KICS vs Molecule
KICS
kics.ioMolecule
docs.ansible.comSide by side
| Figure | KICS | Molecule |
|---|---|---|
| Price from | Free | — |
| Free plan | Yes | — |
| Free trial | — | — |
| Open source | — | — |
| Windows | Yes | — |
| macOS | Yes | — |
| Linux | Yes | Yes |
| Self-hosted | Yes | — |
| Plans published | 1 | 0 |
| Spec score · Infrastructure Testing Tools | 7.9 (#12) | 7.1 (#23) |
| CI integrations | Documented integrations include Azure Pipelines, Bamboo, Bitbucket Pipelines, CircleCI, Codefresh, GitHub Actions, GitLab CI, Jenkins, TeamCity, Travis, Terraform Cloud, AWS CodeBuild, pre-commit hooks, and AWS CDK. | The documentation provides continuous integration examples for GitHub Actions, Travis CI, GitLab CI, Azure Pipelines, Jenkins Pipeline, and Tox. |
| Founded | 2006 | 2015 |
| Installation | KICS can be run as a Docker image or built from source; its documentation also provides downloadable releases for Linux, Windows, and macOS. | The documentation names pip as the only supported installation method and recommends installing Molecule through the ansible-dev-tools package. |
| Purpose | KICS is an open-source static code analysis solution that finds security vulnerabilities, compliance issues, and infrastructure misconfigurations in Infrastructure as Code. | Molecule is an Ansible testing framework for developing and testing collections, playbooks, and roles. |
| Support | The KICS core team can be contacted at [email protected], and the site points users to GitHub Discussions. | The project directs users to the Ansible community forum for questions and help, and says possible security bugs can be reported to [email protected]. |
Plans
In their own words
KICS
KICS is a free, open-source static analysis solution powered by Checkmarx. It scans Infrastructure as Code for security vulnerabilities, compliance issues, and configuration mistakes across Terraform, Kubernetes, Docker, AWS CloudFormation, Ansible, Helm, Google Deployment Manager, AWS SAM, Microsoft ARM, Azure Blueprints, OpenAPI, Pulumi, Crossplane, Knative, and Serverless Framework files. Its security queries can be edited, extended, or supplemented with new queries, using OPA Rego policy language. Documented CI and delivery integrations include GitHub Actions, GitLab CI, Jenkins, Azure Pipelines, CircleCI, Bitbucket Pipelines, Terraform Cloud, AWS CodeBuild, pre-commit hooks, and others. A Visual Studio Code extension can scan automatically. KICS runs as a Docker image, from source, or through downloadable Linux, Windows, and macOS releases. Reports can be exported as JSON, SARIF, GitLab SAST, JUnit, HTML, PDF, CycloneDX, ASFF, or CSV. Terraform functions and environment variables are unsupported, and unofficial or custom Terraform modules are not supported.
Molecule
Molecule has no write-up on Specifiction yet; its figures are above.