# Policy Graph

> Navigates cnspec policy/framework bundles using graph commands. Use when exploring policies, finding checks, tracing compliance mappings, or understanding policy structure.

- Skill: `mondoohq/policy-graph` (Agent Skill, multi-file: 6 files)
- Install (CLI): `npx skillmds@latest add mondoohq/policy-graph`
- Raw SKILL.md: https://api.skillmd.com/api/skills/mondoohq/policy-graph/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: mondoohq (https://skillmd.com/u/mondoohq)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/mondoohq/policy-graph

---


# cnspec Policy Graph Navigation

Navigate and understand cnspec policy bundles (`.mql.yaml` files) using structured graph commands.

## When to Use

- Exploring policy bundle structure ("what checks does this policy have?")
- Finding compliance mappings ("which framework controls map to this check?")
- Tracing relationships ("how does this framework relate to that check?")
- Understanding large bundles (10K+ line `.mql.yaml` files)
- Getting context for a specific check with its MQL code, impact, and docs

## When NOT to Use

- Scanning assets with cnspec (`cnspec scan`)
- Writing MQL queries
- Linting bundles (`cnspec policy lint`)
- Editing policy YAML directly (use the Read/Edit tools for that)

For authoring or changing policies, use the `mql` skill instead. Its **Wiring Policies into Content Validation** section covers the fixtures and validator registrations a policy change in the cnspec repository has to ship with.

## Commands Reference

| Command | Purpose |
|---------|---------|
| `cnspec policy graph search <query> <path>` | Find nodes by name, title, or UID |
| `cnspec policy graph callers <uid> <path>` | What references this node (inbound edges) |
| `cnspec policy graph callees <uid> <path>` | What this node contains/references (outbound edges) |
| `cnspec policy graph context <uid> <path> [--depth N]` | LLM-friendly context with YAML snippets |
| `cnspec policy graph paths <from> <to> <path>` | Find paths between two nodes |
| `cnspec policy graph reachable <uid> <path>` | All nodes transitively reachable |
| `cnspec policy graph export <path> [--format json\|dot]` | Export full graph |

All commands support `--json` for structured output. Search also supports `--kind`, `--tag`, `--impact`, and `--limit`.

## Graph Concepts

### Node Types

- **policy**: A security policy (e.g., `mondoo-linux-security`)
- **group**: A group of checks within a policy (e.g., "SSH Configuration")
- **check**: A scoring query with MQL code and impact rating
- **query**: A data-only query (no scoring)
- **framework**: A compliance framework (e.g., CIS Benchmark, ISO 27001)
- **control**: A control within a framework (e.g., CIS 5.2.1)
- **framework_map**: Maps framework controls to policy checks

### Edge Types

- **contains**: Structural parent-child (policy → group → check, framework → control)
- **maps_to**: Compliance mapping (control → check/policy via framework_map)
- **depends_on**: Policy/framework dependencies
- **variant_of**: Check variant relationship (parent → platform-specific variant)