Skip to content
SPECIFICTION
Get listed

Checkov

checkov.io

Free plan macOSLinux
Visit checkov.io
Spec score 8.0 #10 of 28 in Infrastructure Testing Tools

What it is

Checkov is a free tool for scanning infrastructure-as-code files for configuration problems that could affect security or compliance. Its documented targets include Terraform, CloudFormation, ARM, Serverless, Helm, Kubernetes, and Docker. The policy library contains more than 750 predefined checks, including checks for standards such as CIS and the AWS Foundations Benchmark. Checkov can also identify common credentials in IaC files, including AWS access keys, Azure service credentials, and private keys. Teams can create custom attribute policies in Python or YAML and composite policies in YAML. Documented continuous-integration integrations include Jenkins, Bitbucket Cloud Pipelines, GitHub Actions, and GitLab CI. Add-ons for Visual Studio Code and JetBrains provide real-time scanning and inline fixes. Installation is documented through pip and Homebrew, with Homebrew specified for macOS or Linux. The project supports Python 3.9 through 3.13 and is distributed under the Apache-2.0 license. Prisma Cloud extends Checkov with runtime scanning, visibility, native VCS integrations, drift detection, and pull request annotations. Alpine is not officially tested or supported; it requires Python 3.11 or later.

Spec sheet

Purpose
Checkov scans infrastructure-as-code files for misconfigurations that can cause security or compliance problems.Read 29 Sep 2026 · checkov.io
Compliance
Checkov scans for common standards including CIS and the AWS Foundations Benchmark.Read 29 Sep 2026 · checkov.io
Support
The project directs users to its documentation for tutorials and examples and identifies Prisma Cloud as the maintainer.Read 29 Sep 2026 · github.com
License
The Checkov GitHub repository identifies its license as Apache-2.0.Read 29 Sep 2026 · github.com
CI integrations
The documentation describes integrations with Jenkins, Bitbucket Cloud Pipelines, GitHub Actions, and GitLab CI.Read 29 Sep 2026 · checkov.io
Custom policies
Users can create custom attribute policies in Python or YAML and composite policies in YAML.Read 29 Sep 2026 · checkov.io
Developer tools
Checkov offers Visual Studio Code and JetBrains add-ons for real-time IaC scanning and inline fixes.Read 29 Sep 2026 · checkov.io
Installation
The project documents installation through pip and Homebrew; Homebrew is specified for macOS or Linux.Read 29 Sep 2026 · checkov.io
Platform limitation
Checkov on Alpine requires Python 3.11 or later and is not officially tested or supported.Read 29 Sep 2026 · checkov.io
Policy library
The Checkov documentation says it includes more than 750 predefined policies.Read 29 Sep 2026 · checkov.io
Prisma Cloud
Prisma Cloud extends Checkov with runtime scanning, visibility, native VCS integrations, drift detection, and pull request annotations.Read 29 Sep 2026 · checkov.io
Python support
The repository says it supports Python 3.9 through 3.13 inclusive.Read 29 Sep 2026 · github.com
Secrets scanning
Checkov can detect common credentials such as AWS access keys, Azure service credentials, and private keys in IaC files.Read 29 Sep 2026 · checkov.io
Supported IaC
Documented scan targets include Terraform, CloudFormation, ARM, Serverless, Helm, Kubernetes, and Docker.Read 29 Sep 2026 · checkov.io

Plans and prices

Checkov Free Open-source CLI · Apache-2.0 license Read 29 Sep 2026 · github.com

Every Checkov plan and price →

Strong points and limits

Strong points

  • Scans seven documented infrastructure-as-code targets.
  • Includes more than 750 predefined policies.
  • Detects common cloud credentials in IaC files.
  • Offers CI integrations and IDE add-ons.
  • Free CLI under the Apache-2.0 license.

Limits

  • Alpine is not officially tested or supported.
  • Alpine requires Python 3.11 or later.
  • Prisma Cloud is required for listed extended capabilities.

Who it suits

Checkov suits developers and teams scanning infrastructure-as-code for configuration risks, credentials, or compliance checks. It may also fit teams that want CI or IDE integrations and can use supported environments.

Verdict

Checkov brings predefined and custom policies, credential detection, and workflow integrations to infrastructure-as-code scanning. Its Alpine support is limited, while runtime scanning and other extensions are listed as Prisma Cloud capabilities.

Where Specifiction places it

Alternatives to CheckovAll alternatives →