Summary
cnquery is an open-source tool from Mondoo for asking questions about the current state of your infrastructure. Using the Mondoo Query Language (MQL), it discovers and queries resources across operating systems, cloud accounts, Kubernetes clusters, and network devices, and can export the results as structured JSON for further analysis.
What is cnquery?
cnquery acts as the discovery layer of the Mondoo toolchain. It covers a very broad set of resource types across four layers—OS, cloud, Kubernetes, and network—including network hardware from multiple vendors, which sets it apart from comparable inventory tools. Engineers use it for ad-hoc queries ("which hosts have this package?", "which buckets are public?") and to feed inventory data into downstream pipelines and data lakes.
It is the complement to cnspec: where cnquery answers open-ended questions and exports raw data, cnspec runs continuous pass/fail policy checks. One caveat to plan for is that the JSON output schema is not guaranteed stable across major versions, so downstream consumers should be version-aware.
Why is cnquery relevant?
- Broad discovery: One tool inventories OS, cloud, Kubernetes, and network resources, including network hardware
- Queryable infrastructure: MQL turns the live state of your estate into something you can ask precise questions about
- Pipeline input: Structured JSON export feeds inventories, audits, and architecture-verification workflows
- Pairs with cnspec: Discovery (cnquery) and continuous policy enforcement (cnspec) cover both halves of security posture