Side by side
GitHub CodeQL vs Semgrep Code
Both stand on sast tools. Which one you can start free with, which one lets you read the code, and what each costs once you pay.
Free plan ExtensionLinuxMac+3
Visit GitHub CodeQL 
Free plan Open source APIExtensionLinux+4
Semgrep Code pairs static analysis with AI analysis and remediation guidance for findings. The Free Edition has repository and contributor caps; paid options include Teams at $30/month/contributor and an Enterprise plan with no repository or contributor limit.
Visit Semgrep CodeThe facts
| GitHub CodeQL | Semgrep Code | |
|---|---|---|
| Free plan | Yes | Yes |
| Open source | Not published | Yes |
| Runs on | Extension, Linux, Mac, Self-hosted, Web, Windows | API, Extension, Linux, Mac, Self-hosted, Web, Windows |
| Lowest paid plan | GitHub Code Security: $30 a month | Teams Secrets: $15 a month |
| Plans published | 4 | 6 |
| Maker | Not published | Not published |
| Website | codeql.github.com | semgrep.dev |
| On sast tools | #5 of 25 | #1 of 25 |
GitHub CodeQL: what it does well
Semgrep Code: what it does well
- Supports 35+ programming languages.
- Provides remediation instructions in pull requests.
- Integrates with source-control and CI tools.
- Free Edition allows up to 10 repositories.
- Local and fully CI-based scans keep code in the user's environment.
What to know first
- Free Edition allows a maximum of 10 contributors.
- Teams is limited to 500 private repositories.
- AI processing sends part of a finding's file to a model.
Alternatives to GitHub CodeQL Alternatives to Semgrep Code The whole list