Skip to content
SPECIFICTION
Get listed

CFEngine

cfengine.com

Free plan Open source WebWindowsmacOSLinuxAPISelf-hosted
Visit cfengine.com
Spec score 9.0 #1 of 26 in Configuration Management Tools

What it is

CFEngine automates infrastructure, security, and compliance by moving managed systems toward a state defined in policy. Users describe desired infrastructure states in CFEngine’s domain-specific language, and lightweight agents work to bring each device into compliance. By default, an agent contacts the CFEngine hub every five minutes. The system runs on embedded devices, servers, cloud systems, and mainframes, and is designed for tens or hundreds of thousands of nodes. Enterprise adds the Mission Portal web interface, reporting backed by an SQL database, REST APIs, compliance reports, policy analysis, alerts, inventory and change reporting, file-integrity monitoring, and performance monitoring. Dashboards provide compliance and performance views, alerts, and customizable sharing. Secure bootstrap uses mutual authentication, key exchange, and encrypted TLS communication. Community Edition is free under GNU GPL, supports Linux, and includes community support. Enterprise is free for up to 25 hosts; pricing beyond that is available on request. The supported operating systems listed include Linux distributions and Windows.

Spec sheet

What it does
CFEngine automates configuration, patching, security hardening, compliance and infrastructure maintenance through continuously running agents.Read 14 Oct 2026 · docs.cfengine.com
Purpose
CFEngine automates infrastructure, security and compliance by continuously keeping infrastructure secure, compliant and up to date.Read 1 Oct 2026 · cfengine.com
Platforms
CFEngine supports major platforms including RHEL, Ubuntu, Debian and Windows Server, with tailored support available for OpenBSD, IBM AIX, macOS and Solaris.Read 1 Oct 2026 · cfengine.com
API
The Enterprise Hub exposes a REST API that also supports SQL-based queries for custom reports over distributed database data.Read 14 Oct 2026 · docs.cfengine.com
Security
CFEngine's secure bootstrap uses mutual authentication, key exchange and encrypted communication over TLS.Read 1 Oct 2026 · docs.cfengine.com
Support
Enterprise provides a dedicated support team that answers questions, recommends best practices and can prioritize development of requested features.Read 1 Oct 2026 · cfengine.com
Headquarters
Oslo, NorwayRead 23 Sep 2026 · cfengine.com
Founded
2008Read 23 Sep 2026 · cfengine.com
Alerts and actions
Users can define event alerts and trigger custom actions or integrations when infrastructure changes occur.Read 14 Oct 2026 · cfengine.com
Architecture
The CFEngine agent runs on each managed device and connects to the CFEngine hub by default every five minutes to ensure configuration compliance.Read 1 Oct 2026 · cfengine.com
Authentication and encryption
Public-key authentication is mandatory; Community uses RSA-2048 authentication with Blowfish transfer encryption, while commercial editions use AES-256 and SHA-256 and cite FIPS 140-2 validation.Read 14 Oct 2026 · docs.cfengine.com
Company profile
LinkedIn lists Northern.tech as a privately held software company founded in 2008, headquartered in Oslo, with 51–200 employees.Read 14 Oct 2026 · linkedin.com
Compliance reporting
Enterprise provides customizable reports for internal and external compliance requirements.Read 14 Oct 2026 · cfengine.com
Configuration management
The system manages files, processes, packages, services, users, storage and other promise types.Read 14 Oct 2026 · docs.cfengine.com
Dashboards
Enterprise dashboards show compliance levels, performance, alerts and customizable shared views.Read 14 Oct 2026 · cfengine.com
Desired-state automation
Administrators describe desired states in CFEngine's policy language and local agents converge systems toward those states.Read 14 Oct 2026 · docs.cfengine.com
Documentation depth
Documentation includes getting-started guides, installation, policy tutorials, promise and function references, web UI material and API references.Read 14 Oct 2026 · docs.cfengine.com
Documentation licensing
CFEngine documentation is published as open source and accepts pull-request corrections.Read 14 Oct 2026 · docs.cfengine.com
Enterprise interface
Enterprise includes the Mission Portal web interface, a reporting hub with SQL database, REST APIs, compliance reports, policy analysis, alerts, inventory reporting, change reporting, file-integrity monitoring and performance monitoring.Read 1 Oct 2026 · cfengine.com
Extensibility
CFEngine Build supplies community and vendor policy modules that can be added through Mission Portal or command-line tools.Read 14 Oct 2026 · docs.cfengine.com
External integrations
Policies can consume JSON, YAML and CSV data and can use generated API data or CMDB exports as inputs.Read 14 Oct 2026 · docs.cfengine.com
Installation method
Community installation guides provide precompiled RPM and DEB packages for Ubuntu, Debian, Red Hat, CentOS and SUSE, plus the cf-remote installer.Read 14 Oct 2026 · docs.cfengine.com
Inventory
Inventory reporting collects detailed information across bare-metal servers, virtual machines, cloud instances and IoT devices.Read 1 Oct 2026 · cfengine.com
Inventory reporting
Enterprise collects infrastructure inventory from bare-metal servers, virtual machines, cloud instances and IoT devices.Read 14 Oct 2026 · cfengine.com
Known issue
The 3.27 documentation records a 3.26.0 Ubuntu hub installation hang when using cf-remote and gives manual-install workarounds.Read 14 Oct 2026 · docs.cfengine.com
Legal maker
CFEngine states that it is developed and maintained by Northern.tech AS.Read 14 Oct 2026 · cfengine.com
Licence
Community Edition is licensed under the GNU General Public License, while Enterprise uses a commercial licence.Read 14 Oct 2026 · cfengine.com
Limit: documentation usability
The same account said CFEngine had extensive documentation but that finding a practical learning path was difficult.Read 14 Oct 2026 · syslog.me
Limit: learning curve
UpGuard identifies CFEngine's specialized language and operating-system nuances as producing a steep learning curve.Read 14 Oct 2026 · upguard.com
Limit: policy gaps
A G2 reviewer reported missing SELinux label handling in file promises and no built-in POSIX group management.Read 14 Oct 2026 · g2.com
Limit: pricing transparency
TrustRadius lists Enterprise pricing as contact-sales, without public figures.Read 14 Oct 2026 · trustradius.com
Modules
CFEngine Build is a catalogue of policies and modules created by CFEngine, partners and the community.Read 1 Oct 2026 · cfengine.com
Platform coverage
Supported platforms include RHEL, Debian, Ubuntu and Windows Server, with tailored support available for OpenBSD, AIX, macOS and Solaris.Read 14 Oct 2026 · cfengine.com
Policy analyzer
The policy analyzer displays real-time information about how individual policy lines perform on managed servers.Read 14 Oct 2026 · cfengine.com
Policy model
Users define desired infrastructure states in CFEngine's domain-specific language, and lightweight agents converge actual states toward them.Read 1 Oct 2026 · docs.cfengine.com
Praise: efficiency
UpGuard describes CFEngine's C implementation as having a smaller memory footprint, faster execution and fewer dependencies than Ruby-based alternatives.Read 14 Oct 2026 · upguard.com
Praise: robustness
An independent sysadmin account characterized CFEngine as secure, robust and theoretically well designed.Read 14 Oct 2026 · syslog.me
Praise: security and interoperability
Gartner reviewers highlighted public-key client identification and integration across Linux, Windows and CVS environments.Read 14 Oct 2026 · gartner.com
Praise: self-healing
A G2 reviewer praised CFEngine for creating infrastructure that can manage everything through self-healing behavior.Read 14 Oct 2026 · g2.com
Rating on G2
4.8 out of 5 from 2 reviewsRead 14 Oct 2026 · g2.com
Rating on Gartner Peer Insights
4.0 out of 5 from 2 reviewsRead 14 Oct 2026 · gartner.com
Rating on TrustRadius
9 out of 10 from 3 reviewsRead 14 Oct 2026 · trustradius.com
Release news
CFEngine 3.27.0 became an LTS release on January 9, 2026 and introduced an infrastructure-querying AI agent in Mission Portal.Read 14 Oct 2026 · cfengine.com
Scale
CFEngine runs on embedded devices, servers, cloud systems and mainframes and handles tens or hundreds of thousands of nodes.Read 1 Oct 2026 · cfengine.com
Security model
Agents retain veto power over policy changes, continue operating during communication failures and use safe default access rules.Read 14 Oct 2026 · docs.cfengine.com
Self-hosting architecture
CFEngine requires an agent on every managed machine and commonly uses a policy server or hub for distribution and aggregation.Read 14 Oct 2026 · docs.cfengine.com
Supported releases
The 3.27 support matrix lists RHEL/CentOS, Debian, Ubuntu and Windows client platforms with x86-64 and selected arm64 packages.Read 14 Oct 2026 · docs.cfengine.com
System requirements
The Enterprise quick-install hub requires a 64-bit recent Linux machine, 2 GB memory and 100 MB disk per connected host.Read 14 Oct 2026 · cfengine.com

Plans and prices

Community Edition Free free to use Linux support · community support · configuration management · autonomous agents Read 14 Oct 2026 · cfengine.com
Enterprise free trial Free no credit card required up to 25 hosts · unrestricted trial features Read 14 Oct 2026 · cfengine.com
Enterprise Edition Priced on request single price per license Windows, AIX, Solaris and HP-UX · Mission Portal · REST APIs · reporting · alerts · dashboards · technical support Read 14 Oct 2026 · cfengine.com

Every CFEngine plan and price →

Strong points and limits

Strong points

  • Agents check configuration compliance every five minutes by default
  • Designed to handle tens or hundreds of thousands of nodes
  • Enterprise includes compliance and inventory reporting
  • Enterprise is free for up to 25 hosts

Limits

  • Community Edition supports Linux only
  • Enterprise pricing beyond 25 hosts is on request
  • Community Edition includes community support

Who it suits

CFEngine suits teams managing infrastructure across devices or large node fleets that want policy-based configuration and compliance reporting. Enterprise may fit organizations that need reporting, monitoring, and dedicated support.

CFEngine in depth

Read the full write-up

Overview

CFEngine’s central bet is continuous convergence: policies describe the state infrastructure should maintain, and lightweight agents on managed devices work toward it. Its self-hosted, agent-based design is a strong fit for teams responsible for large, mixed fleets; the main trade-off is that Enterprise pricing requires a request once a deployment exceeds its free allowance.

CFEngine dates to 2008 and is headquartered in Oslo. Agents connect to the hub every five minutes by default, checking configuration compliance on a recurring schedule. The stated scale spans embedded devices, servers, cloud systems and mainframes, including fleets of tens or hundreds of thousands of nodes.

Key features

Policy-driven convergence

Teams define desired infrastructure states in CFEngine’s domain-specific language, then rely on agents to bring actual states into line. Drift detection, patch management and policy as code support ongoing configuration control rather than one-off changes. The five-minute default hub interval gives teams a regular compliance check, but it should not be mistaken for immediate, event-driven enforcement.

Enterprise visibility and control

Enterprise adds the Mission Portal, a web interface backed by a reporting hub and SQL database. It brings compliance reports, policy analysis, alerts, inventory and change reporting, file-integrity monitoring and performance monitoring into one operational surface. Dashboards show real-time compliance levels, allow custom alerts and actions, and can be customized and shared. Inventory reporting covers bare-metal servers, virtual machines, cloud instances and IoT devices.

Enterprise also provides REST APIs; SQL can be used to build custom reports from data in globally distributed CFEngine database servers. Secure bootstrap uses mutual authentication, key exchange and TLS-encrypted communication. A dedicated support team can advise on best practices and prioritize requested feature development. CFEngine Build supplies a catalogue of policies and modules from CFEngine, partners and the community.

Pricing

CFEngine uses a freemium model, with a free plan and Enterprise pricing on request. The free Community Edition costs nothing and is licensed under GNU GPL. It includes Linux support and community support, making it the straightforward choice for teams that can operate within those terms and do not need Enterprise’s interface and reporting package.

Enterprise Edition has no published price; the first 25 hosts are free, and the license uses a single price with no add-on or extra-functionality costs. That structure makes the entry point clear for a small deployment, but organizations planning beyond 25 hosts need a quote to assess total cost.

Platforms

CFEngine is self-hosted, with an agent running on each managed device and a hub for coordination. Supported platforms include Linux distributions RHEL, Debian and Ubuntu, plus Windows. The broader platform footprint also includes macOS, web and API; the Community Edition specifically has Linux support. The architecture’s reach across embedded devices, servers, cloud systems and mainframes is a notable advantage for heterogeneous fleets.

Who it's for

CFEngine is best suited to infrastructure and security teams that want policy-defined configuration enforcement, compliance capabilities and control over a self-hosted system, especially at large scale. Community Edition is a practical starting point for Linux environments with community support. Teams that need Enterprise reporting, dedicated support or broader operational visibility should evaluate Enterprise, while those unwilling to request pricing for deployments beyond 25 hosts should compare alternatives.

Pros and cons

Pros: Agent-based convergence and a five-minute default compliance check support continuous enforcement across large fleets.

Pros: Enterprise bundles dashboards, compliance and inventory reporting, monitoring, REST APIs and dedicated support rather than charging extra for add-ons.

Pros: The free Community Edition is GNU GPL-licensed and includes Linux support.

Cons: Community Edition is Linux-focused and relies on community support, so it is a narrower fit for teams needing broader platform coverage or dedicated help.

Cons: Enterprise costs beyond the first 25 hosts require a quote, making larger-deployment budgeting less direct.

Cons: The recurring five-minute default check may not suit teams seeking immediate event-driven enforcement.

Alternatives

Rudder is worth comparing for teams seeking a freemium option with downloadable, modifiable source code under its open source licenses and support for Linux, Windows, web and API.

Salt is a free alternative with an Apache 2.0-licensed open-source plan and support for Linux, macOS, Windows, self-hosted deployments and API.

Puppet is another freemium choice; its Enterprise plan has 10 nodes free, while Enterprise Advanced and paid Enterprise use custom pricing.

Chef Infra is a free alternative with a paid Business plan at $59 a year, billed per node, per year.

OpenDSC is a free option supporting API, Linux, macOS, self-hosted, web and Windows.

OpenVox is a free, community-maintained alternative that supports agent/server or standalone use.

config.XO may suit very small deployments: its free plan is forever and caps usage at one workspace, one admin user, one cloud connection, one hypervisor, three managed systems and one API key.

Uyuni is a free open-source configuration and infrastructure management option for Linux and self-hosted environments; hardware requirements depend on deployment and channel requirements.

For broader comparisons, see Configuration Management Tools, IT Configuration Management Software and IT Automation Software.

Verdict

Choose CFEngine if your team wants self-hosted, policy-driven convergence for a large or varied fleet, with a free Linux entry tier and a substantial Enterprise reporting and support layer. Look elsewhere if you need transparent pricing beyond 25 Enterprise hosts or a free edition with broader stated platform support.

Verdict

CFEngine centers on policy-defined infrastructure states and agent-based convergence. Community Edition has a clear free tier; organizations needing Enterprise should request pricing beyond the first 25 hosts.

Where Specifiction places it

Alternatives to CFEngineAll alternatives →