The Codeql Development MCP Server, developed by Advanced Security, is a free Model Context Protocol (MCP) server built with TypeScript/Node.js. It connects directly to the CodeQL CLI, wrapping the CodeQL query server to enable AI agents and tools to interact with CodeQL. This server is available as an npm package, tar archives from GitHub Releases, or a VS Code extension. It serves as a crucial bridge, allowing advanced AI clients to access CodeQL's powerful analysis capabilities for various development and security tasks.

What does Codeql Development MCP Server connect to?

The Codeql Development MCP Server is designed to connect directly with the CodeQL CLI. Its core function involves wrapping the existing CodeQL query server, extending its capabilities for AI-driven interactions. This architecture allows AI agents and various development tools to access and interpret CodeQL's deep code analysis features. It acts as an intermediary, translating requests from AI clients into actions performed by the underlying CodeQL infrastructure, making complex security analysis more accessible.

Core features and tools

The Codeql Development MCP Server exposes several callable tools for interacting with CodeQL. These include PrintAST, which provides Abstract Syntax Tree information, and PrintCFG for Control Flow Graph details. It also offers CallGraphFrom and CallGraphTo for exploring call relationships. For code exploration, users can utilize search_ql_code and codeql_resolve_files, allowing AI agents to navigate QL source code and identify relevant files within CodeQL databases.

Who is it for?

The primary audience for the Codeql Development MCP Server includes developers who use AI-powered coding assistants and security researchers. It is built to support these groups in tasks requiring deep code understanding and security analysis through AI. Compatible AI clients like Cursor, GitHub Copilot CLI, and Visual Studio Code (with the advanced-security agent plugin or Copilot Chat) benefit from its capabilities. Skip this if your workflow does not involve AI agents interacting with CodeQL for code analysis or security tasks.

How to get started

No credentials are required for the Codeql Development MCP Server when operating via stdio, as access relies on implicit user-level permissions for processes running as the same user. For HTTP servers, the MCP specification does not mandate caller authentication, allowing any process capable of reaching the server to call its tools by default. It supports both stdio for child process spawning and http for connecting to a separately started server as transport protocols.

Use cases

• Secret Scanning: Enables AI coding agents to scan code changes for exposed secrets before committing or opening a pull request.
• CodeQL Query Development and Testing: Supports AI agents in tasks such as query compilation, test execution, AST/CFG exploration, and iterative query refinement.
• CodeQL Code Search and File Discovery: Allows AI agents to search QL source code and discover files within CodeQL databases and packs without direct grep or shell access.

The Codeql Development MCP Server provides a critical interface for AI agents to interact with CodeQL's powerful analysis capabilities. Its support for various AI clients and transport protocols makes it adaptable for different development and security environments. The server's ability to expose core CodeQL functionalities to AI tools significantly enhances automated code analysis and security research workflows. Try using GitHub Copilot CLI to install the advanced-security plugin and explore its secret scanning capabilities.