https://github.com/advanced-security/codeql-development-mcp-server
LLM <-- MCP --> CodeQL( AST | CFG | CLI | LSP )
https://github.com/advanced-security/codeql-development-mcp-server
ast cfg code-quality code-security codeql copilot-enabled lsp mcp static-analysis
Last synced: 17 days ago
JSON representation
LLM <-- MCP --> CodeQL( AST | CFG | CLI | LSP )
- Host: GitHub
- URL: https://github.com/advanced-security/codeql-development-mcp-server
- Owner: advanced-security
- License: other
- Created: 2026-02-04T23:27:26.000Z (about 1 month ago)
- Default Branch: main
- Last Pushed: 2026-02-18T03:55:09.000Z (22 days ago)
- Last Synced: 2026-02-18T08:27:00.144Z (22 days ago)
- Topics: ast, cfg, code-quality, code-security, codeql, copilot-enabled, lsp, mcp, static-analysis
- Language: TypeScript
- Homepage:
- Size: 1.09 MB
- Stars: 4
- Watchers: 1
- Forks: 0
- Open Issues: 15
-
Metadata Files:
- Readme: README.md
- Contributing: CONTRIBUTING.md
- License: LICENSE
- Code of conduct: CODE_OF_CONDUCT.md
- Codeowners: CODEOWNERS
- Security: SECURITY.md
- Support: SUPPORT.md
Awesome Lists containing this project
README
# CodeQL Development MCP Server
> Enabling AI-assisted CodeQL query development through the Model Context Protocol
A comprehensive [Model Context Protocol (MCP)](https://modelcontextprotocol.io/) server designed specifically for agentic AI development of CodeQL (QL) code. This server provides tools, prompts, and resources to help AI assistants write, validate, and optimize CodeQL queries for security analysis and code quality.
## Features
- **Comprehensive Tool Suite** - Wraps CodeQL CLI commands for query compilation, execution, testing, and database operations
- **Multi-Language Support** - Supports CodeQL query development for 9 languages including Python, JavaScript, Java, C/C++, and more
- **AI-Optimized Prompts** - Built-in prompts and resources that guide AI assistants through CodeQL development workflows
- **Test-Driven Development** - Integrated testing tools for validating query accuracy with expected results
- **Flexible Transport** - Supports both stdio and HTTP transport modes for different integration scenarios
## Limitations
- Requires CodeQL CLI to be installed separately
- Performance depends on the size of CodeQL databases being analyzed
- Some advanced CodeQL CLI features may not yet be exposed as tools
## Project Status
**Active Development** - This project is actively maintained and used in production environments for AI-assisted CodeQL development.
## Background
The `codeql-development-mcp-server` project is maintained by GitHub's CodeQL Expert Services team and builds (and hopefully improves) on the concepts from the [`advanced-security/codeql-development-template`](https://github.com/advanced-security/codeql-development-template) repository template.
The main advantages of using the `codeql-development-mcp-server` are:
1. **Agnostic of development environment**
2. **Agnostic of calling Large Language Model (LLM)**
3. **MCP server tools codify advanced CodeQL development practices**
### Roadmap
Development priorities and open issues are tracked in [GitHub Issues](https://github.com/advanced-security/codeql-development-mcp-server/issues).
### Contributing
We welcome contributions! Whether it's bug fixes, new features, documentation improvements, or additional language support, please see [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.
Please note that this project is released with a [Contributor Code of Conduct](CODE_OF_CONDUCT.md). By participating in this project you agree to abide by its terms.
## Requirements
### Environment
- **Node.js** v24.13.0 or later ([nodejs.org](https://nodejs.org/))
- **Some calling LLM** Bring your own LLM, but some LLMs are (much) better than others.
### External Dependencies
- **CodeQL CLI** - Must be installed and available in PATH ([github.com/github/codeql-cli-binaries](https://github.com/github/codeql-cli-binaries/releases))
## Quick Start
### Install via npm (recommended)
No repository clone needed — install from [npmjs.org](https://www.npmjs.com/package/codeql-development-mcp-server):
```bash
# Install globally
npm install -g codeql-development-mcp-server
```
Or run on-demand without installing globally:
```bash
npx -y codeql-development-mcp-server
```
### VS Code Configuration
Add to your `mcp.json` file:
| OS | Location |
| ------- | -------------------------------------------------- |
| Linux | `~/.config/Code/User/mcp.json` |
| macOS | `~/Library/Application Support/Code/User/mcp.json` |
| Windows | `%APPDATA%\Code\User\mcp.json` |
```json
{
"servers": {
"ql-mcp": {
"command": "npx",
"args": ["-y", "codeql-development-mcp-server"],
"type": "stdio"
}
}
}
```
### Install from GitHub Release archive
1. Download the latest release from [GitHub Releases](https://github.com/advanced-security/codeql-development-mcp-server/releases)
2. Extract the archive:
```bash
tar -xzf codeql-development-mcp-server-vX.X.X.tar.gz -C /path/to/destination
```
### Installing from Source
```bash
git clone https://github.com/advanced-security/codeql-development-mcp-server.git
cd codeql-development-mcp-server
npm install && npm run build
```
### Verification
1. Restart VS Code
2. Open Command Palette (`Ctrl+Shift+P` / `Cmd+Shift+P`)
3. Run "GitHub Copilot: List MCP Servers"
4. Confirm `ql-mcp` appears
## Supported Languages
| Language | CodeQL Identifier |
| --------------------- | ----------------- |
| GitHub Actions | `actions` |
| C/C++ | `cpp` |
| C# | `csharp` |
| Go | `go` |
| Java/Kotlin | `java` |
| JavaScript/TypeScript | `javascript` |
| Python | `python` |
| Ruby | `ruby` |
| Swift | `swift` |
## Documentation
- [Public Installation Guide](docs/public.md) - Install and run without cloning the repository
- [Getting Started Guide](docs/getting-started.md) - Detailed installation and setup instructions
- [Tools Reference](docs/ql-mcp/tools.md) - Complete list of available MCP tools
- [Prompts Reference](docs/ql-mcp/prompts.md) - MCP prompts for CodeQL development workflows
- [Resources Reference](docs/ql-mcp/resources.md) - MCP resources for CodeQL learning and reference
- [Testing Strategy](docs/testing.md) - Multi-layer testing approach
## License
This project is licensed under the terms of the GitHub CodeQL Terms and Conditions. Please refer to [LICENSE](LICENSE) for the full terms.
## Maintainers
This repository is maintained by the team specified in [CODEOWNERS](CODEOWNERS).
## Support
This project uses GitHub issues to track bugs and feature requests. Please search existing issues before filing new ones to avoid duplicates.
This project comes with no expectation or guarantee of support, with more details in the [SUPPORT.md](SUPPORT.md) document.
## Acknowledgement
This project builds upon the [CodeQL CLI](https://github.com/github/codeql-cli-binaries) and the broader [CodeQL ecosystem](https://codeql.github.com/) developed by GitHub. Special thanks to the GitHub Advanced Security team and the open-source community for their contributions.