CodeQL Alternative: SlopCop vs CodeQL Compared

Side by side.

As of November 2026. Each statement about CodeQL is from GitHub’s own pages, listed under Sources.
	SlopCop	CodeQL
What it is	Hosted static analysis of the change a coding agent makes.	The code analysis engine GitHub develops to automate security checks. Its results are shown as code scanning alerts in GitHub.
How it reads code	The service keeps its own clone of the repository and reads the source as written, without building or running it.	You generate a CodeQL database to represent the codebase, then run queries on that database.
With coding agents	A skill and a Stop hook have Claude Code and Codex run a check and fix what it finds. Agents with no shell reach it over MCP.	GitHub analyzes with CodeQL the code that Copilot cloud agent and third-party coding agents, Claude and Codex among them, write in a repository. The agent attempts to resolve what it finds before it finalizes the pull request.
Languages	C, C++, C#, Go, Java, JavaScript, Kotlin, PHP, Python, Ruby, Rust, Scala and TypeScript.	C and C++, C#, Go, Java and Kotlin, JavaScript and TypeScript, Python, Ruby, Rust, Swift, and GitHub Actions workflows.
Rules you write	Bifrost policies kept in the repository, under `.slopcop/policies`.	Queries in the CodeQL language. GitHub’s own queries are open source.
Charged by	The check: 1,000 free each calendar month, then $0.001 each (pricing).	Free on public repositories. Private repositories need GitHub Code Security, priced by the active committer (GitHub’s pricing).

What we measured.

DataFlowBench is our own benchmark, so read it as a vendor’s. Its method, every result and the raw evidence are public. Each question is a small test program: does data from a source reach a sink? Half hold a real flow and half a near miss. It put those questions to Bifrost, the open-source engine a SlopCop check runs, and to CodeQL.

DataFlowBench v0.9.2, released 7 November 2026: each analyzer on the questions in the languages it covers, 13 for Bifrost and 12 for CodeQL.
Analyzer	Questions	Right	Wrong	No answer
Bifrost 0.15.1	886	527	1	358
CodeQL 2.27.2	812	594	146	72

CodeQL answers more: CodeQL answered 740 of the benchmark’s 952 questions and Bifrost 528. In each of the 11 languages both cover, CodeQL gave more right answers.
Bifrost is wrong less often: Of the answers each gave, 1 of Bifrost’s 528 was wrong, and 146 of CodeQL’s 740. Where Bifrost can’t finish an analysis it gives no answer, which is why it left 358 questions unanswered.
Swift: 66 of CodeQL’s 72 unanswered questions are the benchmark’s Swift questions, where this version records no decisive answer from it. Bifrost has no Swift questions, since it does not cover Swift.
The engine, not a check: The scores are Bifrost’s on test programs, with sources and sinks the benchmark supplies. A SlopCop check runs Bifrost with SlopCop’s own rules on your change, which the benchmark does not measure, and it does not estimate accuracy on real projects.

DataFlowBench v0.9.2: right and wrong answers in the 11 languages both analyzers cover, 56 to 70 questions a language. A question that is neither went unanswered.
Language	Questions	Right	Wrong	Right	Wrong
		Bifrost		CodeQL
C	56	42	0	47	8
C++	68	30	0	50	17
C#	70	43	1	55	14
Go	70	44	0	54	15
Java	70	46	0	57	13
JavaScript	70	48	0	57	13
Kotlin	70	32	0	55	15
Python	70	42	0	56	13
Ruby	70	36	0	57	12
Rust	62	42	0	49	13
TypeScript	70	46	0	57	13

Where CodeQL also does better. DataFlowBench v0.9.2 asks, in Java, JavaScript and Python, whether a tool’s own rule language can declare a case’s sources, sinks and sanitizers and carry the flow, and what each tool decides with the rules it ships and nothing supplied.
	Bifrost	CodeQL
Questions its rule language can express	8 of 24 questions in each language.	All 24 questions in each language.
Of those, answered right	7 in Java, 4 in JavaScript and 7 in Python. It left the rest unanswered.	All 24 in each language.
With the rules it ships	No answers. It declined all 12 questions in each language.	No result. The benchmark’s runs could not find CodeQL’s query pack, which it records as a failed run and not as a wrong answer.

When CodeQL is the better pick.

You want the analyzer that answers more. In our benchmark CodeQL answered more questions than Bifrost and got more of them right.
Your code is in Swift, or you want GitHub Actions workflows analyzed.
You want findings as code scanning alerts in GitHub.
You want to write queries of your own in the CodeQL language.
Your project is open source. CodeQL is free for research and open source.

More comparisons.

SlopCop vs Semgrep

Side by side, with our benchmark of Bifrost and Semgrep Community Edition and when Semgrep is the better pick.

All comparisons

SlopCop beside CodeRabbit, SonarQube and your coding agent’s own review, and what a SlopCop check is.

Sources.

How this page was checked: Each statement about CodeQL comes from GitHub’s own pages, listed here, as they read on the day given. Each number comes from our own benchmark. Products change, so read their pages before you decide.
CodeQL: Read on 12 November 2026: codeql.github.com, docs.github.com/en/code-security/concepts/code-scanning/codeql/codeql-code-scanning, docs.github.com/en/code-security/concepts/code-scanning/codeql/codeql-cli.
GitHub: Read on 12 November 2026: github.blog/changelog/2026-06-09-security-validation-for-third-party-coding-agents, github.com/security/plans.
DataFlowBench: Our own benchmark, version 0.9.2, released on 7 November 2026 and read on 12 November 2026: dataflowbench.slopcop.com. Its method, the frozen snapshot and the cases and raw evidence are public.
Names: CodeQL, GitHub and the other product names on this page are trademarks of their owners. SlopCop is not affiliated with them, and none of them endorses this page.

SlopCop vs CodeQL.