Infection

Overview

Infection is a PHP mutation-testing library that shows which changes a test suite fails to detect. It creates mutants using predefined operators, runs tests against changed code, and records killed and escaped mutants, errors, and timeouts. Its Mutation Score Indicator measures the share of generated mutations detected by tests; it also reports Mutation Code Coverage and Covered Code Mutation Score Indicator. Infection supports PHPUnit, PhpSpec, Codeception, and Testo, and runs from the command line at a project root. Teams can run mutated tests in parallel, focus analysis on touched lines or files, and set minimum mutation-score thresholds that fail a build. The homepage describes more than 100 mutators grouped into profiles and allows custom mutators. Optional PHPStan and Mago integrations can help catch escaped mutants involving type violations, dead code, and unreachable paths. Installation options include PHAR, Phive, Composer, Git, and Homebrew. A browser playground supports trying PHP code and tests without installing the tools. Infection is free under the BSD-3-Clause license and requires PHP 8.3 or newer plus Xdebug, phpdbg, or pcov.

Who it is for

Infection suits PHP teams who want to measure whether their tests catch code changes and use mutation scores as a build gate. Its changed-code mode and support for several PHP test frameworks may fit established projects.

Compared on mutation testing tools

Free plan

Yesinfection.github.io

Supported languages

PHPinfection.github.io

Test frameworks

PHPUnit, PhpSpec, Codeception, Testoinfection.github.io

Incremental analysis

Yesinfection.github.io

Parallel execution

Yesinfection.github.io

Surviving mutant reports

Yesinfection.github.io

Mutation quality gate

Yesinfection.github.io

Mutation operators

Arithmetic, boolean, cast, conditional boundary, conditional negotiation, equality, function signature, nullify, number, operator, regex, removal, return value, visibility, and unwrap mutatorsinfection.github.io

Facts

Purpose

Infection mutates PHP source code and reports which changes a test suite fails to catch.infection.github.io · 30 Sept 2026

Testing method

It is a PHP mutation-testing library based on abstract-syntax-tree mutations and runs as a CLI tool from a project root.infection.github.io · 30 Sept 2026

Runtime requirements

The current documentation requires PHP 8.3 or newer and Xdebug, phpdbg or pcov.infection.github.io · 30 Sept 2026

Mutation metrics

Infection provides Mutation Score Indicator, Mutation Code Coverage and Covered Code Mutation Score Indicator metrics.infection.github.io · 30 Sept 2026

CI thresholds

The --min-msi and --min-covered-msi options can fail a build when configured mutation scores are not reached.infection.github.io · 30 Sept 2026

Changed-code mode

The --git-diff-lines option mutates only touched lines, and --git-diff-filter can restrict mutation to changed files.infection.github.io · 30 Sept 2026

Mutators

The homepage describes more than 100 mutators grouped into profiles, plus custom mutator support.infection.github.io · 30 Sept 2026

Static analysis

Infection supports optional PHPStan and Mago integrations to catch escaped mutants involving type violations, dead code and unreachable paths.infection.github.io · 30 Sept 2026

Cloud reporting

Infection can send mutation badges and HTML reports to Stryker Dashboard using a project API key.infection.github.io · 30 Sept 2026

Distribution

The recommended PHAR distribution bundles PHPUnit, PhpSpec, Codeception and Testo, and the PHAR signature can be verified with the documented GPG key.infection.github.io · 30 Sept 2026

License

The project is released under the BSD-3-Clause license.infection.github.io · 30 Sept 2026

Security policy

Only the latest Infection version is supported under its security policy, although older versions may be patched depending on vulnerability severity; vulnerabilities should be reported privately on GitHub.github.com · 30 Sept 2026

Community support

The project links to Discord and GitHub Discussions for community help and states that it welcomes pull requests and issues.github.com · 30 Sept 2026

How it works

It creates mutants using predefined mutation operators, runs tests covering changed lines, and records killed or escaped mutants, errors, and timeouts.infection.github.io · 2 Oct 2026

Mutation score

It reports a Mutation Score Indicator (MSI) that measures the percentage of generated mutations detected by the tests.infection.github.io · 2 Oct 2026

CI reports

Infection can emit GitHub annotations and GitLab Code Quality reports, and can publish mutation badges and HTML reports through Stryker Dashboard.infection.github.io · 2 Oct 2026

Installation

The maker documents PHAR, Phive, Composer, Git, and Homebrew installation methods.infection.github.io · 2 Oct 2026

Security

The maker says its PHAR distribution is signed with a GPG key and documents how to verify the signature and fingerprint.infection.github.io · 2 Oct 2026

Browser playground

The Infection Playground lets users write PHP code and tests in a browser and run mutation testing without installing Composer, Infection, or PHPUnit.infection.github.io · 2 Oct 2026

Caveat

The command-line guide warns that parallel runs can produce false positives when tests depend on one another or use a database.infection.github.io · 2 Oct 2026

Where it ranks on Specifiction

• Best Mutation Testing Tools in 2026#2 of 25

Sources

• infection.github.io· checked 30 Sept 2026
• infection.github.io/guide/· checked 30 Sept 2026
• infection.github.io/guide/using-with-ci.html· checked 30 Sept 2026
• infection.github.io/guide/how-to.html· checked 30 Sept 2026
• infection.github.io/guide/static-analysis-integration.html· checked 30 Sept 2026
• infection.github.io/guide/mutation-badge.html· checked 30 Sept 2026
• infection.github.io/guide/installation.html· checked 30 Sept 2026
• github.com/infection/infection/blob/master/SECURIT· checked 30 Sept 2026
• github.com/infection/infection· checked 30 Sept 2026
• infection.github.io/guide/command-line-options.html· checked 2 Oct 2026
• infection.github.io/guide/infection-playground.html· checked 2 Oct 2026