Repositories list

• codeql-development-mcp-server

  Public
  LLM <-- MCP --> CodeQL( AST | CFG | CLI | LSP )

  mcpstatic-analysisast+ 6

  mcpstatic-analysisastcode-qualitycfglspcode-securitycodeqlcopilot-enabled

  TypeScript

  •

  Other

  •22 forks•1919 stars•88 issues•11 pull request•Updated Apr 23, 2026Apr 23, 2026

• enterprise-security-team

  Public

  advanced-security/enterprise-security-team’s past year of commit activity
  Manage a uniform team of security managers for every organization in your enterprise

  enterpriseghas

  enterpriseghas

  Python

  •

  MIT License

  •66 forks•2424 stars•00 issues•11 pull request•Updated Apr 23, 2026Apr 23, 2026

• codeql-extractor-iac

  Public
  CodeQL Extractor, Library, and Queries for Infrastructure as Code

  CodeQL

  •

  MIT License

  •1212 forks•5959 stars•1313 issues•66 pull requests•Updated Apr 23, 2026Apr 23, 2026

• codeql-sarif-security-standard-annotator

  Public

  advanced-security/codeql-sarif-security-standard-annotator’s past year of commit activity
  Compare a CodeQL SARIF results file to a security standard CWE list and annotate the SARIF rules with a tag to highlight results applicable to the security stan…

  TypeScript

  •

  MIT License

  •11 fork•1010 stars•11 issue•44 pull requests•Updated Apr 23, 2026Apr 23, 2026

• codeql-development-template

  Public template

  advanced-security/codeql-development-template’s past year of commit activity
  Copilot-native repository template for CodeQL query development

  CodeQL

  •

  MIT License

  •22 forks•99 stars•22 issues•22 pull requests•Updated Apr 23, 2026Apr 23, 2026

• codeql-extractor-action

  Public

  advanced-security/codeql-extractor-action’s past year of commit activity
  specify a CodeQL extractor to be used in your workflows as an author of an Extractor.

  Rust

  •

  MIT License

  •00 forks•22 stars•11 issue•1111 pull requests•Updated Apr 23, 2026Apr 23, 2026

• advanced-security-material

  Public

  advanced-security/advanced-security-material’s past year of commit activity
  securitycode-scanningcodeql+ 2

  securitycode-scanningcodeqladvanced-securityadvanced-security-training

  Shell

  •2626 forks•7777 stars•11 issue•44 pull requests•Updated Apr 22, 2026Apr 22, 2026

• validate-secrets

  Public

  advanced-security/validate-secrets’s past year of commit activity
  Extensible secret validation tool for GitHub Secret Scanning and beyond.

  Python

  •

  MIT License

  •22 forks•22 stars•11 issue•11 pull request•Updated Apr 22, 2026Apr 22, 2026

• codeql-sap-js

  Public

  advanced-security/codeql-sap-js’s past year of commit activity
  CodeQL models for SAP JavaScript frameworks CAP, UI5 and XSJS

  TypeScript

  •

  MIT License

  •44 forks•77 stars•1010 issues•11 pull request•Updated Apr 22, 2026Apr 22, 2026

• dismiss-alerts

  Public
  Dismiss GitHub Code Scanning alerts from SARIF suppression data

  sarifcode-scanningsast+ 3

  sarifcode-scanningsastcode-securityghasgithub-advanced-security

  Java

  •

  MIT License

  •44 forks•2121 stars•22 issues•88 pull requests•Updated Apr 21, 2026Apr 21, 2026

• mrva-report-docs

  Public

  advanced-security/mrva-report-docs’s past year of commit activity
  Documentation for the MRVA reporting pipeline - architecture, CLI reference, and developer guide for transforming CodeQL multi-repository variant analysis resul…

  CSS

  •

  MIT License

  •00 forks•22 stars•00 issues•00 pull requests•Updated Apr 21, 2026Apr 21, 2026

• mrva-reports

  Public
  A Blazor WebAssembly app for visualizing GitHub CodeQL Multi-Repository Variant Analysis (MRVA) results

  C#

  •

  MIT License

  •00 forks•11 star•00 issues•00 pull requests•Updated Apr 21, 2026Apr 21, 2026

• mrva-prep

  Public
  CLI tool that optimizes MRVA SQLite databases for the Blazor WebAssembly reports UI

  Go

  •

  MIT License

  •00 forks•11 star•00 issues•00 pull requests•Updated Apr 21, 2026Apr 21, 2026

• sarif-sql

  Public
  A Go CLI for managing GitHub MRVA workflows and transforming SARIF results into SQLite for analytics

  Go

  •

  MIT License

  •00 forks•11 star•00 issues•00 pull requests•Updated Apr 21, 2026Apr 21, 2026

• generate-sbom-action

  Public

  advanced-security/generate-sbom-action’s past year of commit activity
  An Action to wrap creating an SBOM via REST API

  TypeScript

  •

  MIT License

  •55 forks•2020 stars•11 issue•1212 pull requests•Updated Apr 20, 2026Apr 20, 2026

• spdx-dependency-submission-action

  Public
  upload an SPDX 2.2 formatted SBOM to GitHub's dependency submission API

  JavaScript

  •

  MIT License

  •66 forks•2424 stars•44 issues•44 pull requests•Updated Apr 20, 2026Apr 20, 2026

• maven-dependency-submission-action

  Public
  GitHub Action for submitting Maven dependencies

  TypeScript

  •

  MIT License

  •3737 forks•5858 stars•1616 issues•44 pull requests•Updated Apr 20, 2026Apr 20, 2026

• codeql-scanner-vscode

  Public
  CodeQL Plugin for VSCode to help scan and view alerts in code

  TypeScript

  •

  MIT License

  •22 forks•55 stars•11 issue•55 pull requests•Updated Apr 20, 2026Apr 20, 2026

• component-detection-dependency-submission-action

  Public
  This GitHub Action runs the microsoft/component-detection library to automate dependency extraction at build time.

  github-actions

  github-actions

  TypeScript

  •

  MIT License

  •2929 forks•2121 stars•44 issues•66 pull requests•Updated Apr 20, 2026Apr 20, 2026

• secret-scanning-notifications

  Public
  A GitHub Action that sends email notifications to security manager team for any new or resolved secret scanning alerts based on a set frequency

  TypeScript

  •

  MIT License

  •33 forks•11 star•00 issues•1313 pull requests•Updated Apr 20, 2026Apr 20, 2026

• conda-dependency-submission-action

  Public
  GitHub Action that scans Conda manifest files and submits their dependencies to GitHub's Dependency Graph,

  dependency-graphcondadependabot+ 1

  dependency-graphcondadependabotdependency-graph-api

  TypeScript

  •

  MIT License

  •33 forks•11 star•00 issues•88 pull requests•Updated Apr 20, 2026Apr 20, 2026

• sample-javascript-monorepo

  Public
  Detached fork of babel/babel to use as a TypeScript monorepo sample with 150+ packages using the monorepo-code-scanning-action https://github.com/advanced-secu…

  TypeScript

  •

  MIT License

  •11 fork•00 stars•00 issues•66 pull requests•Updated Apr 17, 2026Apr 17, 2026

• dependabot-kev-action

  Public
  Action to detect if any open Dependabot alerts are in the CISA Known Exploited Vulnerabilities (KEV) Catalog of CVEs and fail the workflow.

  PowerShell

  •

  MIT License

  •33 forks•88 stars•22 issues•11 pull request•Updated Apr 16, 2026Apr 16, 2026

• GSSAR

  Public
  GitHub Secret Scanning Auto Remediator (GSSAR)

  githubjavascriptaws+ 3

  githubjavascriptawstypescriptremediationsecret-scanning

  TypeScript

  •

  MIT License

  •1111 forks•4848 stars•33 issues•44 pull requests•Updated Apr 15, 2026Apr 15, 2026

• secret-scanning-tools

  Public
  Testing Suite for GitHub Secret Scanning Custom Patterns

  secret-scanninggithub-advanced-security

  secret-scanninggithub-advanced-security

  Python

  •

  MIT License

  •22 forks•88 stars•00 issues•77 pull requests•Updated Apr 15, 2026Apr 15, 2026

• security-report-action

  Public
  GitHub Action that can generate reports from GitHub Advanced Security and dependency vulnerability findings

  HTML

  •

  MIT License

  •00 forks•33 stars•22 issues•33 pull requests•Updated Apr 15, 2026Apr 15, 2026

• codeql-development-toolkit

  Public

  advanced-security/codeql-development-toolkit’s past year of commit activity
  The CodeQL Development toolkit is a tool for making common CodeQL development workflows easier.

  C#

  •

  MIT License

  •33 forks•99 stars•1111 issues•33 pull requests•Updated Apr 15, 2026Apr 15, 2026

• teams-secret-scanning-notifier-azure-function

  Public
  Microsoft Teams notifier for Secret Scanning alerts from GitHub Advanced Security, using a GitHub App and Azure Function

  github-appsecurity-teamazure-function+ 3

  github-appsecurity-teamazure-functionsecret-scanninggithub-advanced-securitymicrosoft-teams-bot

  TypeScript

  •

  MIT License

  •11 fork•88 stars•11 issue•00 pull requests•Updated Apr 15, 2026Apr 15, 2026

• slack-secret-scanning-notifier-azure-function

  Public
  Slack notifier for Secret Scanning alerts from GitHub Advanced Security, using a GitHub App and Azure Function

  slack-botsecret-scanninggithub-advanced-security

  slack-botsecret-scanninggithub-advanced-security

  TypeScript

  •

  MIT License

  •22 forks•33 stars•33 issues•00 pull requests•Updated Apr 15, 2026Apr 15, 2026

• awesome-secret-scanning

  Public
  A curated list of awesome GitHub Advanced Security secret scanning resources.

  awesome-listsecret-scanninggithub-advanced-security

  awesome-listsecret-scanninggithub-advanced-security

  PowerShell

  •

  MIT License

  •44 forks•1515 stars•00 issues•00 pull requests•Updated Apr 15, 2026Apr 15, 2026