QLCoder Synthesizes CodeQL Queries From CVE Metadata
In April 2026, QLCoder presented an agentic framework that synthesizes executable CodeQL queries from known CVE descriptions and metadata. The project uses abstract syntax tree guidance, retrieval, Model Context Protocol tool use, and CodeQL language infrastructure to iteratively generate queries for vulnerability detection, variant analysis, and regression testing.
QLCoder is an open-source agentic framework for generating end-to-end CodeQL queries that detect known software vulnerabilities from CVE metadata. Its GitHub repository describes a workflow in which an LLM and coding agent iteratively construct a query, beginning with a CodeQL path-query template populated from an abstract syntax tree extracted from a vulnerability-fix diff.
The work, titled "QLCoder: A Query Synthesizer For Static Analysis of Security Vulnerabilities," was presented as an ICLR 2026 poster by Claire Wang, Ziyang Li, Saikat Dutta, and Mayur Naik. The ICLR abstract frames the system as a response to the difficulty of writing precise, expressive CodeQL vulnerability queries, including interprocedural dataflow queries, even for experienced users.
Tool-assisted query synthesis
According to the repository, the coding agent can interface with a retrieval-augmented generation database and the CodeQL language server during synthesis. The ICLR abstract states that QLCoder uses the Model Context Protocol (MCP) for agentic tool use and incorporates CodeQL language infrastructure and documentation into its synthesis loop.
The authors identify stale CodeQL knowledge as a practical failure mode for language models: the ICLR abstract notes that current models can hallucinate deprecated syntax because of limited or outdated training data. Their described approach combines contextual engineering, iterative query feedback, and structured tool interactions to produce executable queries using current CodeQL conventions.
The repository recommends Docker-based installation and documents use of CodeQL version 2.22.2 in the associated paper, while stating that other CodeQL versions and languages can be used. It also notes that the local CodeQL installation's QL packs are stored in the vector database, making the available retrieval context dependent on the installed environment.
Security engineering relevance
The ICLR abstract describes the intended outputs as fine-grained vulnerability signatures that can support detection of known flaws and systematic variant analysis. The repository additionally identifies multivariant analysis, regression testing, and query-authoring guidance as uses for synthesized queries.
For application-security teams, the important distinction is that QLCoder is not merely generating code from natural language. It combines a vulnerability record, source-diff structure, documentation retrieval, and language-server feedback around a domain-specific static-analysis language. Comparable agentic developer workflows often benefit most when they have executable validation loops, because syntactic correctness alone does not establish that a security query captures the intended source-to-sink or control-flow behavior.
The retrieved sources do not provide benchmark results, vulnerability-detection rates, or false-positive measurements. Practitioners evaluating the framework would therefore need to validate generated queries against representative vulnerable and patched codebases before incorporating them into production scanning or regression pipelines.
Key Points
- 1QLCoder generates CodeQL vulnerability queries from CVE metadata and fix-diff AST guidance, targeting reusable signatures for detection and variant analysis.
- 2The framework combines MCP tool use, retrieval, and CodeQL language-server feedback to reduce failures caused by stale or deprecated query syntax.
- 3Agentic static-analysis workflows generally require executable validation because compiling a generated query does not establish detection precision or coverage.
Scoring Rationale
QLCoder addresses a technically important security-engineering task: converting known vulnerability information into executable static-analysis queries. Its tool-feedback design is relevant to teams building agents for specialized developer workflows, although the retrieved sources do not provide evaluation metrics or evidence of broad production adoption.
Sources
Primary source and supporting public references used for this report.
Practice interview problems based on real data
1,625 SQL & Python problems across 15 industry datasets — the exact type of data you work with.
Try 250 free problems
