1. Conduid
  2. Developer Tools
  3. Codeql MCP
MCP server · Developer Tools

Codeql MCP

This project runs a Model Context Protocol (MCP) server that wraps the CodeQL query server. It enables tools like [Cursor](https://cursor.sh/) or AI agents to interact with CodeQL through structured commands.

Unclaimed last commit a year ago devtools
59Fair

Scored 6 months ago · breakdown

About Codeql MCP

Codeql MCP is an MCP server published by JordyZomer in the Developer Tools category: this project runs a Model Context Protocol (MCP) server that wraps the CodeQL query server. It enables tools like [Cursor](https://cursor.sh/) or AI agents to interact with CodeQL through structured commands.

The repository has 147 stars and 21 forks, with the last commit a year ago. Six months or more without a commit doesn't mean the server is broken, but check the open issues before depending on it in production.

Install

From source
git clone https://github.com/JordyZomer/codeql-mcp

This server has no ConduID identity, so agent calls to it are not receipted. Pin the version you install and review the source before granting it credentials.

Ask AI

✦

Ask AI about Codeql MCP

Powered by Claude · Grounded in docs

I know everything about Codeql MCP. Ask me about installation, configuration, usage, or troubleshooting.

Security checks

Static checks derived from the repository 5 days ago. Heuristics on the source, not an audit.

  • ✓README presentThe repository ships documentation.
  • !License declaredNo license file. Legally you have no right to use it in a product.
  • !Tests presentNo tests found. Behaviour changes may go unnoticed between versions.
  • !Dependencies pinnedNo lockfile. Installs can pull different code over time.
  • ✓No dynamic code executionSource scan found no eval, dynamic Function, or shell execution.
  • !Scoped permissionsDoesn't declare a permission scope. Assume it can do anything its process can.

README

CodeQL MCP Server

This project runs a Model Context Protocol (MCP) server that wraps the CodeQL query server. It enables tools like Cursor or AI agents to interact with CodeQL through structured commands and doc search.


Features

  • ✅ Register CodeQL databases
  • ✅ Run full queries or quick-evaluate a symbol
  • ✅ Decode .bqrs files into JSON
  • ✅ Locate predicate/class symbol positions

File Structure

File Purpose
server.py Main FastMCP server exposing CodeQL tools
codeqlclient.py CodeQLQueryServer implementation (JSON-RPC handler)

Requirements

Install with uv:

uv pip install -r requirements.txt

or with pip:

pip install fastmcp httpx

Running the MCP Server

uv run mcp run server.py -t sse
  • Starts the server at http://localhost:8000/sse
  • Required for Cursor or AI agent use

Cursor Config

Make sure your .cusor/config.json contains:

{
  "mcpServers": {
    "CodeQL": {
      "url": "http://localhost:8000/sse"
    }
  }
}

Notes

  • Tools like Cursor will invoke these commands directly via natural language.
  • You must have a codeql binary in your $PATH, or hardcode its path in codeqlclient.py.
  • You should probably specify query locations, query write locations and database paths in your prompts.

README fetched from the repository 5 days ago. The original is authoritative.

Questions

About Codeql MCP

How do I install Codeql MCP?

No package has been published for this server, so install it from source: clone the repository and follow its README.

Is Codeql MCP safe to use with an AI agent?

Its trust score is 59 out of 100 (fair). It passes 2 of the 6 static security checks run so far; the failures are listed above. It has no ConduID identity yet, so agent calls to it are not receipted.

Is Codeql MCP still maintained?

The last commit was a year ago and 4 open issues. That's long enough that you should check whether the maintainer is responding to issues before depending on it.