The request names CodeQL, GitHub's static analysis engine for finding security vulnerabilities via code scanning; the most direct source is GitHub, whose indexed action documents setting up and configuring CodeQL code scanning via GitHub Actions and the CodeQL CLI 1. Trail of Bits also indexes a CodeQL action that scans codebases using interprocedural data flow and taint tracking, and a SARIF parser for CodeQL output 2. LGTM.com, which ran on the same CodeQL analysis technology, is being gra
- 1
GitHubgithub.comverified and signed
Hosts CodeQL code scanning, with an indexed guide for setting up CodeQL via GitHub Actions workflows and the CodeQL CLI 1.
official:MCP server · @github/mcp-registrySDK · @github/copilot-sdklibrary · CodeQL: StubCLI · specifyrepository · copilot-engine-sdk+2,577 community tools built for it
for agents: github/codeql-action · codeql · security-review
- 2
- 3
LGTM.comlgtm.comverified and signed
Earlier CodeQL-based analysis service exposing a LGTM API; its deprecation in favor of GitHub code scanning is announced 3.
official:API · LGTM API specification+6 community tools built for it
for agents: createQueryJob · requestAnalysis · getCodeReview
Sources
- 1GitHub · Change is constant. GitHub keeps you ahead. · GitHub · GitHubgithub.com · read 2026-10-29
- 2Trail of Bits: Security Research, Audits, and Toolstrailofbits.com · read 2026-10-29
- 3The next step for LGTM.com: GitHub code scanning! - The GitHub Bloggithub.blog · read 2026-10-29
For agents: the 10 actions behind this answer
github/codeql-action · CodeQL: Stub verified and signed
Stub: Don't use this action directly. Read [the documentation](https://docs.github.com/en/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning-with-codeql) instead.
codeql · codeql verified and signed
Scans a codebase for security vulnerabilities using CodeQL's interprocedural data flow and taint tracking analysis. Triggers on "run codeql", "codeql scan", "build codeql database", "SAST scan", "taint analysis", "dataflow analysis", or "find vulnerabilities in this repo". Covers Python, JavaScript/
createQueryJob · LGTM API specification verified and signed
Run a CodeQL query on one or more projects
semgrep · semgrep verified and signed
Run Semgrep static analysis scans and create custom detection rules. Use when asked to scan code with Semgrep, find security vulnerabilities, write custom YAML rules, or detect specific bug patterns. IMPORTANT: Also use this skill when users ask to 'scan for bugs', 'check code quality', 'find vulner
datadog · datadog verified and signed
Use Datadog directly in Claude Code through a preconfigured Datadog MCP server. Query logs, metrics, traces, dashboards, and more through natural conversation. This plugin is in preview.
scanning-with-aws-security-agent · scanning-with-aws-security-agent verified and signed
Run an AWS Security Agent scan on the workspace — uploads the source to AWS, scans it with the managed Security Agent service, and returns ranked, verified findings with code locations and remediations. Use when the user asks to scan code, find vulnerabilities, run a security scan or review, check s
zizmorcore/zizmor-action · zizmor-action verified and signed
Run zizmor from GitHub Actions 🌈
codacy/codacy-analysis-cli-action · Codacy Analysis CLI verified and signed
Execute Codacy code analysis using your remote Codacy configuration
· detekt website read, tools not yet checked
The official website of detekt - A static analyzer for Kotlin
JetBrains/ReSharper-InspectCode · JetBrains ReSharper Inspect Code verified and signed
C# static analysis tool
Labels are the instruments' verdict and are never changed by ranking. Agents and robots get this same answer as JSON at /api/v1/find?q=…&answer=1 and through the MCP server.