CodeQL Development MCP Server

Name: CodeQL Development MCP Server
Author: GitHub Advanced Security

Write, test, run and profile CodeQL queries from an AI assistant through the local CodeQL CLI

Official · GitHub Advanced Security TypeScript Local · stdio Developer tools Security

GitHub npm Website

51 popularity score ★ 39 ↓ 838/wk

Connect your client

Local (npm)

Add in one click

Add to Cursor Add to VS Code Add to LM Studio Add to Goose

Opens the app, which asks before it adds the server.

Or add it by command or config

Claude CodeTerminal

claude mcp add codeql-development -- npx -y codeql-development-mcp-server

Claude Desktopclaude_desktop_config.json

{
  "mcpServers": {
    "codeql-development": {
      "command": "npx",
      "args": [
        "-y",
        "codeql-development-mcp-server"
      ]
    }
  }
}

Cursor~/.cursor/mcp.json

{
  "mcpServers": {
    "codeql-development": {
      "command": "npx",
      "args": [
        "-y",
        "codeql-development-mcp-server"
      ]
    }
  }
}

VS Code.vscode/mcp.json

{
  "servers": {
    "codeql-development": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "codeql-development-mcp-server"
      ]
    }
  }
}

Codex~/.codex/config.toml

[mcp_servers.codeql-development]
command = "npx"
args = ["-y", "codeql-development-mcp-server"]

Gemini CLITerminal

gemini mcp add --scope user codeql-development npx -- -y codeql-development-mcp-server

Settings 5

`CODEQL_PATH`	Optional: Absolute path to the CodeQL CLI binary; defaults to codeql on PATH.
`TRANSPORT_MODE`	Optional: stdio (default) or http.
`HTTP_PORT`	Optional: Port for HTTP mode, default 3000.
`HTTP_HOST`	Optional: Address HTTP mode binds to, default localhost.
`DEBUG`	Optional: Turn on debug logging, default false.

What it does

CodeQL Development MCP Server (registered in clients as ql-mcp) helps an assistant author CodeQL queries. It wraps the CodeQL CLI you install yourself: it creates and analyses CodeQL databases, compiles, formats and runs queries, scaffolds a new query with its test folder, runs and accepts query tests, decodes BQRS output and works through SARIF files (listing rules, diffing two runs, splitting out one rule, sorting findings into new and pre-existing against a git diff). Through the CodeQL language server it also gives completions, go-to-definition, references and diagnostics for .ql files.

Beyond tools it serves 10 prompts for guided workflows (test-driven query writing, ranking likely false or true positives in SARIF, documenting a query, building a training workshop) and reference resources such as per-language AST and security-pattern guides. It covers the CodeQL languages actions, cpp, csharp, go, java, javascript, python, ruby and swift.

The npm page advertises 34 tools, but the source at v2.27.2 registers far more by default: 49 CodeQL, language-server, query-development and SARIF tools listed in its server-tools reference, plus 6 annotation tools, 4 audit-finding tools and 4 query-results-cache tools that the reference does not list, 63 in all. A further 11 session-tracking tools are off unless enabled. It is maintained by GitHub's CodeQL Expert Services team in the advanced-security organisation.

What it needs

Runtime	Node.js 25+

Node.js v25.6.0 or later (npx). The CodeQL CLI installed separately and on PATH, or its binary given in CODEQL_PATH. Some tools that run bundled queries (such as PrintAST) need their pack dependencies installed first with the package's second program, codeql-development-mcp-server-setup-packs. CodeQL databases or source code to work on. Building from source with plain npm run build also needs a Go toolchain for the client CLI.

Limits

It does nothing without a working CodeQL CLI, and some CLI features are not exposed as tools. Speed depends on the size of the databases analysed. validate_codeql_query is a heuristic check that does not compile, and codeql_lsp_diagnostics on inline code cannot resolve pack imports. Use is governed by the GitHub CodeQL Terms and Conditions rather than an open-source licence, and its support page promises no support. In HTTP mode it binds to localhost on port 3000 unless HTTP_HOST or HTTP_PORT is set (source, not in the README).

Who it suits

Suits security engineers and CodeQL authors who already use the CodeQL CLI and want an assistant to write queries test-first, run them on local databases and triage SARIF output. It runs entirely on your machine and needs no account. Inside VS Code or Cursor the makers recommend their VSIX extension, which bundles the server and finds the CLI for you. It is not a code-scanning service: if you want GitHub's code scanning alerts for a repository rather than query development, look elsewhere.

Tools 60 of 74

codeql_bqrs_decode: Turn a BQRS result file into text, CSV or JSON, with paging by result set and rows
codeql_bqrs_info: Show result sets, column types and row counts of a BQRS file
codeql_bqrs_interpret: Render BQRS results as CSV, SARIF or graph output using the query's metadata
codeql_database_analyze: Run queries or suites on a database, producing evaluator logs, BQRS and SARIF
codeql_database_create: Build a CodeQL database from source code, including overlay databases
codeql_generate_log-summary: Summarise a structured JSON evaluator event log
codeql_generate_query-help: Produce query help documentation from QLDoc comments
codeql_pack_install: Install a CodeQL pack's dependencies
codeql_pack_ls: List CodeQL packs found under a local directory
codeql_query_compile: Compile a query and report errors
codeql_query_format: Reformat CodeQL source files
codeql_query_run: Run one query against a database
codeql_resolve_database: Check a database path and its structure
codeql_resolve_languages: List the installed extractor packs
codeql_resolve_metadata: Read the metadata key-value pairs of a query file
codeql_resolve_queries: List the queries available on the local disk
codeql_resolve_tests: Find local paths of unit tests or queries under a directory
codeql_test_accept: Save new test output as the expected baseline
codeql_test_extract: Extract test databases for query tests
codeql_test_run: Run query tests, with optional diff-informed and overlay checks
codeql_lsp_completion: Get completions at a position in a CodeQL file from the language server
codeql_lsp_definition: Jump to where a CodeQL symbol is defined
codeql_lsp_diagnostics: Check CodeQL code for syntax and semantic errors via the language server
codeql_lsp_references: Find every use of a CodeQL symbol
create_codeql_query: Scaffold folders and files for a new query and its tests
find_class_position: Locate a class's start and end for quick evaluation
find_codeql_query_files: Gather the files and folders that belong to a query, with its metadata
find_predicate_position: Locate a predicate's start and end for quick evaluation
list_codeql_databases: List databases found in the configured base folders
list_mrva_run_results: List multi-repository variant analysis run results per repository
list_query_run_results: List query run output folders, filterable by query name, language or path
profile_codeql_query: Profile a query run on a database from its evaluator log
profile_codeql_query_from_logs: Condense evaluator logs into a compact profile plus a line-indexed detail file
quick_evaluate: Evaluate a single class or predicate of a query for debugging
read_database_source: Read or list source files from a database's source archive
register_database: Add a local database folder to the server's known databases
search_ql_code: Search QL source files by text or regex
validate_codeql_query: Run a quick structural check on a query without compiling it
sarif_compare_alerts: Check whether two SARIF alerts overlap in their code locations
sarif_deduplicate_rules: Find rules that duplicate each other across two SARIF files
sarif_diff_by_commits: Mark SARIF findings as new or pre-existing using a git diff
sarif_diff_runs: Compare two SARIF files for added, removed and changed rules and results
sarif_extract_rule: Pull one rule's data out of a multi-rule SARIF file as valid SARIF
sarif_list_rules: List rules in a SARIF file with counts, severity, precision and tags
sarif_rule_to_markdown: Write a rule's SARIF data as markdown with Mermaid dataflow diagrams
sarif_store: Keep SARIF content in the session store and return a key for other SARIF tools
query_results_cache_lookup: Find cached query results by a query's @id
query_results_cache_compare: Compare cached results for one query across databases
query_results_cache_retrieve: Return cached results, optionally only some lines or SARIF results
query_results_cache_clear: Remove cached results by key, query, database or all at once
annotation_create: Add a note or bookmark to any item
annotation_get: Fetch one annotation by its id
annotation_list: List annotations, filtered by category or item key
annotation_update: Change an annotation's text, label or metadata
annotation_delete: Remove annotations by id, category or key prefix
annotation_search: Full-text search over saved annotations
audit_store_findings: Save analysis findings for a repository
audit_list_findings: List a repository's saved findings with their notes
audit_add_notes: Add analyst notes to a saved finding
audit_clear_repo: Delete every saved finding for a repository

Popularity

51 popularity score, on our list (the bar is 36)

★ 39 ↓ 838/wk

GitHub stars, whole repository	39	19.2 points
npm downloads, last week	838	23.4 points
Official server	Yes	8 points

It lives in the folder server of advanced-security/codeql-development-mcp-server, which holds more than this server. Its stars are the whole repository's, so in the score they never count for more than its own downloads.

Measured 2026-11-07. How the score works.

Where it is published

Code	advanced-security/codeql-development-mcp-server/server ★ 39, the whole repository
npm	codeql-development-mcp-server 2.27.4, 2026-11-03

What it can reach

Runs	On your machine
Reaches	Files on your machine, Your code, The internet
Changes things	Yes: it can write, send, create or delete
Sign-in	None
Licence	LicenseRef-CodeQL-Terms (npm)
Last code change	2026-11-03 (a release)

Runs locally over stdio by default and calls the CodeQL CLI as a subprocess, so it reads source trees, databases, query packs and result files on paths the assistant passes. It writes: it creates databases and query scaffolding on disk, overwrites test baselines (codeql_test_accept), installs pack dependencies (codeql_pack_install, which downloads packs) and keeps annotations, audit findings and a results cache in a local SQLite store that tools can delete. No sign-in is needed. With TRANSPORT_MODE=http it listens on localhost:3000 by default; setting HTTP_HOST exposes it to other machines.

Over time

GitHub stars, whole repository 39 +1 (+3 %)

3938

13 Oct 20267 Nov 2026

npm downloads a week 838 +374 (+81 %)

98144

16 Feb 20267 Nov 2026

Before the site measured it, read from npm's daily download counts.

Popularity score 51 +11 (+28 %)

5140

13 Oct 20267 Nov 2026

What is rising across the directory

Sources

Page checked 2026-10-14.

Badge for your README

Shows this server's rank in its category, and stars for a server that runs on your machine. It updates every hour.

MarkdownREADME.md

[![CodeQL Development MCP Server on EveryMCPServer](https://everymcpserver.com/badge/codeql-development-mcp-server.svg)](https://everymcpserver.com/servers/codeql-development-mcp-server)

Connect your client

Add in one click

Or add it by command or config

Settings 5

What it does

What it needs

Limits

Who it suits

Tools 60 of 74

Similar servers

SonarQube MCP Server

BC Code Intelligence MCP Server

Code Index MCP

Code Runner MCP Server

opencode-mcp

Instant MCP