Manage cnspec Providers

cnspec scans dozens of platforms, from AWS to Windows hosts. The code that knows how to talk to a given platform lives in a provider, and providers are loaded on demand: cnspec ships with only a few built-in providers, such as core, and downloads every other provider the first time you need it.

How automatic provider management worksCopy Anchor Link

Suppose you install cnspec on a Linux workstation. No providers are installed yet.

• You run cnspec scan local. cnspec needs the os provider, downloads it, then runs the scan. The os provider stays on disk for next time.
• You run cnspec shell aws. cnspec needs the aws provider, downloads it, opens the shell.

For most users this just works and there's nothing to manage. The exceptions are:

• Containers, where the provider download repeats every time the container starts.
• Read-only hosts, where cnspec can't write the provider to disk.
• Air-gapped hosts, where cnspec can't reach releases.mondoo.com.

The next three sections walk through each.

ContainersCopy Anchor Link

By default, every fresh container that runs a cnspec command re-downloads providers, which slows down scans and burns network. To avoid that, do one of the following:

• Bake providers into the image. See Install a provider manually below.
• Disable auto-update so cnspec uses whatever's pre-installed. See Turn off provider auto-update.

Read-only hostsCopy Anchor Link

If cnspec can't write to the host, it can't download or update providers either. Install the providers you need ahead of time and turn off auto-update so cnspec doesn't try to fetch updates and warn on every command.

Air-gapped hostsCopy Anchor Link

In air-gapped networks, cnspec can't reach releases.mondoo.com to fetch providers. Download the providers you need on a connected machine, copy them across, and install them from the file. Then disable auto-update so cnspec stops trying to fetch updates.

If you run an internal mirror instead, point the updates_url setting at it. cnspec then downloads providers from <updates_url>/providers and keeps updating them automatically.

Turn off provider auto-updateCopy Anchor Link

By default, every cnspec command installs the provider it needs if it's missing and updates it when a newer version is available. cnspec checks the list of available provider versions at most once an hour. Disable this when you want cnspec to use only what you've already installed. The same setting also stops cnspec from updating itself.

For all commandsCopy Anchor Link

Set auto_update: false in the cnspec configuration file. The file location depends on whether you want the setting to apply system-wide or just to one user:

• Linux, all users: /etc/opt/mondoo/mondoo.yml
• macOS, all users: /Library/Mondoo/etc/mondoo.yml
• Linux and macOS, single user: ~/.config/mondoo/mondoo.yml
• Windows, all users: C:\ProgramData\Mondoo\mondoo.yml
• Windows, single user: C:\Users\{username}\.config\mondoo\mondoo.yml

auto_update: false

For a single commandCopy Anchor Link

Pass --auto-update=false to skip the check just once:

cnspec scan --auto-update=false

The flag overrides the auto_update setting in mondoo.yml.

Available providersCopy Anchor Link

You can browse and download every provider at releases.mondoo.com/providers/. Past versions are kept indefinitely.

To list what's installed locally:

cnspec providers

For all providers subcommands, run cnspec providers -h.

Install a provider manuallyCopy Anchor Link

To install the latest version of a provider:

cnspec providers install NAME

For example:

cnspec providers install k8s

To install a specific version, append it to the name:

cnspec providers install aws@14.0.0

To install from the preview release channel for one command, without changing any configuration:

cnspec providers install aws --channel preview

--channel has no effect when you pin a version or install from a file or URL.

To install only a provider's configuration and resource schema, without its binary:

cnspec providers install aws --schema-only

A schema-only install is much smaller than the full provider. It's enough to compile queries against the provider's resources, but not to connect to assets. To scan, install the provider fully.

To install from a downloaded archive:

cnspec providers install -f providers/os/dist/os.tar.xz

To install from a URL:

cnspec providers install --url https://releases.mondoo.com/providers/os/14.0.1/os_14.0.1_linux_arm64.tar.xz

For all flags, run cnspec providers install -h.

Update providers manuallyCopy Anchor Link

To update every installed provider to its latest version:

cnspec providers update

To update one or more specific providers:

cnspec providers update vsphere

Providers already on the latest version are skipped. Add --channel preview to update from the preview channel for this one command.

Remove a providerCopy Anchor Link

cnspec providers delete terraform