Side by side
GitHub CodeQL vs Semgrep Supply Chain
Both stand on ruby static analysis tools. Which one you can start free with, which one lets you read the code, and what each costs once you pay.
Free plan ExtensionLinuxMac+3
Visit GitHub CodeQL 
Free plan APILinuxMac+2
Semgrep Supply Chain combines dependency security, reachability analysis, malware detection, and upgrade workflows in one service. Its free tier has clear repository and contributor limits, while paid plans add capacity and support.
Visit Semgrep Supply ChainThe facts
| GitHub CodeQL | Semgrep Supply Chain | |
|---|---|---|
| Free plan | Yes | Yes |
| Open source | Not published | Not published |
| Runs on | Extension, Linux, Mac, Self-hosted, Web, Windows | API, Linux, Mac, Self-hosted, Web |
| Lowest paid plan | See the plans | Teams — Supply Chain: $30 per contributor a month |
| Plans published | 4 | 3 |
| Maker | Not published | Not published |
| Website | codeql.github.com | semgrep.dev |
| On ruby static analysis tools | #4 of 21 | #8 of 21 |
GitHub CodeQL: what it does well
Semgrep Supply Chain: what it does well
- Detects vulnerabilities and malicious dependencies
- Code-aware reachability analysis
- SBOM and license compliance tools
- Autofix pull requests and upgrade guidance
- Hybrid deployment with local code handling
What to know first
- Free Edition limited to 10 repositories
- Free Edition limited to 10 contributors
- REST API access listed for Teams and Enterprise
- Enterprise pricing is custom
Alternatives to GitHub CodeQL Alternatives to Semgrep Supply Chain The whole list