CodeQL vs Mend.io

From $30 per committer/month (GitHub Advanced Security, indicative)

Quote on request

Free on public repos. Private repositories require GitHub Advanced Security, priced per active committer.

Quote-based enterprise pricing, typically per developer or per application.

Free for public repositories on GitHub.

Free tier for small teams on Mend's developer products.

Widely used

GitHub (Microsoft) · since 2019

Widely used

Mend.io · since 2011

• Interprocedural dataflow analysis finds real vulnerabilities that regex- and pattern-based tools cannot see.
• Free on public repositories, with results in the GitHub security tab.
• Custom queries let you encode organisation-specific security rules.

• Licence compliance reporting is the strongest in the category and often the reason legal approves a release.
• Reachability analysis reduces the transitive-dependency alert flood.
• Automated remediation pull requests.

• Writing custom CodeQL queries is a specialist skill with a steep learning curve.
• Analysis is slow — minutes to tens of minutes, so it fits nightly better than per-commit.
• Private-repo licensing through Advanced Security is expensive at scale.

• SAST is weaker than dedicated code-analysis vendors.
• Enterprise pricing and sales process.
• Interface is dated in places.

GitHub-hosted projects wanting deep static security analysis, free if the repo is public.

Enterprises where open-source licence compliance is as important as vulnerability management.