cnspec System Requirements
Minimum operating system versions, CPU architectures, PowerShell version, and access rights cnspec needs to install and scan a local host.
This page describes what a host needs to install cnspec and scan its local operating system. It covers supported operating system versions, CPU architectures, the minimum PowerShell version on Windows, and the access rights a local scan requires.
These requirements apply only to hosts where you install cnspec to scan themselves. To scan a remote target over SSH, WinRM, a cloud API, or a container image, cnspec runs from your workstation or a CI runner and nothing needs to be installed on the target. For the full list of what cnspec can reach remotely, see Supported Scan Targets.
Supported operating systems
Mondoo builds and tests cnspec on the platforms below. cnspec ships as a single static binary, so it has no runtime dependencies beyond the operating system itself.
| Edition | Tested versions |
|---|---|
| Windows client | 10, 11 |
| Windows Server | 2016, 2019, 2022, 2025 |
PowerShell 5.1 or later is required. The Windows installer declares #Requires -Version 5, so it stops with an error on any host running an older PowerShell. Check the installed version before you install:
$PSVersionTable.PSVersionLegacy Windows Server releases are a common cause of failed installs. Windows Server 2012 ships with PowerShell 3.0 and Windows Server 2012 R2 ships with PowerShell 4.0, both below the required minimum. These versions are also outside the tested matrix above. To install cnspec on them, first install Windows Management Framework 5.1 to bring PowerShell up to 5.1, then run the installer.
TLS 1.2 must be enabled so the installer can reach Mondoo's download and API endpoints. It is enabled by default on modern Windows, and the install pages explain how to confirm or enable it.
Supported CPU architectures
| Operating system | Architectures |
|---|---|
| Windows | amd64 (64-bit x86), arm64 (64-bit ARM) |
| Linux | amd64, arm64, 386 (32-bit x86); arm, ppc64le, and s390x as standalone binaries |
| macOS | amd64 (Intel), arm64 (Apple silicon), plus a universal package |
The automated install scripts detect amd64, arm64, and 386. For the additional Linux architectures, download the matching binary directly from releases.mondoo.com and follow the standalone binary instructions.
Access rights for a local scan
A local scan reads protected operating system configuration, so it needs elevated privileges to return complete results. The table below summarizes what each platform requires.
- Installing: the package manager and the automated install script require
root, or a user withsudo. - Scanning: run
cnspec scan localasrootor withsudo. A full scan reads files such as/etc/shadowand/etc/sudoersthat are only readable byroot. Without elevated privileges, the checks that depend on those files return no data. When you run cnspec as a service, the systemd unit runs asrootby default.
Network requirements
To install cnspec and report results to Mondoo Platform, the host needs outbound access on port 443 to Mondoo's install, release, API, and registry endpoints, and a clock kept in sync with NTP. Each install guide lists the exact endpoints and includes connectivity checks: