
→ Platform:		macos
→ Version:		26.3
→ Hostname:		tsuki.home
→ IP:			192.168.254.21
→ Time:			2026-02-04T12:07:41-08:00
→ Version:		12.21.0 (API Version: 12)
→ Latest Version:	12.21.0
→ Providers URL:	https://releases.mondoo.com/providers
→ Installed Providers:	 core | mock | os
→ API ConnectionConfig:	https://api.edge.mondoo.com
→ API Status:		SERVING
→ API Time:		2026-02-04T20:07:42Z
→ API Version:		12
→ Owner:		//captain.api.mondoo.app/spaces/lunalectric-team-workstations
→ Client:		//agents.api.mondoo.app/spaces/lunalectric-team-workstations/agents/2SARlZgQnFLAzj7jfiS1Fx2HBz8
→ Service Account:      //agents.api.mondoo.app/spaces/lunalectric-team-workstations/serviceaccounts/2bMtksUk9EjrI5MC3tTf6UmhNC2
→ client is registered
→ client authenticated successfully
! possible clock skew detected: 72h0m6.277868s

Specify a proxy server for communication with Mondoo

You can specify a proxy server for communication between cnspec and Mondoo Platform. This is useful if your default system proxy restricts communication, or if you need to monitor different types of traffic.

Find the Mondoo configuration file:
- Linux: /etc/opt/mondoo/mondoo.yml
- Windows: C:\ProgramData\Mondoo\mondoo.yml
Add this line to mondoo.yml, replacing the example address and port with your proxy server's:
```
api_proxy: https://1.1.1.1:8080
```