GitHub CodeQL
7.5#1 in git gui clientsFrom $30 a monthFree planWebExtensionLinuxmacOS
VisitGitHub CodeQL vs Pysa
Pysa
6.7#9 in static application security testing softwareFree planFree planExtensionLinuxmacOSSelf-hosted
VisitWhat both publish
| Fact | GitHub CodeQL | Pysa |
|---|---|---|
| CI integration | The CodeQL bundle can be downloaded for an external CI system to generate code-scanning results and upload them to GitHub. | A GitHub Action can run Pysa in CI and show results in GitHub's Security code scanning UI. |
| Purpose | CodeQL is a language and toolchain for code analysis that treats code as data. | Pysa is a security-focused static analysis tool for Python that tracks data flows to find security and privacy issues. |
GitHub CodeQL plans
- Free for research and open sourceFree
- CodeQL for open source and researchFree
- GitHub Code Security$30 a month
- GitHub Free with CodeQL code scanning—
Pysa plans
- Free (MIT-licensed open-source software)Free
Pick GitHub CodeQL if…
CodeQL is for developers and security teams who want query-based code analysis in an IDE, CLI, or CI workflow. Its availability depends on supported languages, operating systems, and repository eligibility.
Pick Pysa if…
Pysa suits Python teams looking for source-code taint analysis, including teams that want to run checks in CI. It is most relevant when the code and dependencies to analyze are available within the configured search paths.