Semgrep Code vs GitHub CodeQL

Semgrep Code9.4Visit GitHub CodeQL9.0Visit

Higher score Semgrep Code #1 in SAST Tools 9.4/10 Free plan Free plan✓ 5 of 5 features Visit Semgrep Code

vs

GitHub CodeQL #3 in SAST Tools 9.0/10 Free plan Free plan✓ 5 of 5 features Visit GitHub CodeQL

• Semgrep Code fits best

  Teams needing broad SAST integrations

• GitHub CodeQL fits best

  GitHub-centric development teams

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Side by side

Feature	Semgrep Code 9.4/10 Visit ↗	GitHub CodeQL 9.0/10 Visit ↗
At a glance
Editor score	9.4	9.0
Ranking	#1 in SAST Tools	#3 in SAST Tools
Best for	Teams needing broad SAST integrations	GitHub-centric development teams
Pricing model	Free plan + paid	Free plan + paid
Starting price	$30/user/mo	$30/user/mo
Free plan	✓	✓
Free trial	—	—
Deployment	Cloud	Cloud, Desktop
Platforms	Web	Web, Windows, macOS, Linux
Support	Community, Docs	Docs
Integrations	13 integrations	4 integrations
Built for	Small business, Mid-market, Enterprise	Small business, Mid-market, Enterprise
Features Semgrep Code 5/5 · GitHub CodeQL 5/5
Pull request scans	✓	✓
IDE support	✓	✓
CI/CD integration	✓	✓
Custom security rules	✓	✓
Automated fixes	✓	✓
Specs
Analysis targets	source code	source code
Languages supported	35 (best)	11
Our review
Pros	Cross-file and cross-function taint analysis GitHub, GitLab, Bitbucket, CI/CD, and IDE integrations AI-assisted triage, remediation guidance, and fix suggestions	Semantic queries detect vulnerabilities and coding errors. Pull-request, GitHub Actions, and external CI scanning. Custom queries and SARIF support for tailored analysis.
Cons	Free Edition is limited to 10 repositories and 10 contributors Teams starts at $30 per contributor per month Enterprise pricing is custom	Private-repository scanning requires paid GitHub Code Security. Paid pricing is based on unique active committers. The feature set is centered on source-code analysis.
Our verdict	Semgrep Code is a static application security testing product for development and security teams. It analyzes source code with Semgrep’s Pro Engine and security rules to identify vulnerabilities, including issues that require cross-file… Read the review →	GitHub CodeQL is a semantic static-analysis engine for finding security vulnerabilities, coding errors, and other issues in source code. It represents code as data and queries that representation, giving development and security teams a… Read the review →

Strengths and trade-offs

• Semgrep Code — where it wins

  • Cross-file and cross-function taint analysis
  • GitHub, GitLab, Bitbucket, CI/CD, and IDE integrations
  • AI-assisted triage, remediation guidance, and fix suggestions

  Where it doesn't

  • Free Edition is limited to 10 repositories and 10 contributors
  • Teams starts at $30 per contributor per month
  • Enterprise pricing is custom

• GitHub CodeQL — where it wins

  • Semantic queries detect vulnerabilities and coding errors.
  • Pull-request, GitHub Actions, and external CI scanning.
  • Custom queries and SARIF support for tailored analysis.

  Where it doesn't

  • Private-repository scanning requires paid GitHub Code Security.
  • Paid pricing is based on unique active committers.
  • The feature set is centered on source-code analysis.

• Semgrep Code9.4/10 · Free plan

  Broad SAST coverage with pull-request, CI/CD, IDE, custom-rule, and AI-assisted workflows.

  Visit Semgrep CodeFull verdict →
• GitHub CodeQL9.0/10 · Free plan

  Deep SAST for GitHub workflows, with free public-repository scanning.

  Visit GitHub CodeQLFull verdict →