CodeQL
About
Bridges to the CodeQL static analysis engine for identifying security vulnerabilities and quality issues in codebases through structured query evaluation and result interpretation.
Details
- Author
- jordyzomer
- Repository
- JordyZomer/codeql-mcp
- GitHub stars
- 75
- Downloads
- 339
- Categories
- AI, Design, Developer Tools, Search, Frontend, Infrastructure, Other
- Tags
- #integration
Jump to
- ✅ Register CodeQL databases
- ✅ Run full queries or quick-evaluate a symbol
- ✅ Decode .bqrs files into JSON
- ✅ Locate predicate/class symbol positions
---
Setting up with Highlight
This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:
- Download and install Highlight from highlightai.com/download
- Navigate to the plugins tab and select "Add Custom Plugin"
-
Configure the plugin with the settings below
Plugin Name
CodeQLCommand (node, npx, python, etc.)npxArguments-
Argument 1
-y -
Argument 2
@highlight/mcp-server
Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
-
Argument 1
- Enable "Start Automatically" if you want the plugin to start when Highlight launches
From the repository
uv run mcp run server.py -t sse
Make sure your .cusor/config.json contains:
{
"mcpServers": {
"CodeQL": {
"url": "http://localhost:8000/sse"
}
}
}
Claude Desktop / Cursor
Paste into your MCP client config file to install this server.
{
"mcpServers": {
"codeql": {
"env": {},
"args": [
"-y",
"@highlight/mcp-server"
],
"command": "npx"
}
}
}Linux
{
"env": [],
"args": [
"-y",
"@highlight/mcp-server"
],
"command": "npx"
}Macos
{
"env": [],
"args": [
"-y",
"@highlight/mcp-server"
],
"command": "npx"
}Windows
{
"env": [],
"args": [
"/c",
"npx",
"-y",
"@highlight/mcp-server"
],
"command": "cmd"
}CodeQL MCP Server
This project runs a Model Context Protocol (MCP) server that wraps the CodeQL query server. It enables tools like Cursor or AI agents to interact with CodeQL through structured commands and doc search.
---
Features
- ✅ Register CodeQL databases
- ✅ Run full queries or quick-evaluate a symbol
- ✅ Decode .bqrs files into JSON
- ✅ Locate predicate/class symbol positions
---
File Structure
| File | Purpose |
|-------------------|-----------------------------------------------------|
| server.py | Main FastMCP server exposing CodeQL tools |
| codeqlclient.py | CodeQLQueryServer implementation (JSON-RPC handler) |
---
Requirements
Install with uv:
uv pip install -r requirements.txt
or with pip:
pip install fastmcp httpx
Running the MCP Server
uv run mcp run server.py -t sse
Cursor Config
Make sure your.cusor/config.json contains:
{
"mcpServers": {
"CodeQL": {
"url": "http://localhost:8000/sse"
}
}
}
Notes
- Tools like Cursor will invoke these commands directly via natural language. - You must have a codeql binary in your $PATH, or hardcode its path in codeqlclient.py. - You should probably specify query locations, query write locations and database paths in your prompts.Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
