CodeQL

Verified 19 Aug 2026

GitHub’s semantic code analysis, query-based and CI-native.

CodeQL is GitHub’s semantic static analysis: you write queries, it finds variants, it runs in GitHub Advanced Security / Actions. It is a verification primitive for factories that already live on GitHub.

Verification

Model independence: Multi-model
Deployment: Cloud, Self-hosted
Open source: No
License: See GitHub CodeQL terms (not a casual OSS license)
Pricing model: Mixed
Added / updated: 19 Aug 2026 / 19 Aug 2026

codeql.github.com · Docs

Editorial take

CodeQL is the serious query engine, not an AI reviewer. License is not “just MIT.” Use it as a gate on security invariants. Agents can generate queries; humans should own them.

Strengths

Semantic queries, not only regex.
Native GitHub Actions path.
Variant analysis for classes of bugs.

Limitations

Licensing is restrictive compared with Semgrep’s engine.
Heavy compared with a linter.
GitHub-shaped commercial packaging.

Fields last checked against primary sources on 19 Aug 2026. Pricing and plan names rot; follow the vendor URL.