CodeQL
CodeQL: the libraries and queries that power security researchers around the world, as well as code scanning in GitHub Advanced Security observed · 2026-08-28
Health v2 · maintenance only
77/100
- Activity 99
- Release rhythm 35
- Longevity 100
Flags: no_releases
How is this computed?
round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10) — computed 2026-09-03. Adoption (stars, forks) is never an input.
- gap_med: n/a
- age_days: 2955
- days_rel: n/a
- days_push: 7
- n_releases_24m: 0
Adoption not part of the score
10016 stars · 2070 forks observed · 2026-08-28
What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded
CodeQL is a semantic code analysis engine that treats code as a queryable database, letting you write queries to find security vulnerabilities and code-quality issues. This repository contains the standard CodeQL libraries and queries powering GitHub Advanced Security code scanning, alongside the separately licensed CodeQL CLI.
Use cases
- find security vulnerabilities in a codebase
- write custom static analysis queries
- run code scanning on GitHub repositories
- research variants of a known vulnerability across open source projects
- analyze taint flows from user input to dangerous sinks
- set up automated security checks in CI
When to choose
- you want to discover vulnerability variants by querying code as data
- you need GitHub Advanced Security code scanning for your repository
- you do security research on open source projects
- you want to write reusable, shareable security checks
When to avoid
- you need to analyze closed-source code without a commercial license from GitHub
- you want lightweight linting rather than deep semantic analysis
- you cannot build the CodeQL database for your build system
Facets
library · maturity active
security vulnerability-scanning static-site-generator security developer-tools version-control cross-platform cli editor-plugin codeql static-analysis sast code-scanning query-language github-advanced-security taint-tracking
2 sources
- readme: https://github.com/github/codeql · fetched 2026-08-28 · c7c20eb910c9
- homepage: https://codeql.github.com · fetched 2026-08-29 · c79642ab96d8
Member repositories
| Repository | Role | Health v2 |
|---|---|---|
| github/codeql | main | 77 |
| github/codeql-action | plugin | 95 |
| github/codeql-cli-binaries | infra | 99 |
For agents
Data as of 2026-08-30T08:39:29.467469+00:00 · Report a problem