通过模型上下文协议实现AI辅助CodeQL查询开发

一个全面的模型上下文协议（MCP）服务器，专为 CodeQL（QL）代码的代理 AI 开发而设计。该服务器提供工具、提示和资源，帮助 AI 助手编写、验证和优化 CodeQL 查询，以实现安全分析和代码质量。

特色

• 综合工具套件 - 封装 CodeQL CLI 命令，用于查询编译、执行、测试和数据库操作
• 多语言支持 - 支持包括 Python、JavaScript、Java、C/C++、Rust、Swift 等 10 种语言的 CodeQL 查询开发
• AI优化提示词 - 内置提示和资源，指导AI助手完成CodeQL开发流程
• 测试驱动开发 - 用于验证查询准确性和预期结果的集成测试工具
• 灵活传输 - 支持不同集成场景下的stdio和HTTP传输模式

局限性

• 要求单独安装 CodeQL CLI
• 性能取决于被分析的 CodeQL 数据库规模
• 一些高级 CodeQL CLI 功能可能尚未作为工具公开

CodeQL Development MCP Server

Enabling AI-assisted CodeQL query development through the Model Context Protocol

A comprehensive Model Context Protocol (MCP) server designed specifically for agentic AI development of CodeQL (QL) code. This server provides tools, prompts, and resources to help AI assistants write, validate, and optimize CodeQL queries for security analysis and code quality.

Features

• Comprehensive Tool Suite - Wraps CodeQL CLI commands for query compilation, execution, testing, and database operations
• Multi-Language Support - Supports CodeQL query development for 10 languages including Python, JavaScript, Java, C/C++, Rust, Swift, and more
• AI-Optimized Prompts - Built-in prompts and resources that guide AI assistants through CodeQL development workflows
• Test-Driven Development - Integrated testing tools for validating query accuracy with expected results
• Flexible Transport - Supports both stdio and HTTP transport modes for different integration scenarios

Limitations

• Requires CodeQL CLI to be installed separately
• Performance depends on the size of CodeQL databases being analyzed
• Some advanced CodeQL CLI features may not yet be exposed as tools

Project Status

Active Development - This project is actively maintained and used in production environments for AI-assisted CodeQL development.

Background

The codeql-development-mcp-server project is maintained by GitHub’s CodeQL Expert Services team and builds (and hopefully improves) on the concepts from the advanced-security/codeql-development-template repository template.

The main advantages of using the codeql-development-mcp-server are:

1. Agnostic of development environment
2. Agnostic of calling Large Language Model (LLM)
3. MCP server tools codify advanced CodeQL development practices

Roadmap

Development priorities and open issues are tracked in GitHub Issues.

Contributing

We welcome contributions! Whether it’s bug fixes, new features, documentation improvements, or additional language support, please see CONTRIBUTING.md for guidelines.

Please note that this project is released with a Contributor Code of Conduct. By participating in this project you agree to abide by its terms.

Requirements

Environment

• Node.js v25.6.0 or later (nodejs.org)
• Some calling LLM Bring your own LLM, but some LLMs are (much) better than others.

External Dependencies

• CodeQL CLI - Must be installed and available in PATH (github.com/github/codeql-cli-binaries)

Quick Start

VS Code extension via VSIX (recommended for IDEs)