VulnGraph vs GitHub CodeQL
Deep single-repo dataflow, meet cross-repo reasoning.
CodeQL performs deep semantic dataflow and taint analysis — within one repository. That depth is real and hard to match per-repo. VulnGraph operates across repositories: it stitches services into one architecture graph and follows taint across the boundaries CodeQL treats as the edge of the world. Different scope, naturally complementary.
| Capability | VulnGraph | GitHub CodeQL |
|---|---|---|
| Deep single-repo dataflow / taintCodeQL's core strength. | ~ | ✓ |
| Semantic query language | — | ✓ |
| Cross-service dataflow / taint analysis | ✓ | — |
| Cross-repository architecture graph | ✓ | — |
| Polyglot, language-agnostic (spec/graph level) | ✓ | ~ |
| SARIF / GitHub Code Scanning output | ✓ | ✓ |
✓ full · ~ partial · — not offered
When GitHub CodeQL fits
Choose CodeQL for the deepest possible analysis inside a single repository, with a powerful query language and GitHub-native integration.
When VulnGraph fits
Choose VulnGraph when the path leaves the repository — input in one service reaching a sink in another, across the boundaries a single-repo analyzer can't cross.
Using them together
Use both: CodeQL for per-repo depth, VulnGraph for the cross-repo network. Both publish to GitHub Code Scanning via SARIF.