Infection

Infection is a PHP mutation-testing tool for developers who want to assess whether tests catch plausible code changes. It suits PHP teams using supported test frameworks and CI; its strongest case is pairing focused mutation runs with score-based build gates.

Overview

Run from a project root, Infection applies abstract-syntax-tree mutations to PHP and runs tests against the altered code. It records mutants as killed, escaped, errored, or timed out, giving teams a way to find tests that execute code without detecting changes to it. The Mutation Score Indicator measures the percentage of generated mutations detected by tests, while Mutation Code Coverage and Covered Code Mutation Score Indicator add coverage-aware measures.

Key features

Mutation analysis and CI

More than 100 mutators are grouped into profiles, and custom mutators are supported. The range of operators—from arithmetic and conditional changes to visibility and return-value changes—lets teams probe different kinds of test weakness. Optional PHPStan and Mago integrations can catch escaped mutants involving type violations, dead code, and unreachable paths. This adds useful analysis, though it means teams need to decide whether those integrations fit their existing tooling.

The --min-msi and --min-covered-msi options can fail a build when scores miss configured thresholds. GitHub annotations and GitLab Code Quality reports help surface results in CI, while Stryker Dashboard can host mutation badges and HTML reports using a project API key. These controls suit teams that want test quality to influence merge decisions; a score is still a policy signal, not a complete judgment of test quality.

Focused runs and parallel execution

The --git-diff-lines option targets touched lines, and --git-diff-filter can narrow analysis to changed files. That makes incremental analysis more practical when a full mutation run is too costly for each change. The --threads option runs tests for mutated code in parallel, with --threads=max detecting CPU cores automatically. But parallel execution can misreport results when tests depend on one another or use a database, so shared-state suites should not enable it casually.

Installation and learning

Installation options include PHAR, Phive, Composer, Git, and Homebrew. The recommended PHAR bundles PHPUnit, PhpSpec, Codeception, and Testo, and its signature can be checked against the documented GPG key. A browser playground lets developers try PHP code and tests without installing Composer, Infection, or PHPUnit. That lowers the barrier to evaluating mutation testing, although it is not a substitute for integrating the CLI into a project.

Pricing

Infection is free, with no paid plan or seat limit stated. Its BSD-3-Clause license is a fit for teams that want an open-source tool rather than a managed paid product. The trade-off is that teams configure and run the CLI themselves; cloud reporting through Stryker Dashboard requires a project API key.

Platforms

Infection supports Linux, macOS, and the web playground. It targets PHP and currently requires PHP 8.3 or newer plus Xdebug, phpdbg, or pcov. Its supported test frameworks are PHPUnit, PhpSpec, Codeception, and Testo, so projects outside that combination should check framework compatibility before committing to it.

Who it's for

Infection is best for PHP developers who want evidence that tests detect behavioral changes, especially teams that need incremental analysis or mutation-score gates in CI. Its security policy supports only the latest version, though older releases may be patched depending on vulnerability severity. Community help is available through Discord and GitHub Discussions, and the project welcomes issues and pull requests. Teams tied to older PHP runtimes, unsupported test frameworks, or stateful suites that rely on parallel execution should weigh those constraints first.

Pros and cons

Pros: Mutation scores, coverage-aware metrics, and configurable CI thresholds make test effectiveness measurable and enforceable.

Pros: Changed-line and changed-file options help limit analysis to current work, while broad mutator profiles and custom mutators offer flexibility.

Pros: The free BSD-3-Clause license, multiple installation routes, and browser playground make it accessible to teams at different stages.

Cons: PHP 8.3 or newer and a supported coverage driver are required, ruling out projects that cannot meet those runtime needs.

Cons: Parallel runs can give false positives with interdependent or database-backed tests, limiting the safety of automatic concurrency.

Cons: Only the latest version is covered by the security policy, which makes staying current important.

Alternatives

ArcMutate is worth comparing for teams seeking a freemium option with Linux, macOS, self-hosted, and Windows support; its open-source plan is free for open-source projects, while its Base plan is $8 a month. Mutant is another freemium choice for Linux and macOS: it is free with a full feature set for public repositories, while commercial monthly pricing is $30. For Python projects, Mutatest is a free, open-source option for Linux, macOS, and Windows; pytest-gremlins is a Linux option requiring Python 3.11 or newer.

pymute is a free Linux alternative that installs with Rust and Cargo. mutmut, PIT, and Gambit are also free alternatives, with Linux and macOS support for mutmut and broader listed platform support for PIT and Gambit. Browse Mutation Testing Tools for more options.

Verdict

Choose Infection if you maintain a PHP project on a supported runtime and want mutation metrics, focused analysis, and CI gates without a license cost. Its clearest advantage is the combination of configurable scoring and incremental runs; look elsewhere if your PHP runtime or test framework is incompatible, or if reliable parallel execution is essential for a stateful suite.