Happy slice of mcp pizzaMCP.pizza

codeql-mcp

MCP.Pizza Chef: JordyZomer

Security researchers use CodeQL to hunt for vulnerability patterns across a whole codebase. This bridge lets an assistant such as Cursor register a database you have already built, run a saved query, decode the results, and pinpoint a class or rule to test on its own. It cannot build the database for you, and CodeQL itself has to be installed separately. The code has not changed since March 2025, and the repository carries no licence at all, which leaves workplace use legally unclear.

Unmaintained · no code changes since March 2025; no licence file
Coding

Use This MCP server To

Run a saved security query against a codebase I already scanned Test one part of a query before running the whole thing Turn raw scan results into a readable table Find where a rule is defined inside a long query file Ask Cursor to check a project for a known flaw pattern

README

CodeQL MCP Server

This project runs a Model Context Protocol (MCP) server that wraps the CodeQL query server. It enables tools like Cursor or AI agents to interact with CodeQL through structured commands and doc search.

Features

  • ✅ Register CodeQL databases
  • ✅ Run full queries or quick-evaluate a symbol
  • ✅ Decode .bqrs files into JSON
  • ✅ Locate predicate/class symbol positions

File Structure

File Purpose
server.py Main FastMCP server exposing CodeQL tools
codeqlclient.py CodeQLQueryServer implementation (JSON-RPC handler)

Requirements

Install with uv:

uv pip install -r requirements.txt

or with pip:

pip install fastmcp httpx

Running the MCP Server

uv run mcp run server.py -t sse

Cursor Config

Make sure your .cusor/config.json contains:

{
  "mcpServers": {
    "CodeQL": {
      "url": "http://localhost:8000/sse"
    }
  }
}

Notes

  • Tools like Cursor will invoke these commands directly via natural language.
  • You must have a codeql binary in your $PATH, or hardcode its path in codeqlclient.py.
  • You should probably specify query locations, query write locations and database paths in your prompts.

codeql-mcp FAQ

Is this still maintained?
It has been quiet since March 2025, with no releases and no licence file. Treat it as one person's experiment rather than a supported product.
Do I need a key or an account?
No. There is no sign-up and no key of any kind. You do need the free CodeQL command-line tool installed and reachable on your computer.
Can I use this to scan a project I just downloaded?
Not on its own. It can only register a CodeQL database that already exists, complete with its src.zip file. Building that database is a separate step this tool does not perform.
How many things can it actually do?
Six: register a database, run a query, quick-test a single symbol, decode results, find a class position, and find a rule position. The README advertises only four.
What can it change on my computer?
It reads your query files and writes result files. By default those land at /tmp/eval.bqrs and /tmp/quickeval.bqrs, you can name a different location, and it overwrites whatever is there without asking.
Is it safe to leave running?
Only on a machine you trust. Started directly with Python, it listens on every network address on port 8000 with no password, so anyone who can reach that port could run queries against your code.
How hard is the setup?
Developer-level. You install Python packages, install CodeQL separately, start the server from a terminal, and point your app at a local web address.
Which apps does it work in?
The instructions cover Cursor only. Other apps that can connect to a local web address should work, but nothing else is documented or tested.