# CodeQL

CodeQL: the libraries and queries that power security researchers around the world, as well as code scanning in GitHub Advanced Security

Repository: https://github.com/github/codeql
Canonical: https://ross.abutalabs.com/products/codeql
Homepage: https://codeql.github.com
Language: CodeQL
License: MIT
License Family: permissive
Topics: semmle-ql, codeql, github-advanced-security, github-security-lab, works-with-codespaces
Last push: 2026-08-26T22:05:48+00:00
Link (homepage): https://codeql.github.com

## Health v2 (maintenance only)
Score: 77/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 99, release rhythm 35, longevity 100
- inputs: {"age_days": 2955, "days_push": 7, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 10016, forks 2070 (observed 2026-08-28T04:10:39.258270+00:00)

## What it is
CodeQL is a semantic code analysis engine that treats code as a queryable database, letting you write queries to find security vulnerabilities and code-quality issues. This repository contains the standard CodeQL libraries and queries powering GitHub Advanced Security code scanning, alongside the separately licensed CodeQL CLI.

## Use cases
- find security vulnerabilities in a codebase
- write custom static analysis queries
- run code scanning on GitHub repositories
- research variants of a known vulnerability across open source projects
- analyze taint flows from user input to dangerous sinks
- set up automated security checks in CI

## When to choose
- you want to discover vulnerability variants by querying code as data
- you need GitHub Advanced Security code scanning for your repository
- you do security research on open source projects
- you want to write reusable, shareable security checks

## When to avoid
- you need to analyze closed-source code without a commercial license from GitHub
- you want lightweight linting rather than deep semantic analysis
- you cannot build the CodeQL database for your build system

## Facets
- artifact type: library
- maturity: active
- function: security, vulnerability-scanning, static-site-generator
- domain: security, developer-tools, version-control
- platform: cross-platform, cli, editor-plugin
- tags: codeql, static-analysis, sast, code-scanning, query-language, github-advanced-security, taint-tracking

## Member repositories
- github/codeql (main) score 77
- github/codeql-action (plugin) score 95
- github/codeql-cli-binaries (infra) score 99

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:10:39.258270+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T17:19:59.830308+00:00, confidence not recorded.
  - readme: https://github.com/github/codeql (fetched 2026-08-28T04:10:39.258270+00:00, sha c7c20eb910c9)
  - homepage: https://codeql.github.com (fetched 2026-08-29T08:20:19.700670+00:00, sha c79642ab96d8)
- Data as of 2026-08-30T08:39:29.467469+00:00.