CodeQL for Visual Studio Code review
A free VS Code extension for building and analyzing CodeQL queries.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
CodeQL for Visual Studio Code is GitHub’s editor extension for developers who write, run, and test CodeQL queries against databases. It is aimed at CodeQL specialists building custom security queries, rather than developers seeking general code-quality checks or fixes inside the editor. The extension is free, open source, and available for Visual Studio Code on Windows, macOS, and Linux. Its focus is the CodeQL/QL language, with query and library authoring supported by IntelliSense, autocomplete, and Go To Definition.
The main draw is the query workflow. Users can run queries against one or more CodeQL databases, inspect data-flow paths in results, and browse and run queries from the open-source CodeQL security query repository. The extension also supports creating and editing query, library, and model packs, running unit tests for queries, and viewing variant analysis across multiple repositories. Those tools make it suited to teams that need to develop and validate CodeQL queries, though its single-language and single-IDE scope is a poor fit for broader multi-language security work or teams using another editor.
The extension connects with the CodeQL CLI and GitHub repositories, while access to CodeQL capabilities depends on repository type and GitHub Code Security licensing. Although the extension itself is free and MIT-licensed, according to the vendor, use with certain private or organization-owned repositories may require a Code Security license. Published support is through documentation. Choose it if your work centers on authoring CodeQL queries in VS Code and you can meet any applicable licensing requirements; consider another tool if you need broader language coverage, in-editor fixes, or support beyond documentation.
CodeQL for Visual Studio Code pros and cons
- Where it wins
- Write and test custom queries, libraries, and query packs in VS Code
- Inspect data-flow paths and run queries against CodeQL databases
- Run variant analysis across multiple repositories
- Where it doesn't
- Works in Visual Studio Code rather than across multiple IDEs
- The extension supports CodeQL/QL, a single language
- Some private or organization-owned repositories may require GitHub Code Security licensing
CodeQL for Visual Studio Code fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update