Infection

Visit site Alternatives

Score5.9

Rank#5 of 25

Free planNo

Runs onLinux, macOS, Web

Summary

Infection is a free PHP mutation-testing library that checks whether a test suite catches changes to source code. It creates altered versions of code, runs tests that cover the changed lines, and records detected and surviving mutations, errors, and timeouts. Its Mutation Score Indicator measures the share of generated mutations detected by tests; it also reports Mutation Code Coverage and Covered Code Mutation Score Indicator. Infection runs from a project root as a CLI tool and supports PHPUnit, PhpSpec, Codeception, and Testo. Teams can run mutated tests in parallel, limit analysis to changed lines or files, and configure minimum scores that fail a build. The project describes more than 100 mutators, supports custom mutators, and offers optional PHPStan and Mago integrations. A browser playground lets users run mutation testing on PHP code and tests without installing the tools locally. Current documentation requires PHP 8.3 or newer and Xdebug, phpdbg, or pcov. Installation methods include PHAR, Phive, Composer, Git, and Homebrew. It is released under the BSD-3-Clause license.

Who it is for

Infection suits PHP developers who want to assess whether tests detect code changes, including teams using one of its supported test frameworks. Its changed-code modes and score thresholds may be useful for incremental analysis and build checks.

What is good

Supports PHPUnit, PhpSpec, Codeception, and Testo.
Can restrict mutation analysis to changed lines or files.
Score thresholds can fail a build.
Includes a browser playground for PHP mutation testing.
Available through several installation methods.

What to know first

Requires PHP 8.3 or newer.
Requires Xdebug, phpdbg, or pcov.
Parallel runs may give false positives with dependent or database-using tests.
Security support focuses on the latest version.

Verdict

Infection offers several ways to focus and measure mutation testing in PHP projects, including changed-code analysis and build thresholds. Check its runtime requirements and parallel-run caveat before adopting it.

Compared on mutation testing tools

Free plan: Yesinfection.github.io
Supported languages: PHPinfection.github.io
Test frameworks: PHPUnit, PhpSpec, Codeception, Testoinfection.github.io
Incremental analysis: Yesinfection.github.io
Parallel execution: Yesinfection.github.io
Surviving mutant reports: Yesinfection.github.io
Mutation quality gate: Yesinfection.github.io
Mutation operators: Arithmetic, boolean, cast, conditional boundary, conditional negotiation, equality, function signature, nullify, number, operator, regex, removal, return value, visibility, and unwrap mutatorsinfection.github.io

Facts

Purpose: Infection mutates PHP source code and reports which changes a test suite fails to catch.infection.github.io · 30 Sept 2026
Testing method: It is a PHP mutation-testing library based on abstract-syntax-tree mutations and runs as a CLI tool from a project root.infection.github.io · 30 Sept 2026
Runtime requirements: The current documentation requires PHP 8.3 or newer and Xdebug, phpdbg or pcov.infection.github.io · 30 Sept 2026
Mutation metrics: Infection provides Mutation Score Indicator, Mutation Code Coverage and Covered Code Mutation Score Indicator metrics.infection.github.io · 30 Sept 2026
CI thresholds: The --min-msi and --min-covered-msi options can fail a build when configured mutation scores are not reached.infection.github.io · 30 Sept 2026
Changed-code mode: The --git-diff-lines option mutates only touched lines, and --git-diff-filter can restrict mutation to changed files.infection.github.io · 30 Sept 2026
Mutators: The homepage describes more than 100 mutators grouped into profiles, plus custom mutator support.infection.github.io · 30 Sept 2026
Static analysis: Infection supports optional PHPStan and Mago integrations to catch escaped mutants involving type violations, dead code and unreachable paths.infection.github.io · 30 Sept 2026
Cloud reporting: Infection can send mutation badges and HTML reports to Stryker Dashboard using a project API key.infection.github.io · 30 Sept 2026
Distribution: The recommended PHAR distribution bundles PHPUnit, PhpSpec, Codeception and Testo, and the PHAR signature can be verified with the documented GPG key.infection.github.io · 30 Sept 2026
License: The project is released under the BSD-3-Clause license.infection.github.io · 30 Sept 2026
Security policy: Only the latest Infection version is supported under its security policy, although older versions may be patched depending on vulnerability severity; vulnerabilities should be reported privately on GitHub.github.com · 30 Sept 2026
Community support: The project links to Discord and GitHub Discussions for community help and states that it welcomes pull requests and issues.github.com · 30 Sept 2026
How it works: It creates mutants using predefined mutation operators, runs tests covering changed lines, and records killed or escaped mutants, errors, and timeouts.infection.github.io · 2 Oct 2026
Mutation score: It reports a Mutation Score Indicator (MSI) that measures the percentage of generated mutations detected by the tests.infection.github.io · 2 Oct 2026
CI reports: Infection can emit GitHub annotations and GitLab Code Quality reports, and can publish mutation badges and HTML reports through Stryker Dashboard.infection.github.io · 2 Oct 2026
Installation: The maker documents PHAR, Phive, Composer, Git, and Homebrew installation methods.infection.github.io · 2 Oct 2026
Security: The maker says its PHAR distribution is signed with a GPG key and documents how to verify the signature and fingerprint.infection.github.io · 2 Oct 2026
Browser playground: The Infection Playground lets users write PHP code and tests in a browser and run mutation testing without installing Composer, Infection, or PHPUnit.infection.github.io · 2 Oct 2026
Caveat: The command-line guide warns that parallel runs can produce false positives when tests depend on one another or use a database.infection.github.io · 2 Oct 2026