GitHub CodeQL

Overview

GitHub CodeQL is a source-code analysis language and toolchain for teams that want to inspect code through queries. It suits security teams and developers who need customizable checks and can work within its supported languages and GitHub scanning options. Its strongest case is combining broad security query coverage with custom analysis; language and repository eligibility can rule it out for some projects.

CodeQL builds a database from source code, runs queries against it, and returns results for review and triage. Queries can target security, correctness, maintainability, and readability, making it useful beyond vulnerability checks, though teams must interpret and act on the findings.

For category comparisons, see SAST Tools, Static Application Security Testing Software, and Static Analysis Tools.

Key features

Custom and security queries

Teams can write queries and package them in CodeQL packs for code scanning or CLI analysis. That flexibility is valuable when standard checks do not match a codebase or review process, but it also makes CodeQL a better fit for teams willing to shape and manage analysis than for those seeking only a fixed, hands-off check.

CodeQL 2.26.2's Default suite contains 497 security queries covering 170 CWEs; the Extended suite adds 131 queries covering 32 additional CWEs. This gives security-focused teams substantial built-in coverage, while the separate suites let them choose between the default set and broader checks.

CLI, IDE, and CI workflows

GitHub provides a CLI and a Visual Studio Code extension. For a GitHub-hosted repository, the standard route is enabling code scanning with GitHub Actions. Teams using an external CI system can download the CodeQL bundle, generate code-scanning results, and upload them to GitHub. That supports different build environments, although the GitHub-hosted workflow is centered on Actions.

CodeQL supports pull request scans and IDE use. Custom packs can be used with code scanning or the CLI, so teams can carry their own analysis into either workflow.

Pricing

CodeQL has free and paid options, but eligibility and billing differ by plan. Free for research and open source costs nothing for research use and open-source codebases. CodeQL for open source and research also costs nothing and covers OSI-approved open source, academic research, and specified automated analysis, CI, or CD.

GitHub Code Security costs $30 a month, billed per active committer/month. It includes CodeQL code scanning, Copilot Autofix, and Dependency review. The per-committer billing means the monthly cost depends on the number of active committers; the plan's stated inclusions extend beyond CodeQL alone.

GitHub Free with CodeQL code scanning makes CodeQL available for public repositories and is billed per month, with no price stated. Code scanning eligibility is broader for organization-owned repositories only when they use GitHub Team, GitHub Enterprise Cloud, or GitHub Enterprise Server with GitHub Code Security enabled. Readers should check repository eligibility before choosing a workflow; the free research and open-source plans have their own stated use conditions.

Platforms

The latest release supports Ubuntu 22.04 and 24.04, Windows 10 or Windows Server 2019, Windows 11 or Windows Server 2022/2025, and macOS 14, 15, and 26. CodeQL is also offered as a web workflow, CLI, Visual Studio Code extension, and self-hosted option. Language support covers C/C++, C#, Go, Java, Kotlin, JavaScript, TypeScript, Python, Ruby, Rust, Swift, and GitHub Actions workflows. Despite the broad selection, PHP and Scala are not supported, so teams working in those languages should look elsewhere.

Who it's for

CodeQL is a strong fit for teams building in supported languages that want query-based security and quality analysis, especially those using GitHub code scanning or willing to connect an external CI system. Its custom-query model also suits security researchers and teams that need checks tailored to their code. It is a poor fit when a project depends on unsupported languages or an organization-owned repository does not meet the required GitHub plan and Code Security conditions.

Pros and cons

Pros

• Substantial security query coverage: the Default and Extended suites together cover 202 CWEs, with a choice of broader analysis.
• Custom analysis: teams can write queries and package them for CLI use or code scanning rather than being limited to built-in checks.
• Workflow options: GitHub Actions is the standard route, while the bundle supports external CI result uploads.
• Free routes for eligible users: research and open-source plans are free, and public repositories can use code scanning through GitHub Free.

Cons

• Language gaps: PHP and Scala are unsupported, which excludes some codebases from direct analysis.
• Repository restrictions: organization-owned repository scanning requires a qualifying GitHub plan and Code Security enabled.
• Paid-seat exposure: GitHub Code Security is billed per active committer/month, so the monthly bill varies with active committer count.
• Query-based work requires review: results are for review and triage, so teams need a process to evaluate findings rather than treating analysis as an automatic resolution.

Alternatives

Choose Semgrep Code if its free tier's stated allowance of up to 10 repositories, 10 contributors, and 60 AI credits better matches a small team; it also offers Code and Supply Chain in that tier. Choose OpenText Fortify SAST if you want to compare another paid SAST option across Linux, macOS, web, and Windows.

PVS-Studio is another paid alternative with a free plan and trial, and its Team plan is described for fewer than 10 developers on one supported platform. Klocwork, CodeSonar, and DerScanner are additional paid options to consider.

Fluid Attacks is a paid alternative with a free trial and an Essential plan requiring at least 10 authors per month. Kiuwan Code Security is another paid alternative with a free trial; its Professional plan is $49 a year, billed annually, with a 10-user minimum and coverage for up to 25 applications.

For C and C++-specific comparisons, browse C and C++ Static Analysis Tools. See Database Schema Comparison Tools and Nintendo Switch Emulators for those separate categories.

Verdict

Choose GitHub CodeQL if your codebase uses a supported language and you want substantial query-based security coverage with the option to write rules of your own. Its mix of Actions, CLI, IDE, and external CI workflows is a meaningful strength. Look elsewhere if language coverage or repository eligibility is a barrier, or if per-active-committer billing does not suit your organization.