| name | policy-graph |
| description | Navigates cnspec policy/framework bundles using graph commands. Use when exploring policies, finding checks, tracing compliance mappings, or understanding policy structure. |
| allowed-tools | Bash Read Glob Grep |
cnspec Policy Graph Navigation
Navigate and understand cnspec policy bundles (.mql.yaml files) using structured graph commands.
When to Use
- Exploring policy bundle structure ("what checks does this policy have?")
- Finding compliance mappings ("which framework controls map to this check?")
- Tracing relationships ("how does this framework relate to that check?")
- Understanding large bundles (10K+ line
.mql.yaml files)
- Getting context for a specific check with its MQL code, impact, and docs
When NOT to Use
- Scanning assets with cnspec (
cnspec scan)
- Writing MQL queries
- Linting bundles (
cnspec policy lint)
- Editing policy YAML directly (use the Read/Edit tools for that)
For authoring or changing policies, use the mql skill instead. Its Wiring Policies into Content Validation section covers the fixtures and validator registrations a policy change in the cnspec repository has to ship with.
Commands Reference
| Command | Purpose |
|---|
cnspec policy graph search <query> <path> | Find nodes by name, title, or UID |
cnspec policy graph callers <uid> <path> | What references this node (inbound edges) |
cnspec policy graph callees <uid> <path> | What this node contains/references (outbound edges) |
cnspec policy graph context <uid> <path> [--depth N] | LLM-friendly context with YAML snippets |
cnspec policy graph paths <from> <to> <path> | Find paths between two nodes |
cnspec policy graph reachable <uid> <path> | All nodes transitively reachable |
cnspec policy graph export <path> [--format json|dot] | Export full graph |
All commands support --json for structured output. Search also supports --kind, --tag, --impact, and --limit.
Graph Concepts
Node Types
- policy: A security policy (e.g.,
mondoo-linux-security)
- group: A group of checks within a policy (e.g., "SSH Configuration")
- check: A scoring query with MQL code and impact rating
- query: A data-only query (no scoring)
- framework: A compliance framework (e.g., CIS Benchmark, ISO 27001)
- control: A control within a framework (e.g., CIS 5.2.1)
- framework_map: Maps framework controls to policy checks
Edge Types
- contains: Structural parent-child (policy → group → check, framework → control)
- maps_to: Compliance mapping (control → check/policy via framework_map)
- depends_on: Policy/framework dependencies
- variant_of: Check variant relationship (parent → platform-specific variant)
