CLOUDM0N
Repository intelligence

github/codeql

GitHub

An open-source repository containing the standard CodeQL libraries and queries that power GitHub Advanced Security and other application security products.

CLOUDM0N decision
REVIEW BEFORE ADOPTION
Trust REVIEW · 80/100
Good fit if

Developers and security researchers who want to contribute to standard CodeQL libraries and security checks.

Watch out for

Does not include the core CodeQL engine or CLI, which are hosted in a separate repository.

Practical intelligence

What matters before you adopt it

Problem it solves

The lack of open, standard, and community-maintainable security checks and libraries for running automated security analysis.

Best for
Developers and security researchers who want to contribute to standard CodeQL libraries and security checks.
Users of Visual Studio Code who write and run CodeQL queries.
Main trade-offs
Does not include the core CodeQL engine or CLI, which are hosted in a separate repository.
Analyzing closed-source code with the CodeQL CLI requires a separate commercial license.
Why it stands out
Licensed under the highly permissive MIT License.
Integrates with a dedicated Visual Studio Code extension providing syntax highlighting, IntelliSense, code navigation, and unit test support.
Trust & CVEs

Security evidence without the noise

Trust remains a decision signal; CVEs and scanner evidence explain what is driving the risk.

Security findings
2
CLOUDM0N scanner findings
Critical
0
High
0
Medium
2
Low
0
View trust evidence & security findings▼
Why this score
No trust rationale was stored for this scan.
CLOUDM0N findings
MEDIUM
Dynamic code execution pattern detected. 5 sample match(es) found.
MEDIUM
The project can spawn operating-system processes; review command construction and input handling. 5 sample match(es) found.
Architecture from code5 modules · 0 edges▼
Structural evidence

Modules and dependency edges extracted from repository code. This is code evidence, not README inference.

Code files
20
Modules
5
Dependency edges
0
Core modules
(root)
1 files
actions
2 files
config
configuration
14 files
cpp
3 files
Dependency flow
No dependency edges were extracted.
Detected languages
C++ · C · JavaScript · Python · Shell
Detected frameworks
—
Architecture evidence details
flowchart TD
    %% repo — high-level architecture (DRAFT, refine me)
    n0["(root) · 1 file"]
    n1["actions · 2 files"]
    n2["config · configuration · 14 files"]
    n3["cpp · 3 files"]
    class n2 infra
    classDef infra fill:#b35c00,color:#ffffff,stroke:#8f4a00
Evidence, security & integrations▼
Integrations
GitHub Advanced SecurityVisual Studio CodeCodeQL CLI
Security notes
• Powers security analysis across global public repositories and enterprise code via GitHub Advanced Security.
• Closed-source analysis with the CodeQL CLI requires a separate commercial license.
Still unknown
• The README does not specify any hardware, operating system, or RAM requirements to compile or test queries.
• The README does not provide concrete CLI setup or installation commands, redirecting instead to external links.
• The README does not list which programming languages are supported by the libraries in this repository.
Adoption guidance▼
Adopt if
+ You are writing or testing custom security checks using the CodeQL query language.
+ You want to contribute to the standard queries used globally by GitHub Advanced Security.
Avoid if
– You only need the pre-compiled CodeQL CLI binary or engine itself, as these are hosted and licensed separately.
– You must analyze closed-source code using the CLI without acquiring a commercial license.
How it works & getting started▼
How it works
1.The user installs the CodeQL extension for Visual Studio Code.
2.The user uses standard CodeQL libraries and queries to search for vulnerabilities in code.
3.The user defines workspace tasks in tasks.json to automate frequent developer commands.
4.The user writes custom queries, runs unit tests inside VS Code, and contributes them back via pull requests.
Getting started
→ Install the 'CodeQL for Visual Studio Code' extension from the marketplace.
→ Refer to the CodeQL language documentation and the CodeQL CLI guide to learn how to write queries.
→ Read the contributing guidelines in the docs folder before contributing code or documentation changes.
Agent handoff
Use with any agent
JSON API
Alternatives

Nearby repositories worth comparing before adoption.

Compare top options →
graphify
Graphify-Labs/graphify
74
Fit

Turn any codebase, with its docs, SQL schemas, configs, and PDFs, into a queryable knowledge graph. A /graphify skill for Claude Code, Cursor, Codex, and Gemini CLI: local deterministic AST parsing, every edge explained, no vector store.

Trust REVIEW · 45
Compare →
codebase-memory-mcp
DeusData/codebase-memory-mcp
71
Fit

This MCP server transforms how developers interact with codebases by building a persistent knowledge graph that indexes repositories in milliseconds across 155 programming languages. With sub-millisecond query speeds and 99% token reduction, it enables AI coding assistants like Cursor, Claude Code, and Windsurf to understand your entire codebase context without drowning in context windows. Built as a single static binary with zero dependencies, it runs anywhere.

Trust REVIEW · 55
Compare →
holaOS
holaboss-ai/holaOS
71
Fit

holaOS คือ Agentic OS ที่ทำให้ AI Agent สามารถทำงานดิจิทัลได้ทุกอย่างบนคอมพิวเตอร์ของคุณ ไม่ว่าจะเป็นการจัดการไฟล์ ท่องเว็บ หรือรันโปรแกรมต่างๆ ผ่าน Natural Language ด้วย Electron + TypeScript + MCP Protocol ที่ Open Source สำหรับ Developer ที่อยากสร้าง Desktop AI Agent ของตัวเอง

Trust REVIEW · 45
Compare →