Infection

Free plan LinuxMacWeb

What Infection is

Infection is a PHP mutation-testing tool that checks whether a test suite detects deliberate changes to source code. It creates mutations using predefined operators, runs tests covering changed lines, and records which mutations tests catch, which survive, and any errors or timeouts. Its Mutation Score Indicator measures the share of generated mutations detected by tests; it also reports Mutation Code Coverage and Covered Code Mutation Score Indicator. Infection supports PHPUnit, PhpSpec, Codeception, and Testo, and runs from a project root as a command-line tool. Teams can run mutated tests in parallel, focus on changed lines or files, and set minimum score thresholds that can fail a build. Optional PHPStan and Mago integrations help identify escaped mutations involving type violations, dead code, or unreachable paths. A browser playground lets users try PHP code and tests without installing the toolchain. Infection requires PHP 8.3 or newer and Xdebug, phpdbg, or pcov. It is free and released under the BSD-3-Clause license.

Who it suits

Infection suits PHP developers who want to assess whether their tests catch code changes, including teams enforcing mutation-score thresholds in CI. The browser playground may suit people exploring mutation testing without installing the tools.

What it does well

Works with PHPUnit, PhpSpec, Codeception, and Testo.
Can focus mutations on changed lines or files.
Minimum mutation scores can fail a build.
Browser playground runs PHP mutation tests without installation.

What to know first

Requires PHP 8.3 or newer.
Requires Xdebug, phpdbg, or pcov.
Parallel runs may give false positives for interdependent or database tests.
Only the latest version is covered by the security policy.

Limits

The documentation requires PHP 8.3 or newer and Xdebug, phpdbg, or pcov. Parallel runs may produce false positives when tests rely on one another or use a database.

Getting started

Open the Infection website or use the browser playground to try PHP code and tests.
For local command-line use, choose a documented installation route: PHAR, Phive, Composer, Git, or Homebrew.
Meet the documented runtime requirements: PHP 8.3 or newer and Xdebug, phpdbg, or pcov.
Run Infection from the project root with a supported test framework.
Configure thread count, changed-code options, score thresholds, or CI reporting as needed.

Verdict

Infection offers a range of mutation metrics and controls for targeting changes or setting build thresholds. Check the PHP and coverage-driver requirements, and use care with parallel runs when tests depend on one another or a database.

Questions

How much does Infection cost?

Infection is free, with a free plan.

Which platforms does Infection support?

Its listed platforms are Linux, macOS, and web. The command-line tool runs from a project root, and the Infection Playground runs in a browser.

Which test frameworks work with Infection?

It supports PHPUnit, PhpSpec, Codeception, and Testo.

What does Infection measure?

It reports Mutation Score Indicator, Mutation Code Coverage, and Covered Code Mutation Score Indicator. MSI measures the share of generated mutations detected by tests.

What runtime does Infection require?

The current documentation requires PHP 8.3 or newer and Xdebug, phpdbg, or pcov.

What license does Infection use?

The project is released under the BSD-3-Clause license.

Facts from Infection's own pages

Browser playground: The Infection Playground lets users write PHP code and tests in a browser and run mutation testing without installing Composer, Infection, or PHPUnit. · infection.github.io, 2 Oct 2026
Caveat: The command-line guide warns that parallel runs can produce false positives when tests depend on one another or use a database. · infection.github.io, 2 Oct 2026
Changed-code mode: The --git-diff-lines option mutates only touched lines, and --git-diff-filter can restrict mutation to changed files. · infection.github.io, 30 Sept 2026
CI reports: Infection can emit GitHub annotations and GitLab Code Quality reports, and can publish mutation badges and HTML reports through Stryker Dashboard. · infection.github.io, 2 Oct 2026
CI thresholds: The --min-msi and --min-covered-msi options can fail a build when the configured mutation-score threshold is not met. · infection.github.io, 2 Oct 2026
Cloud reporting: Infection can send mutation badges and HTML reports to Stryker Dashboard using a project API key. · infection.github.io, 30 Sept 2026
Community support: The project links to Discord and GitHub Discussions for community help and states that it welcomes pull requests and issues. · github.com, 30 Sept 2026
Distribution: The recommended PHAR distribution bundles PHPUnit, PhpSpec, Codeception and Testo, and the PHAR signature can be verified with the documented GPG key. · infection.github.io, 30 Sept 2026
How it works: It creates mutants using predefined mutation operators, runs tests covering changed lines, and records killed or escaped mutants, errors, and timeouts. · infection.github.io, 2 Oct 2026
Installation: The maker documents PHAR, Phive, Composer, Git, and Homebrew installation methods. · infection.github.io, 2 Oct 2026
License: The project is released under the BSD-3-Clause License. · infection.github.io, 2 Oct 2026
Mutation metrics: Infection provides Mutation Score Indicator, Mutation Code Coverage and Covered Code Mutation Score Indicator metrics. · infection.github.io, 30 Sept 2026
Mutation score: It reports a Mutation Score Indicator (MSI) that measures the percentage of generated mutations detected by the tests. · infection.github.io, 2 Oct 2026
Mutators: The homepage describes more than 100 mutators, grouped into profiles, and support for custom mutators. · infection.github.io, 2 Oct 2026
Parallel execution: Tests for mutated code can run in parallel with the --threads option, including automatic CPU-core detection with --threads=max. · infection.github.io, 30 Sept 2026
Purpose: Infection mutates PHP source code and reports changes that a test suite fails to catch. · infection.github.io, 2 Oct 2026
Runtime requirements: The current guide says Infection requires PHP 8.3 or later and Xdebug, phpdbg, or pcov installed. · infection.github.io, 2 Oct 2026
Security: The maker says its PHAR distribution is signed with a GPG key and documents how to verify the signature and fingerprint. · infection.github.io, 2 Oct 2026
Security policy: Only the latest Infection version is supported under its security policy, although older versions may be patched depending on vulnerability severity; vulnerabilities should be reported privately on GitHub. · github.com, 30 Sept 2026
Static analysis: The documentation describes integration with PHPStan, Psalm, and other static analysis tools. · infection.github.io, 2 Oct 2026
Test frameworks: It supports PHPUnit, PhpSpec, Codeception, and Testo. · infection.github.io, 2 Oct 2026
Testing method: It is a PHP mutation-testing library based on abstract-syntax-tree mutations and runs as a CLI tool from a project root. · infection.github.io, 30 Sept 2026

Where Infection stands on Freedom251

Mutation Testing Tools#6 of 25