repository·main·Indexed 19 days ago
https://github.com/mondoohq/mqlA query language and toolset for interacting with diverse infrastructure targets, including cloud providers, network devices, and local hosts. It includes the mqlx library for evaluating expressions and querying connected infrastructure, a provider-scaffold tool for developing new providers, and a specialized Ansible provider for static security and compliance analysis of playbooks and project directories.
The OS provider allows you to access and query operating systems via cnquery or cnspec. It supports a wide range of platforms including Linux, macOS, and Windows.
To interact with an operating system, you can use one of the following connectors:
The procfs package provides helpers to parse structured information from the Linux /proc filesystem. Unlike standard human-readable tools like sysctl or top, this implementation is designed specifically for machine readers to consume structured data.
A key feature of this implementation is that it does not require direct local system access; it is designed to work via remote connections, making it suitable for querying infrastructure remotely.
The Ansible provider allows for static security and compliance verification of Ansible code using cnquery. It performs entirely static analysis without executing anything against an inventory.
You can target the provider in two ways:
ansible.cfg, and vault-encrypted files.# To analyze a single playbook
mql shell ansible providers/ansible/play/testdata/play_cert_validation.yaml
# To analyze an entire project directory
mql shell ansible ./my-ansible-projectThe Certificate Resource in MQL allows you to inspect and validate SSL/TLS certificates using three primary methods:
Each connection to OpenStack produces exactly one asset representing the Keystone-scoped project.
technology=openstack/project=<project-uuid>openstack-project["openstack"]technology=openstack/project=<project-uuid>MQL parses Elixir and Erlang lock files to identify dependencies. Because these files use language-specific term syntax rather than standard formats like JSON, MQL uses regex-based extraction to identify package names and versions.
mix.lock formatEntries are represented as a map of package names to tuples.
Entry structure: "name": {:hex, :name, "version", "hash", build_tools, deps, "repo", "outer_hash"}
Example:
%{
"jason": {:hex, :jason, "1.4.1", "af1chabc...", [:mix], [], "hexpm", "fdfhash..."}
}rebar.lock formatEntries are represented as a list of package tuples.
Entry structure: {<<"name">>, {pkg, <<"name">>, <<"version">>, <<"hash">>}, level}
Example:
[{<<"cowboy">>, {pkg, <<"cowboy">>, <<"2.10.0">>, <<"hash...">>}, 0}]Both ecosystems use the Hex PURL scheme for identification:
pkg:hex/<name>@<version># Elixir mix.lock example
"jason": {:hex, :jason, "1.4.1", "af1chabc...", [:mix], [], "hexpm", "fdfhash..."}
# Erlang rebar.lock example
{<<"cowboy">>, {pkg, <<"cowboy">>, <<"2.10.0">>, <<"hash...">>}, 0}The mqlx package provides a high-level Go API for embedding the MQL engine in two distinct modes:
Connect or ConnectLocal), compile a query, and then execute that query against the connected asset to retrieve structured data.| Type | Role | Lifetime / reuse |
|---|---|---|
Env | Manages feature flags, provider schemas, and the expression runtime | One per process; concurrent-safe |
Conn | Represents a connection to a specific asset | Many queries per Conn; concurrent-safe |
Query | A compiled, immutable MQL query | Evaluate against any Conn or in expression mode |
Result | The output of a single evaluation | Provides Value(), Decode(), Err(), and Raw() |
Env is the root. It creates Conn objects or compiles Query objects.Query is asset-independent. You can compile a query once using Env.Compile and then run it multiple times against different connections using Query.EvalOn(ctx, conn, ...).// Expression Mode Example
env, _ := mqlx.NewEnv()
q, _ := env.Compile("props.count > 3", mqlx.WithProps(map[string]any{"count": 0}))
res, _ := q.Eval(ctx, mqlx.WithPropValues(map[string]any{"count": 5}))
// Asset Mode Example
conn, _ := env.ConnectLocal(ctx)
res, _ := conn.Query(ctx, "users { name uid }")MQL can catalog Jenkins plugins by scanning directories for .jpi or .hpi files (which are ZIP archives). The cataloger extracts metadata from the META-INF/MANIFEST.MF file within each archive to identify installed plugin versions and their dependencies. This is used for supply chain security and vulnerability management.
By default, the parser looks in standard Jenkins plugin directories, but you can specify a custom path using the jenkins.packages resource.
mql run os -c "jenkins.packages(path: '/var/lib/jenkins/plugins') { list { name version } }"MQL provides two new resources for managing Windows software inventory via Chocolatey: chocolatey.packages (for listing) and chocolatey.package (for individual package details). These resources allow you to inspect installed packages, versions, dependencies, and pin status.
Because these resources parse .nuspec XML files directly, they work in offline scans, container images, and remote connections without requiring the choco.exe CLI to be present.
mql run os -c "chocolatey.packages { list { name version pinned } }"MQL supports in-query cross-asset traversal using a typed-root foundation. This allows queries to chain across different asset types by declaring a root asset and then traversing its fields.
--env support inside a traversal; secrets must be provided via an explicit source (such as the existing vault/conf.Credentials mechanism) keyed to the target asset's identity.The cnspec SBOM Cataloger for Go identifies dependencies by parsing standard Go ecosystem files. This allows for Software Bill of Materials (SBOM) generation in local, remote (SSH/WinRM), or containerized environments.
go.mod: Declares the module path, minimum Go version, and dependency requirements. It distinguishes between direct and transitive dependencies using the // indirect comment.go.sum: A checksum database containing cryptographic hashes (h1: prefix) for dependencies to ensure integrity.vendor/modules.txt: Used when go mod vendor is active; it lists all vendored modules and uses ## explicit to identify direct dependencies.debug.BuildInfo to extract the dependency tree without source code.