Scaling CodeQL from one codebase to a thousand
Multi-repository variant analysis (MRVA) is now available in CodeQL for Visual Studio Code, letting researchers run a single CodeQL query against up to 1,000 repositories at once. The feature builds on the variant analysis technique already central to CodeQL: model a vulnerability as a custom query and it will catch not just the exact pattern you encoded, but logical variants of the same flaw across a codebase.
GitHub’s Security Lab has used this approach internally to discover new vulnerabilities, including Android advisories affecting more than 10 million applications. MRVA extends that workflow to the wider community, so researchers can compare their code against known attack patterns across large numbers of open source projects without manually acquiring and preparing each database.
How an MRVA run works
Running an MRVA query mirrors the single-repo workflow in CodeQL for VS Code. Instead of downloading CodeQL databases locally, VS Code triggers a GitHub Action that fetches all the databases for the repositories in your list, executes your query against each, and streams the results back into the editor as they complete.
To get started, MRVA ships with predefined repository lists of 10, 100, and 1,000 public repositories, built with GitHub’s code search team and covering each language supported by CodeQL. For more targeted analysis, you can define custom lists or run against up to 1,000 repositories within a single GitHub organization you have access to.
Once results arrive, you can sort repositories by star count or last update time to prioritize active, widely used projects. A “Export results” feature generates lightweight Markdown reports for sharing findings with colleagues or project maintainers.
Database availability and coverage
CodeQL databases are stored for every public repository that runs GitHub code scanning, so enabling code scanning on your public repo makes it available for MRVA. In addition, GitHub stores databases for thousands of popular public repositories not currently running code scanning, keeping the available pool broader than just code-scanning adopters and ensuring the most relevant projects are accessible for security research.
For private repositories, MRVA works with any repo you can read, provided code scanning with CodeQL is enabled. That makes the same queries useful for an organization’s internal portfolio: develop a query to catch a new weakness on one project, then sweep it across your entire estate to find every occurrence at once. Setup and usage details are covered in the MRVA documentation.
