# Install codeql with Homebrew Cask

Semantic code analysis engine. Version 2.26.1 via Homebrew Cask; verified 2026-07-16. Also installable with nix: nix profile install nixpkgs#codeql.

## Install

```sh
sudo av install cask:codeql
```

Additional install commands:

### macOS

- Homebrew Cask (100%):

```sh
brew install --cask codeql
```

  Evidence: local Homebrew cask metadata

## Package facts

- **Package key:** cask:codeql
- **Package manager:** Homebrew Cask
- **Package manager page:** <https://formulae.brew.sh/cask/codeql>
- **Version:** 2.26.1
- **Source summary:** Semantic code analysis engine
- **Homepage:** <https://codeql.github.com/>
- **Repository:** <https://github.com/github/codeql-cli-binaries>
- **Upstream docs:** <https://codeql.github.com/>
- **Source archive:** <https://github.com/github/codeql-cli-binaries/releases/download/v2.26.1/codeql-osx64.zip>
- **Last updated:** 2026-07-16T10:20:31Z
- **Generated:** 2026-07-25T07:20:51+00:00

## Executables

- codeql (binary)
- codeql (alias)

## Install behavior

- Post-install hook: not defined
- Bottle: not available

## Freshness

- Page generated: 2026-07-25
- Package-manager version: 2.26.1
- Package-manager updated: 2026-07-16
- Local data: ok
- Upstream repository: https://github.com/github/codeql-cli-binaries
- info: No cached GitHub release or tag data was available.
## Project history and usage

CodeQL is GitHub's semantic code analysis engine and query language, packaged for command-line use through the CodeQL CLI. It is used for code scanning, security research, custom queries, and CI analysis.

### Project history

CodeQL originated at Semmle, whose semantic analysis technology was acquired by GitHub in 2019. GitHub subsequently made CodeQL central to GitHub Advanced Security and to code scanning workflows, with the CLI distributed from GitHub-controlled release repositories.

### Adoption history

Adoption moved from security research and Semmle users into GitHub's hosted code scanning product, GitHub Actions workflows, and enterprise security programs. The CLI remains important for users who need local analysis, custom queries, alternative CI systems, or prebuilt CodeQL databases.

### How it is used

The CLI creates CodeQL databases, runs queries, analyzes code, produces SARIF results, manages CodeQL packs, and uploads results to GitHub code scanning. GitHub recommends the CodeQL bundle because it includes the CLI plus compatible queries and libraries.

### Why package nerds care

Package nerds care because the Homebrew cask wraps a large, versioned security-analysis toolchain that is otherwise commonly installed from GitHub release bundles. Its formula/cask packaging makes CodeQL feel like a normal terminal tool despite its bundled queries, extractors, and platform-specific binaries.

### Timeline

- 2019: GitHub creates the codeql-cli-binaries repository for CLI binaries.
- 2019: GitHub acquires Semmle, bringing CodeQL into GitHub.
- 2020: CodeQL becomes a core part of GitHub code scanning and Advanced Security workflows.
- 2026: Homebrew cask distributes CodeQL CLI 2.25.6.

### Related projects

- Related projects include github/codeql for queries and libraries, github/codeql-action for GitHub Actions integration, GitHub code scanning, SARIF tooling, and CodeQL for Visual Studio Code.

### Sources

- <https://github.com/github/codeql-cli-binaries>
- <https://docs.github.com/en/code-security/codeql-cli>
- <https://docs.github.com/api/article/body?pathname=/en/code-security/how-tos/find-and-fix-code-vulnerabilities/scan-from-the-command-line/set-up-codeql-cli>
- <https://formulae.brew.sh/api/cask/codeql.json>


## Security Notes

No matching local secret-handling manifest was found for codeql. Nucleus package metadata is still published here so future coverage has a stable package URL.


## Source Database Details

- **Source Database:** Homebrew cask API
- **Tap:** homebrew/cask
- **Full Token:** codeql
- **Names:** CodeQL
- **Artifacts:** Binary: 1, Target: 1
- **Deprecated:** no
- **Disabled:** no

## Other Package-Manager Records

- Nix - codeql: normalized package name match | nixpkgs package indexes: pkgs/by-name/co/codeql/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1
- Scoop - main/codeql: normalized package name match | Scoop official bucket manifest trees: bucket/codeql.json from https://api.github.com/repos/ScoopInstaller/Main/git/trees/master?recursive=1


## Related links

- [Homebrew Cask packages](https://www.automicvault.com/pkg/homebrew-cask-packages/) - Generated from Homebrew Cask package-manager metadata.
- [Homebrew Cask binaries](https://www.automicvault.com/pkg/homebrew-cask-binaries/) - Cask artifact metadata includes a binary.

## Combined YAML source

View the package source record on GitHub. [combined/codeql.yml](https://github.com/automic-vault/db/blob/main/combined/codeql.yml)


## Sources

- Nucleus package database
- package-page enrichment
- curated package history
- package version freshness
- av.db category and tag curation
- package relationship graph
- external package-manager database matches
- cross-ecosystem install command graph