Semgrep vs CodeQL
Feature checklists rarely decide anything. What decides it is the pricing metric, who has to write the tests, and which limitation you can live with.
Entry price
From $30 per contributor/month (Teams, per product)
Free tierFrom $30 per active committer/month (GitHub Code Security)
Free tierWhat drives the bill
The metric that actually scales your invoice.
The CLI plus community rules costs nothing and covers a lot. Teams is priced per product per contributor — Code $30, Supply Chain $30, Secrets $15 — so scanning for all three multiplies the per-contributor figure.
Free on public repos. For private repositories GitHub split Advanced Security into two products in April 2025: Code Security at $30 and Secret Protection at $19 per active committer/month, both now available on Team plans as well as Enterprise. CodeQL sits in Code Security. Billing counts active committers, not seats, which can surprise teams with many occasional contributors.
Free tier
Open-source CLI is free and complete; hosted platform free for up to 10 contributors.
Free for public repositories on GitHub.
Open source
LGPL-2.1 (CLI)
MIT (queries)
Self-hostable
No-code authoring
Languages
Platforms
Fits teams
Adoption
Widely used
Semgrep · since 2020
Widely used
GitHub (Microsoft) · since 2019
Strengths
- Custom rules are genuinely writable — you can encode your own security or architecture standards in an afternoon.
- Free CLI with a large community rule registry is immediately useful.
- Fast enough to run on every pull request without complaint.
- Interprocedural dataflow analysis finds real vulnerabilities that regex- and pattern-based tools cannot see.
- Free on public repositories, with results in the GitHub security tab.
- Custom queries let you encode organisation-specific security rules.
Limitations
- Pattern matching without full dataflow misses some vulnerability classes.
- Community rule quality is uneven; expect to curate.
- Advanced dataflow and supply-chain features are paid only.
- Writing custom CodeQL queries is a specialist skill with a steep learning curve.
- Analysis is slow — minutes to tens of minutes, so it fits nightly better than per-commit.
- Private-repo licensing through Advanced Security is expensive at scale.
Best for
Teams that want customisable static analysis and can start entirely for free.
GitHub-hosted projects wanting deep static security analysis, free if the repo is public.
All of these integrate with: Jenkins, VS Code.
Pricing last reviewed August 2026 and is indicative only — confirm on each vendor’s own page.