---
name: CodeQL Audit
slug: codeql-audit
category: Quality
description: CodeQL Audit builds a CodeQL database and runs query suites through the mantis_codeql MCP server. Use it for dataflow-aware SAST when you need source-to-sink analysis beyond pattern matching tools.
github: "https://github.com/deonmenezes/mantishack/tree/main/.codex/skills/codeql-audit"
language: Rust
stars: 490
forks: 73
install: "npx degit https://github.com/deonmenezes/mantishack/tree/main/.codex/skills/codeql-audit ~/.claude/skills/codeql-audit"
installs_to: ~/.claude/skills/codeql-audit
source_path: .codex/skills/codeql-audit/SKILL.md
collection_size: 25
category_size: 1354
collection_url: "https://dirskills.com/collections/deonmenezes/mantishack"
added: 2026-08-26T05:13:13.872Z
last_synced: 2026-08-26T05:13:13.872Z
canonical_url: "https://dirskills.com/skills/codeql-audit"
---

# CodeQL Audit

CodeQL Audit builds a CodeQL database and runs query suites through the mantis_codeql MCP server. Use it for dataflow-aware SAST when you need source-to-sink analysis beyond pattern matching tools.

**Install:**

```bash
npx degit https://github.com/deonmenezes/mantishack/tree/main/.codex/skills/codeql-audit ~/.claude/skills/codeql-audit
```

## README

Use `codeql_create_database` then `codeql_analyze` (mantis_codeql MCP server) when you need dataflow-aware SAST beyond what regex/pattern tools (semgrep, ast-grep) can prove -- CodeQL's query suites trace actual source-to-sink data flow through the codebase.

Workflow:
1. `codeql_create_database({ source_root, language, database_path })` once per target/language. This is slow (can take minutes on large repos); don't repeat it unless the source changed.
2. `codeql_analyze({ database_path, query_suite })`. Default `query_suite` is `"security-extended"`; use `"security-and-quality"` only if the user wants broader quality findings too.
3. Treat every SARIF result as a `candidate` with a dataflow-backed path, which is stronger recall evidence than a plain grep match -- but it is still not a confirmed finding. CodeQL's own dataflow models can miss framework-specific sanitization; verify the path manually before validating.
4. If `codeql` reports `available: false`, fall back to `semgrep_scan` and `program-analysis`'s `source_sink_scan`/`ast_grep_scan` for recall, and tell the user CodeQL-grade dataflow coverage wasn't available for this run.