GitHub CodeQL vs Semgrep Supply Chain
GitHub CodeQL
codeql.github.com
Semgrep Supply Chain
semgrep.devSide by side
| Figure | GitHub CodeQL | Semgrep Supply Chain |
|---|---|---|
| Price from | $30/mo | $30/mo |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | — |
| Web | Yes | Yes |
| Windows | Yes | — |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| API | — | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 5 | 3 |
| Spec score · Ruby Static Analysis Tools | 8.5 (#2) | 8.2 (#4) |
| Purpose | CodeQL is a language and toolchain for code analysis that treats code as data. | Semgrep Supply Chain detects vulnerabilities in open-source dependencies, blocks malware, and provides codebase-aware reachability analysis and upgrade guidance. |
Plans
GitHub CodeQL
- Free for research and open sourceFree
- GitHub Code Security$30 a month
- CodeQL for open source and researchFree
- GitHub Code Security$30 a month
- GitHub Free with CodeQL code scanningPrice not published
Semgrep Supply Chain
- Free EditionFree
- Teams — Supply Chain$30 a month
- EnterprisePriced on request
In their own words
GitHub CodeQL
GitHub CodeQL has no write-up on Specifiction yet; its figures are above.
Semgrep Supply Chain
Semgrep Supply Chain has no write-up on Specifiction yet; its figures are above.