CodeQL vs ESLint
Which should you use? A side-by-side look at what each one does, who it suits, what it costs, how hard it is to set up, and where each falls short.
Open source · MIT
The standard query libraries and checks behind GitHub's code scanning security tools.
Open source · MIT
A JavaScript linter that finds and reports problematic code patterns, with rules you can configure.
The short answer
Choose CodeQL if you need…
- Security researchers who want to study or extend CodeQL queries
- Developers learning how CodeQL queries are written and organized
- Contributors who want to improve the standard checks through pull requests
- Teams already using GitHub Advanced Security who want to understand its built-in checks
Choose ESLint if you need…
- JavaScript developers who want automatic checks on their code
- Teams that want consistent rules enforced in a shared configuration
- Projects that need to customize which code patterns are flagged
- Developers working with React who add a React-specific plugin on top
Side-by-side
| CodeQL | ESLint | |
|---|---|---|
| Type | Dev tool | Dev tool |
| Price | Free and open source | Free and open source |
| Licence | MIT | MIT |
| GitHub stars | 10.3k | 27.6k |
| Setup difficulty | Advanced | Intermediate |
| How you get it | Clone and build from source | Install with a package manager |
| Main language | CodeQL | JavaScript |
| Last code update | 4 days ago | 4 days ago |
What each one is
CodeQL
This repository holds the standard CodeQL libraries and queries that GitHub uses in its application security products, including GitHub Advanced Security. CodeQL lets you write queries that search source code for patterns, such as security weaknesses, and the README says security researchers also use these libraries. It is mainly useful if you want to read, run, or contribute to those checks.
ESLint
ESLint is a tool that scans JavaScript (ECMAScript) code and reports patterns that may be problems or bad practice. It works by parsing code into a syntax tree and checking it against rules, and every rule is a pluggable piece you can turn on, off, or adjust. Developers use it to catch mistakes and keep code style consistent across a project.
Best for
CodeQL
- Security researchers who want to study or extend CodeQL queries
- Developers learning how CodeQL queries are written and organized
- Contributors who want to improve the standard checks through pull requests
- Teams already using GitHub Advanced Security who want to understand its built-in checks
ESLint
- JavaScript developers who want automatic checks on their code
- Teams that want consistent rules enforced in a shared configuration
- Projects that need to customize which code patterns are flagged
- Developers working with React who add a React-specific plugin on top
Strengths
CodeQL
- Open source under the MIT License for the code in this repository
- Backed by the same libraries that GitHub's security products use, according to the README
- Documentation and style guides are linked from the README
ESLint
- Highly pluggable: every rule is a plugin and rules can be added at runtime, per the README
- Mature and widely used, with an MIT license and about 27,600 GitHub stars
- Clear three-level severity model (off, warn, error) that controls the exit code
Not ideal for
CodeQL
- People who only want a ready-made scan with no setup: the README points to the CodeQL extension and CLI for running queries, not to this repository as a finished tool
- Anyone analyzing closed-source code with the CLI, since the README says that use needs a separate commercial license
ESLint
- People who only want code formatting; the README says Prettier is the formatter and ESLint is a linter
- Users of experimental or non-standard syntax without a suitable parser, since ESLint officially supports only the latest final ECMAScript standard
- Environments that cannot run a supported Node.js version (^20.19.0, ^22.13.0, or >=24)
Trade-offs
CodeQL
- The README does not describe a standalone install or run path for this repository itself, so beginners may need the separate CodeQL CLI and VS Code extension first
- The CodeQL CLI and engine are licensed separately and hosted in another repository, which adds a licensing question for closed-source use
- The README is truncated and gives little detail on the directory layout or build steps
ESLint
- Requires a supported Node.js version and, for TypeScript type definitions, TypeScript 5.3 or later
- Does not lock dependency versions by design, so behavior can change as dependencies update
- Parser officially supports only the latest final ECMAScript standard; newer experimental syntax may need other parsers
Getting started
CodeQL
Clone the repository
git clone https://github.com/github/codeqlESLint
Install and configure ESLint
npm init @eslint/config@latestRun ESLint on a file
npx eslint yourfile.jsFrequently asked questions
What is the difference between CodeQL and ESLint?
CodeQL: The standard query libraries and checks behind GitHub's code scanning security tools. ESLint: A JavaScript linter that finds and reports problematic code patterns, with rules you can configure. CodeQL suits security researchers who want to study or extend codeql queries, while ESLint suits javascript developers who want automatic checks on their code.
Are CodeQL and ESLint free?
CodeQL: Free and open source. ESLint: Free and open source.
Which is easier to set up, CodeQL or ESLint?
ESLint is easier to get started with (rated intermediate); CodeQL is rated advanced and usually needs more setup.
Is CodeQL or ESLint more popular?
ESLint has more GitHub stars (27.6k) than CodeQL (10.3k). Popularity isn't the same as fit — check which one matches your use case above.
What are other alternatives to CodeQL and ESLint?
Other options people compare them with include typescript-eslint, Prettier, standard, lint-staged, RuboCop.
Keep comparing
Built from our catalogue entries for both products: open-source details come from each project's README (AI-assisted, refreshed weekly) and GitHub data; AI-tool details are editorial. Spotted something wrong? Let us know from either product's page.