Skip to content

Declare the state. Verify against the machines.

refpoint executes declarative controls against machines over SSH, WinRM, or locally, and writes a report you can file as evidence. Controls are HCL data, not code that runs on your workstation. It reads and never changes anything.

Get startedRead the concepts

One static binary. Linux and macOS on amd64 and arm64. Windows on amd64.

admin@web-01 — refpoint
$ refpoint run ./linux-baseline -t admin@web-01Target: admin@web-01  ·  Linux Security Baseline v0.1.0  ✓  [ssh-01]  SSH root login is disabled  impact: 0.9    ✓  root-login[sshd_config: PermitRootLogin]   ✓  [usr-04]  Password hashing is SHA-512  impact: 0.9    ✓  pam-sha512[command: hash-algorithm]   ✗  [fs-01]  /tmp mounted noexec,nosuid,nodev  impact: 0.8    ✗  tmp-noexec[mount: /tmp]       ✗ option[noexec]: got "rw,nosuid,nodev", want "noexec" SummaryLinux Security Baseline  v0.1.0  ✗  admin@web-01   69.2%  2/3 controls passed · 1 failedAverage compliance score: 69.2%

One profile, every target, a score you can act on.

Impact-weighted scoring
Every control carries an impact from 0.0 to 1.0, so one critical failure outweighs nine trivial passes. Gate CI on the threshold you set.
control "ssh-01" {
  title  = "SSH root login is disabled"
  impact = 0.9
}
Exceptions with an expiry
Waive a control with a justification and an expiry date. Waived controls leave the score untouched and lapse on their own.
waiver "ssh-02" {
  justification = "Replacement scheduled Q3."
  expiration    = "2026-12-31"
}
Profiles that compose
A profile can depend on others and take every control or only the ones a pattern selects, so a company baseline and a team overlay stay separate files.
dependency {
  path    = "../shared/baseline"
  include = ["^ssh-", "^audit-"]
}
An inventory for the fleet
Describe hosts in one HCL file, with SSH keys and known-hosts files applied per environment, and scan them in parallel.
target "admin@web-01.example.com" {
  tags = { env = "prod", role = "web" }
}
Drift between two runs
Compare a saved result with last week's and fail only on regressions, so a pipeline gates on what got worse rather than on absolute state.
refpoint diff baseline.json current.json \
  --fail-on-regression
Exit codes CI can read
An unreachable target is a broken run, not a fleet to fix, and it gets its own code.
0  every target compliant
1  a control failed
2  a target unreachable or a control errored
5  a target below --threshold

First scan in three commands.

  1. 01

    Install the binary

    Download the release archive for your platform. One static binary, no daemon, no runtime on the runner.

    tar -xzf refpoint_linux_amd64.tar.gz
install -m 0755 refpoint /usr/local/bin/
  2. 02

    Scaffold a profile

    Writes profile.rpp and controls/example.rpc, ready for you to edit.

    refpoint init my-baseline
  3. 03

    Run it

    Scans the local machine and prints a scored report.

    refpoint run ./my-baseline

Read the getting started guide for the full walkthrough, including the saved JSON result.

Safe to point at production.

refpoint connects with the credentials you give it, reads facts, and writes nothing on the target. Both directions are treated as untrusted: the profile that says what to run, and the machine that answers.

Read the security model
Reads, never changes
Every resource reads one fact: a file, a service, a package, a port. Nothing on the target is created, modified, or removed.
Commands are deny by default
The command resource refuses any executable unless both your ceiling and the profile's own allowlist permit it. A refusal names the gate that closed.
Host keys are checked
SSH host keys are verified against known_hosts and a changed key is refused. WinRM over plain HTTP without sealing is refused too.
Every operation is logged
The audit log records what ran, where, for which control, and whether it succeeded. It holds no command output, so it holds no secrets, and its hash is sealed into the report.

Every control ends in one state.

Passed and failed describe the machine. Error, skipped, and waived describe the run. They are never merged: an unreachable target is counted on its own and exits with its own code, so a scan that could not see a machine never reads as clean.

passed
Every assertion held.
failed
At least one assertion did not hold.
error
Could not be evaluated: unreachable target, blocked command, or unreadable output.
skipped
Not evaluated on purpose: a precondition was not met.
waived
An accepted exception applied, with a reason and an expiry.

Reports are bound to their contents.

Evidence, not screenshots. Every report format except the terminal carries an attestation: a SHA-256 over the report body, an Ed25519 signature when you supply a key, and the hash of the audit log that records every operation on every target.

The run's scope sits inside the signed body, so a narrowed run cannot be presented as a complete one, and a report cannot be re-labelled or re-dated without breaking verification. Months later,refpoint verifystill tells you whether the file you filed is the file that was produced.

Attested formatsjsonjunithtmlghagitlab
Read about evidence and attestation
report.json
{
  "report": { ... },
  "attestation": {
    "v": "1.1",
    "sha256": "1d82da1ac56d3379330595df889ea6bd3992bc001fb09156b87492418b189505",
    "audit_log_sha256": "14e1d8555d2e2d311f16ea1bb1e5b10d2a889c69bf05ddc26e046bcf5db8af05",
    "run_id": "a26316dfaba5f6cd6af6fd70d39fed4e96d0bf7498a2bebaab419cd800fa3ebd",
    "created": "2026-09-20T07:07:08Z",
    "key_id": "f2a22cfa9990cb47",
    "sig": "igzYTOQMxjgFgNQbQH8NRO5ooNMUM3tqiX6VQlPMODVT56p/JttzxYlTOUfgzEnU239vHIbQ3c8RKn1ccKnlCg=="
  }
}

Read it in order, or jump in.

20 pages in reading order. Every page has a Markdown twin and the whole set is indexed in llms.txt, so a model reads the same text you do.

Run it on a test host.

One binary, one profile, one machine. The report is yours to keep, and so is the proof.

Get startedInstall
refpoint init my-baseline
refpoint run ./my-baseline -t admin@test-01 --reporter json:result.json
refpoint verify result.json