CodeQL for Visual Studio Code: querying databases and reading path results

An editor extension that tracks an upstream product

github/vscode-codeql is the CodeQL extension for Visual Studio Code, and the project description says it plainly: an extension that adds rich language support for CodeQL. It is used to find problems in code bases using CodeQL, and it is written primarily in TypeScript.

The scope is stated just as plainly. The project tracks new feature development in CodeQL and, whenever appropriate, brings that functionality into the Visual Studio Code experience. That sentence is the most important line in the readme for anyone planning an adoption, because it means the feature list is set upstream. You are not choosing a query tool here, you are choosing a front end for a tool that GitHub develops and releases on its own schedule.

The extension is released rather than a development build. It is distributed through the Visual Studio Marketplace, and the marketplace listing is the project homepage. Changes between versions are tracked in a Changelog kept in the repository at extensions/ql-vscode/CHANGELOG.md.

The repository itself is a monorepo. Alongside the extensions/ directory it has syntaxes/ for the CodeQL grammar, docs/, a CODEOWNERS file, a CODE_OF_CONDUCT, CONTRIBUTING.md, an .editorconfig, a .markdownlint.json and a .husky directory for git hooks. The topic tags include works-with-codespaces, so the extension is meant to be usable in a Codespace as well as on a laptop.

Path flow is the feature that makes results triagable

Five features are listed, and the second one is the reason a security team would install the extension rather than run the command line tool.

The extension shows the flow of data through the results of path queries, and the readme calls this essential for triaging security results. A CodeQL path query produces a sequence of steps from a source to a sink, and the raw text of those steps is close to unreadable on a real finding. Rendering the flow inside the editor turns a list of program fragments into a path you can follow and argue about in a review.

That framing also tells you what the extension is not trying to do. It is not a dashboard, a triage queue or a findings database. It is the layer that makes one result at a time legible, which means the questions it answers are local: is this path reachable, does this intermediate step matter, is the sanitiser here doing what its name suggests.

For an engineer who is new to CodeQL, this is the part worth spending time on first, because the difference between understanding a finding and dismissing it is mostly about seeing the path.

Querying databases and borrowing from the open query repository

The remaining features cover the everyday loop of writing and running a query.

The first is the core capability: you can use CodeQL to query databases and discover problems in code bases. The third is the shortcut to the other half of that loop, an easy way to run queries from the large, open source repository of CodeQL security queries. Those two are what the extension is for, and the query library is not something the extension ships itself. It is a separate repository, github/codeql, and the extension is the client for it.

The fourth feature is about authoring rather than running. The extension adds IntelliSense to support writing and editing your own CodeQL query and library files. That is a narrower promise than it sounds: it means completions and signatures for the QL language inside the editor, so a custom query can be written without leaving the editor or guessing the shape of a library predicate.

Taken together, the four features describe a complete authoring loop: browse the shared query library, adapt a query or write your own, run it against a database, and read the path result. What none of them mention is the database creation step, which is where the command line tool and the CI pipelines usually sit.

Variant analysis spreads one query across thousands of repositories

The fifth feature is the one that scales beyond a single checkout, and it deserves to be read carefully rather than skimmed.

The extension supports running CodeQL queries against thousands of repositories on GitHub using multi-repository variant analysis. Variant analysis works by generalising a query into variants and applying each of them across a set of repositories, so a single pattern can surface similar problems in code that was never going to be reviewed by hand. Doing that from inside the editor means the same generalisation step that normally lives in a CI job can be explored interactively.

The readme does not describe the mechanics of the variant generation, the repository selection or the result handling, so an evaluation has to test this against a real query set rather than trust a description. It is also the feature most sensitive to the upstream product, because it depends on GitHub hosting the analysis and on the CodeQL version that the extension resolves to.

For most users this is a secondary capability. For a team that wants to know whether a newly published pattern affects their whole dependency set, it is the reason to use the extension rather than a local CodeQL CLI.

Two licences apply, and only one of them is MIT

The licensing note in this repository is unusually precise, and it is easy to skim past the second sentence.

The CodeQL extension for Visual Studio Code is licensed under the MIT License, with the licence file at the root of the repository. MIT is permissive: no copyleft obligation, no share-alike requirement, and the obligation to keep the copyright notice. Shipping the extension inside your own tooling is straightforward on those terms.

The second sentence is the one that matters. The version of CodeQL used by the CodeQL extension is subject to the CodeQL Research Terms and Conditions, a separate document hosted by the CodeQL security lab. So the MIT grant covers the extension's own source, while the analyser it drives is licensed differently, and the two licences travel together whenever you use the extension.

That is a licensing note rather than legal advice, and the practical consequence is narrow. If you intend to run CodeQL against code you do not own, read the research terms as well as the MIT file, because the extension's licence does not settle that question. The same repository also asks that the GitHub logos are used according to the GitHub logo guidelines, which is a separate condition on the branding rather than on the code.

Releases arrive slowly while commits keep landing

The maintenance pattern here is worth understanding before you pin a version.

The last push was on 2026-10-20 and the repository is not archived, so work continues. The published releases tell a slower story: v1.17.8 on 2026-07-17, v1.17.7 on 2025-12-08 and v1.17.6 on 2025-10-24. The gap between those three versions is roughly nine months, and the gap between the last release and the last commit is a few weeks.

That combination is normal for an extension that must stay compatible with a moving upstream product. CodeQL ships on its own cadence, and the extension has to be tested against a specific CodeQL version before it goes out, so commits accumulate between release dates.

It does have a practical consequence for teams. There is no published release that is more recent than the July version, so anything new in the repository after that date is unreleased and not something the marketplace will hand you. Pinning to a released version means accepting an older CodeQL underneath it.

Two more details are visible in the repository itself. The CI workflow builds the extension and carries a status badge in the readme, and the .husky/ directory holds git hooks, which suggests commits are checked before they land.

Editorial conclusion

Adopt this extension if you already work with CodeQL and want the query loop inside the editor, especially if your review work depends on reading a path result from the sink back to the source. Do not adopt it expecting a complete CodeQL workflow, since the documentation does not cover how to create databases, choose packs or authenticate, and the CodeQL version that runs inside it is licensed separately under the Research Terms. Verify first which CodeQL version the extension resolves to, because the upstream CodeQL release cycle decides what the extension can offer, and that the path flow view is what your triage process actually needs before you spend time configuring anything.

Frequently asked questions

Official sources

1. github/vscode-codeql on GitHub
2. License: MIT
3. Project website
4. README
5. Releases