# inspec/inspec

InSpec: Auditing and Testing Framework

Repository: https://github.com/inspec/inspec
Canonical: https://ross.abutalabs.com/products/inspec
Homepage: http://inspec.io
Language: Ruby
License: NOASSERTION
License Family: other
Topics: audit, inspec, security, compliance, devsec, devops, tdd-utilities, tdd, spec, testing
Last push: 2026-08-26T14:53:29+00:00

## Health v2 (maintenance only)
Score: 92/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 99, release rhythm 78, longevity 100
- inputs: {"age_days": 4023, "days_push": 7, "days_rel": 69, "gap_med": 47.5, "n_releases_24m": 13}
- flags: no_license
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 3085, forks 678 (observed 2026-08-28T04:07:42.045055+00:00)

## What it is
Chef InSpec is an open-source testing framework for infrastructure that expresses compliance, security, and policy requirements as human- and machine-readable code. It provides a CLI to run tests locally or remotely via SSH, WinRM, or Docker, making compliance-as-code executable anywhere.

## Use cases
- audit server security configurations as code
- run compliance tests on remote hosts via ssh
- verify infrastructure meets policy requirements
- test that insecure packages are not installed
- automate security compliance checks in ci/cd
- codify cis benchmark controls
- scan docker containers for configuration compliance

## When to choose
- you need compliance and security requirements expressed as automated, repeatable tests
- you want to audit local machines, remote hosts over SSH/WinRM, or containers with one tool
- your team practices DevSecOps and wants compliance checks early in the release cycle
- you need human-readable profiles with controls, impact levels, and metadata for auditors

## When to avoid
- you only need unit or end-to-end testing of application code rather than infrastructure state
- you want a fully open-source tool without EULA/license acceptance requirements
- you need continuous configuration management (enforcement) rather than auditing - Chef Infra or Ansible may fit better
- you prefer writing checks in a general-purpose language instead of a DSL

## Facets
- artifact type: framework
- maturity: active
- function: testing, security, infrastructure-as-code, cli, developer-tools
- domain: security, testing, self-hosted
- platform: windows, ruby, cli, cross-platform
- tags: compliance-as-code, infrastructure-testing, audit, devsecops, policy-as-code, tdd, devops, automation, linux, macos

## Member repositories
- inspec/inspec (main) score 92

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:07:42.045055+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T07:27:39.608830+00:00, confidence not recorded.
  - readme: https://github.com/inspec/inspec (fetched 2026-08-28T04:07:42.045055+00:00, sha 837a856dc095)
  - homepage: http://inspec.io (fetched 2026-08-29T09:42:57.435889+00:00, sha cf99eaa06108)
  - site_page: https://docs.chef.io (fetched 2026-08-29T09:42:57.439129+00:00, sha c045f99ebfe1)
  - site_page: https://docs.chef.io/inspec (fetched 2026-08-29T09:42:57.441285+00:00, sha 382e3e24a471)
  - site_page: https://www.chef.io/how-to-buy (fetched 2026-08-29T09:42:57.447316+00:00, sha 1b60fb194ced)
- Data as of 2026-08-30T08:39:29.467469+00:00.