Semgrep, CodeQL and SonarQube are static analysis tools that scan source code, but they are built differently. Semgrep matches patterns with data flow, CodeQL queries a database built from your code, and SonarQube combines code quality with security analysis. Their licensing terms differ too.
Safeguard publishes this guide and sells a competing product, so we describe other tools only from their own documentation. Facts below are as of 19 October 2026.
Key takeaways
- Semgrep Community Edition analyzes within a single function. Semgrep Code adds cross-function and cross-file analysis.
- CodeQL builds a database from your code and runs QL queries. Its CLI license limits use on private code unless you hold a paid GitHub Advanced Security license.
- SonarQube's Community Build covers 22 languages and frameworks. Taint analysis is listed starting at the Developer edition.
- No single tool is right for every team. Language coverage and licensing are usually the first filters.
How do Semgrep, CodeQL and SonarQube analyze code differently?
They use three different models, and each has its own strengths from the docs.
Semgrep. Semgrep Code's docs say rules combine pattern matching and data flow analysis, and that a match generates a finding. You can run it on local repositories or in CI/CD, and write custom rules. The docs describe the Community Edition (CE) as intraprocedural, meaning it analyzes within a single function. Semgrep Code does cross-function analysis within a file by default, and also supports cross-file (interfile) analysis. The docs say cross-file analysis yields fewer false positives and more true positives but takes longer.
CodeQL. CodeQL's docs describe a two step process. First it extracts a relational representation of the code into a CodeQL database, holding the abstract syntax tree, data flow graph and control flow graph. For compiled languages, the extractor monitors the normal build. Then you run queries written in QL. The docs also describe variant analysis, where a known vulnerability seeds a search for similar bugs across many repositories.
SonarQube. The docs describe a platform for code quality and security analysis that finds bugs, vulnerabilities, security hotspots, code smells and architecture issues. It is offered as SonarQube Server (self-managed), SonarQube Cloud (SaaS) and SonarQube for IDE. Security capabilities listed include SAST, taint analysis, secrets detection and IaC scanning.
Which languages does each tool support?
CodeQL's supported list is documented in full, while Semgrep and SonarQube describe coverage more loosely.
- CodeQL: C/C++, C#, GitHub Actions, Go, Java, Kotlin, JavaScript, Python, Ruby, Rust, Swift and TypeScript, with version ranges on its supported languages page.
- SonarQube: 40+ languages and frameworks across the product. The Community Build lists 22, Developer adds 18 more, and Enterprise adds 8 more such as Apex, COBOL, RPG and VB6.
- Semgrep: the docs say Semgrep Code supports a broad set of languages with varying analysis capabilities and maturity levels. Check the current language table before you commit.
What are the licensing and cost differences?
Licensing is where these tools differ most, so read the terms before you adopt one.
- CodeQL: the CodeQL CLI license permits analysis of open source codebases and academic research. It prohibits use on code that is not an open source codebase unless you hold a paid GitHub Advanced Security license. Generating databases for CI or CD is also limited to open source code hosted on GitHub.com, unless that paid exception applies.
- SonarQube: the Community Build is described as free and open source. Developer and Enterprise offer a 14 day free trial, and pricing for some features is through sales.
- Semgrep: Semgrep Code is enabled in the Semgrep AppSec Platform. The pages we read did not state its pricing, and we do not quote any.
Comparison table
| Criteria | Semgrep | CodeQL | SonarQube |
|---|---|---|---|
| Approach | Pattern matching plus data flow | Query a code database with QL | Quality and security rules |
| Analysis depth | CE: single function. Code: cross-function and cross-file | Data flow and control flow graphs | Taint analysis listed from Developer edition |
| Languages | Broad, see docs | 12 listed languages | 22 in Community Build, more in paid editions |
| Deployment | Local, CI, AppSec Platform | CLI, VS Code, GitHub code scanning | Server, Cloud, IDE |
| Custom rules | Yes | Yes, in QL | Not detailed on the pages we read |
| Licensing note | Platform needed for Semgrep Code | Private code needs paid GitHub license | Community Build free and open source |
How to choose
- List your languages and check each tool's current support table.
- Check your code hosting. CodeQL's license terms matter if your code is private.
- Decide whether you need quality rules, security rules, or both.
- Decide how deep analysis must go, single function versus cross-file.
- Ask who will write and maintain custom rules.
- Run each tool on one repository and compare false positives by hand.
You can see what a SAST result and triage view looks like in this demo.
Click through it at your own pace, or open it full screen.
Frequently asked questions
Is Semgrep Community Edition the same as Semgrep Code?
No. The docs say CE analyzes within a single function, while Semgrep Code adds cross-function and cross-file analysis.
Can I use CodeQL on a private repository for free?
The CodeQL CLI license limits use to open source codebases unless you hold a paid GitHub Advanced Security license. Read the current license text for your case.
Does SonarQube do taint analysis in the free edition?
On the edition table we read, taint analysis is listed from the Developer edition up, not for Community Build.
Which one has the most languages?
SonarQube's docs cite 40+ across all editions. CodeQL lists 12 languages. Compare against your own stack rather than the totals.
Sources
- Semgrep Code overview: https://docs.semgrep.dev/semgrep-code/overview
- CodeQL about page: https://codeql.github.com/docs/codeql-overview/about-codeql/
- CodeQL supported languages: https://codeql.github.com/docs/codeql-overview/supported-languages-and-frameworks/
- CodeQL CLI license: https://github.com/github/codeql-cli-binaries/blob/main/LICENSE.md
- SonarQube overview: https://docs.sonarsource.com/what-is-sonarqube.md
- SonarQube editions: https://www.sonarsource.com/products/sonarqube/downloads/
Last reviewed: 19 October 2026.
