CodeQL
The standard query libraries and checks behind GitHub's code scanning security tools.
- Stars
- 10.3k
- Forks
- 2.1k
- Licence
- MIT
- Language
- CodeQL
- Last update
- 4 days ago
- Type
- Dev tool
What it is
This repository holds the standard CodeQL libraries and queries that GitHub uses in its application security products, including GitHub Advanced Security. CodeQL lets you write queries that search source code for patterns, such as security weaknesses, and the README says security researchers also use these libraries. It is mainly useful if you want to read, run, or contribute to those checks.
- Read the standard CodeQL libraries and queries to see how a security check is written
- Run queries with the CodeQL extension for Visual Studio Code, as described in the README
- Propose a new check or an improvement to an existing query through a pull request
Great for
- Security researchers who want to study or extend CodeQL queries
- Developers learning how CodeQL queries are written and organized
- Contributors who want to improve the standard checks through pull requests
- Teams already using GitHub Advanced Security who want to understand its built-in checks
Not ideal for
- People who only want a ready-made scan with no setup: the README points to the CodeQL extension and CLI for running queries, not to this repository as a finished tool
- Anyone analyzing closed-source code with the CLI, since the README says that use needs a separate commercial license
How to get it
- 1
Clone and build from source
You'll need: Visual Studio Code with the CodeQL extension (optional, for running queries) · CodeQL CLI, licensed separately (needed for command-line analysis)
Clone the repository
git clone https://github.com/github/codeql - 2
Run it
- Clone the repository with git.
- Install the CodeQL extension for Visual Studio Code from the marketplace link in the README.
- Open the repository in Visual Studio Code and browse the query and library files.
- Consult the CodeQL documentation linked in the README to learn how to write and run queries.
- 3
Get the most out of it
- Read the CONTRIBUTING.md guidelines before opening a pull request, as the README recommends.
- Use the style guides linked in the docs folder to format queries and write query metadata.
- Use the .vscode/tasks.json tasks through the Run Task menu, as the README describes.
- Use the VS Code extension for syntax highlighting, IntelliSense, and unit test support for CodeQL libraries and queries.
Downloads
Strengths
- Open source under the MIT License for the code in this repository
- Backed by the same libraries that GitHub's security products use, according to the README
- Documentation and style guides are linked from the README
Trade-offs
- The README does not describe a standalone install or run path for this repository itself, so beginners may need the separate CodeQL CLI and VS Code extension first
- The CodeQL CLI and engine are licensed separately and hosted in another repository, which adds a licensing question for closed-source use
- The README is truncated and gives little detail on the directory layout or build steps
How it compares
| Project | Stars | Type | Level | Updated | Best for |
|---|---|---|---|---|---|
| codeql (this) | 10.3k | Dev tool | advanced | 4 days ago | Security researchers who want to study or extend CodeQL queries |
| eslint | 27.6k | Dev tool | intermediate | 4 days ago | JavaScript developers who want automatic checks on their code |
| electron | 124k | Framework | intermediate | 4 days ago | Web developers who want to ship a desktop app using skills they already have |
Stats synced from GitHub. The assessment above was drafted with AI from the project's README on 2026-10-29 and may miss recent changes — check the README before relying on a command. MIT licence: free to use, modify and distribute, including commercially, as long as you keep the copyright notice.