Progmune vs CodeQL: complementary, not competing
Last verified: 2026-09 · Facts about third-party tools are checked quarterly.
Quick comparison
| Dimension | CodeQL | Progmune |
|---|---|---|
| Core model | QL queries over a semantic code database; cross-function dataflow, taint, points-to | Deterministic protocol state machine over cross-function call sequences |
| What it catches | Deep semantic vulnerabilities: injection chains, complex dataflow paths, queryable code properties at scale | Sequence-level lifecycle violations: missing handshake steps, unauthenticated session handling, payment confirmation without signature verification, unreleased resources |
| What it does NOT catch | Protocol temporal constraints — it tracks data, not the state of a protocol across a sequence of operations | Pattern/dataflow-level vulnerabilities; Progmune is deliberately not a query engine |
| Determinism | Deterministic | Deterministic — an LLM never judges; outputs evidence chain |
| Languages | Broad support; compiled languages typically require a build step to create the database | TypeScript / Python production; C / Go annotation-driven Beta; Java in progress; 12 framework adapters |
| Generation-time interception | No | Yes — code generated through Progmune is validated before it lands on disk |
| Open source | Proprietary engine with free tiers (open-source projects); GitHub-centric | MIT; code stays local; masked fingerprints upload by default (opt-out) |
| Positioning | Industry-standard semantic analysis, widely used as a security gate | Auxiliary checker — evidence for human review, not a deployment gate |
| Typical setup | GitHub Actions integration, query packs, minutes to hours depending on builds | npm i progmune-runtime, one command, minutes |
Who should use which
CodeQL fits you if
You want deep semantic analysis, complex dataflow queries at scale, GitHub-native security workflows, or have the build infrastructure for compiled languages.
Progmune fits you if
Your team generates code with AI and wants lifecycle/sequence verification — proof that auth flows, payments, and resource handling follow valid protocol state machines — plus generation-time interception.
Bottom line: choose CodeQL for semantic depth and dataflow analysis; choose Progmune for protocol-lifecycle verification as auxiliary evidence. They answer different questions: "where does this data flow?" vs "does this sequence of operations follow the protocol?"
Using both together
A pragmatic setup: keep CodeQL as your semantic analysis layer in GitHub Actions. Add Progmune as an auxiliary check in the same pipeline (npm run trust -- --project . --json), or via MCP in Claude Code, and enable generation-time interception for agent-produced code. CodeQL answers dataflow questions; Progmune answers lifecycle questions with an evidence chain.
中文版
| 维度 | CodeQL | Progmune |
|---|---|---|
| 核心模型 | QL 查询 + 语义代码数据库；跨函数数据流、污点、指向分析 | 确定性协议状态机，作用于跨函数调用序列 |
| 能抓住 | 深层语义漏洞：注入链、复杂数据流路径、规模化代码属性查询 | 序列级生命周期违规：握手步骤缺失、未认证会话处理、支付确认前未验签、资源未释放 |
| 抓不住 | 协议时序约束——它追踪数据，不追踪协议在一串操作中的状态 | 模式/数据流级漏洞；Progmune 刻意不做查询引擎 |
| 确定性 | 确定性 | 确定性——LLM 不参与裁决，输出证据链 |
| 语言 | 覆盖广；编译语言通常需要构建步骤生成数据库 | TS/Python 生产级；C/Go 注解驱动 Beta；Java 进行中；12 个框架适配器 |
| 生成时拦截 | 无 | 有——经 Progmune 生成的代码落盘前完成校验 |
| 开源 | 专有引擎 + 免费档（面向开源项目）；GitHub 生态中心 | MIT；代码完全本地；脱敏指纹默认匿名上报（可关闭） |
| 定位 | 业界标准的语义分析，广泛用作安全门禁 | 辅助检查器——供人工审查的证据，非部署门禁 |
| 接入成本 | GitHub Actions 集成、query pack，视构建情况分钟到小时 | npm i progmune-runtime，一条命令，分钟级 |
CodeQL 适合你，如果
你想要深层语义分析、规模化复杂数据流查询、GitHub 原生安全工作流，或已具备编译语言的构建基础设施。
Progmune 适合你，如果
你的团队用 AI 产码，需要生命周期/序列验证——证明认证流、支付与资源处理遵循有效协议状态机——以及生成时拦截。
结论：语义深度与数据流分析选 CodeQL；协议生命周期验证作为辅助证据选 Progmune。它们回答的是不同问题：「数据流到哪里」vs「这串操作是否遵循协议」。