MCP 服务器

codeql-development-mcp-server

Enables AI-assisted development of CodeQL queries for security analysis through the Model Context Protocol. Provides tools for compiling, testing, and executing CodeQL queries across multiple programming languages.

README

CodeQL Development MCP Server

Enabling AI-assisted CodeQL query development through the Model Context Protocol

A comprehensive Model Context Protocol (MCP) server designed specifically for agentic AI development of CodeQL (QL) code. This server provides tools, prompts, and resources to help AI assistants write, validate, and optimize CodeQL queries for security analysis and code quality.

Features

Comprehensive Tool Suite - Wraps CodeQL CLI commands for query compilation, execution, testing, and database operations
Multi-Language Support - Supports CodeQL query development for 10 languages including Python, JavaScript, Java, C/C++, Rust, Swift, and more
AI-Optimized Prompts - Built-in prompts and resources that guide AI assistants through CodeQL development workflows
Test-Driven Development - Integrated testing tools for validating query accuracy with expected results
Flexible Transport - Supports both stdio and HTTP transport modes for different integration scenarios

Limitations

Requires CodeQL CLI to be installed separately
Performance depends on the size of CodeQL databases being analyzed
Some advanced CodeQL CLI features may not yet be exposed as tools

Project Status

Active Development - This project is actively maintained and used in production environments for AI-assisted CodeQL development.

Background

The codeql-development-mcp-server project is maintained by GitHub's CodeQL Expert Services team and builds (and hopefully improves) on the concepts from the advanced-security/codeql-development-template repository template.

The main advantages of using the codeql-development-mcp-server are:

Agnostic of development environment
Agnostic of calling Large Language Model (LLM)
MCP server tools codify advanced CodeQL development practices

Roadmap

Development priorities and open issues are tracked in GitHub Issues.

Contributing

We welcome contributions! Whether it's bug fixes, new features, documentation improvements, or additional language support, please see CONTRIBUTING.md for guidelines.

Please note that this project is released with a Contributor Code of Conduct. By participating in this project you agree to abide by its terms.

Requirements

Environment

Node.js v25.6.0 or later (nodejs.org)
Some calling LLM Bring your own LLM, but some LLMs are (much) better than others.

External Dependencies

CodeQL CLI - Must be installed and available in PATH (github.com/github/codeql-cli-binaries)

Quick Start

Install via npm (recommended)

No repository clone needed — install from npmjs.org:

# Install globally
npm install -g codeql-development-mcp-server

Or run on-demand without installing globally:

npx -y codeql-development-mcp-server

VS Code Configuration

Add to your mcp.json file:

OS	Location
Linux	`~/.config/Code/User/mcp.json`
macOS	`~/Library/Application Support/Code/User/mcp.json`
Windows	`%APPDATA%\Code\User\mcp.json`

{
  "servers": {
    "ql-mcp": {
      "command": "npx",
      "args": ["-y", "codeql-development-mcp-server"],
      "type": "stdio"
    }
  }
}

Install from GitHub Release archive

Download the latest release from GitHub Releases
Extract the archive:

tar -xzf codeql-development-mcp-server-vX.X.X.tar.gz -C /path/to/destination

Installing from Source

git clone https://github.com/advanced-security/codeql-development-mcp-server.git
cd codeql-development-mcp-server
npm install && npm run build

Verification

Restart VS Code
Open Command Palette (Ctrl+Shift+P / Cmd+Shift+P)
Run "GitHub Copilot: List MCP Servers"
Confirm ql-mcp appears

Supported Languages

Language	CodeQL Identifier
GitHub Actions	`actions`
C/C++	`cpp`
C#	`csharp`
Go	`go`
Java/Kotlin	`java`
JavaScript/TypeScript	`javascript`
Python	`python`
Ruby	`ruby`
Swift	`swift`

Documentation

Public Installation Guide - Install and run without cloning the repository
Getting Started Guide - Detailed installation and setup instructions
Tools Reference - Complete list of available MCP tools
Prompts Reference - MCP prompts for CodeQL development workflows
Resources Reference - MCP resources for CodeQL learning and reference
Testing Strategy - Multi-layer testing approach

License

This project is licensed under the terms of the GitHub CodeQL Terms and Conditions. Please refer to LICENSE for the full terms.

Maintainers

This repository is maintained by the team specified in CODEOWNERS.

Support

This project uses GitHub issues to track bugs and feature requests. Please search existing issues before filing new ones to avoid duplicates.

This project comes with no expectation or guarantee of support, with more details in the SUPPORT.md document.

Acknowledgement

This project builds upon the CodeQL CLI and the broader CodeQL ecosystem developed by GitHub. Special thanks to the GitHub Advanced Security team and the open-source community for their contributions.