MQL Overview

MQL (Mondoo Query Language) is a graph-based query language for exploring and validating the configuration of your infrastructure. Point it at a cloud account, a Kubernetes cluster, an operating system, a SaaS platform, or a Terraform file, and MQL retrieves the data you ask for and evaluates whether it meets your requirements.

MQL is declarative: you describe what you want to know, and MQL figures out how to fetch and evaluate it. It powers every check that cnspec runs, so the query you prototype interactively becomes the check you ship in a policy.

Two things MQL does

• Query. Ask questions about an asset and get structured data back. For example, list every package with "ssl" in its name and show its version:

  packages.where( name == /ssl/i ) { name version }

• Assert. Write expressions that must evaluate to true. For example, verify that no user named "bob" exists on the system:

  users.none( name == "bob" )

The same language covers both. A query you write to explore an asset becomes, with a small change, a check that passes or fails.

Where MQL runs

The fastest way to run MQL is with cnspec, Mondoo's open source CLI. Once cnspec is installed, run a single query from the command line:

cnspec run local -c "packages.where( name == /ssl/i ) { name version }"

Or open the interactive shell and explore an asset live:

cnspec shell local

You can also wrap MQL in policies, run it in CI/CD pipelines, and embed the MQL engine directly in your own Go applications.

Start here

Go further

• Build security policies. To turn your queries and checks into reusable, documented policies, read the Policy Authoring Guide.
• Embed MQL in your tools. To run MQL from scripts or inside a Go application, read Embedding MQL.

Can't find what you need?

• Open source users: join the community discussion on GitHub.
• Mondoo Platform users: join the community Slack channel to chat with us and other Mondoo users.