feat(resources): improve CodeQL MaD extensions support by data-douser · Pull Request #266 · advanced-security/codeql-development-mcp-server

data-douser · 2026-04-24T18:39:34Z

Closes #261.

Summary of Changes

Implements changes required for resolution of issue #261 and first-class support for CodeQL Models-as-Data (MaD) extensions as part of agentic CodeQL development.

Add per-language library-modeling resources, a common data-extensions overview, and a procedural MCP prompt for data extension development workflows.

Resources:

Add library-modeling for cpp, csharp, java, javascript, python, ruby (from template PR Add deterministic release version updater and pack fixes #42)
Add data-extensions-overview.md covering MaD tuple and API Graph formats (codeql://learning/data-extensions)
Update Go library-modeling with barrierModel and barrierGuardModel (CodeQL 2.25.2+)
Register 6 new language resources in language-types.ts

Prompt:

Add data_extension_development MCP prompt with 8-step procedural workflow (from template PR Build(deps-dev): bump @types/node from 25.2.2 to 25.2.3 #48)

Docs:

Update server-overview.md, server-prompts.md, server-queries.md with new URIs and references

Outline of Changes

TODO

Implements changes required for resolution of issue #261 and first-class support for CodeQL Models-as-Data (MaD) extensions as part of agentic CodeQL development. Add per-language library-modeling resources, a common data-extensions overview, and a procedural MCP prompt for data extension development workflows. Resources: - Add library-modeling for cpp, csharp, java, javascript, python, ruby (from template PR #42) - Add data-extensions-overview.md covering MaD tuple and API Graph formats (codeql://learning/data-extensions) - Update Go library-modeling with barrierModel and barrierGuardModel (CodeQL 2.25.2+) - Register 6 new language resources in language-types.ts Prompt: - Add data_extension_development MCP prompt with 8-step procedural workflow (from template PR #48) Docs: - Update server-overview.md, server-prompts.md, server-queries.md with new URIs and references

github-actions · 2026-04-24T18:39:47Z

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package

Version

Score

Details

actions/actions/setup-go

4a3601121dd01d1626a1e23e37211e3254c1c06c

🟢 5.7

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Maintained	🟢 6	7 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 6
Binary-Artifacts	🟢 10	no binaries found in the repo
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Security-Policy	🟢 9	security policy file detected
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
SAST	🟢 10	SAST tool is run on all commits

Scanned Files

.github/workflows/lint-and-format.yml

Copilot

Pull request overview

Adds first-class Models-as-Data (MaD) / data extensions documentation and workflow support to the CodeQL Development MCP Server, enabling agentic development of library models via new learning resources, per-language guides, and a dedicated MCP prompt.

Changes:

Added a new codeql://learning/data-extensions resource plus per-language library-modeling resources for multiple languages.
Introduced a new data_extension_development workflow prompt (template + registration + schema) for end-to-end MaD authoring/testing.
Updated server documentation and tests to account for newly registered resources/prompts and expanded Go library-modeling docs with barrierModel / barrierGuardModel.

Show a summary per file

File	Description
server/test/src/resources/language-resources.test.ts	Updates expectations for additional language resources registration.
server/test/src/prompts/workflow-prompts.test.ts	Updates prompt-name count expectation for the new workflow prompt.
server/src/types/language-types.ts	Registers new per-language `library-modeling` markdown resources via `additionalResources`.
server/src/tools/codeql-resources.ts	Registers new learning resource `codeql://learning/data-extensions`.
server/src/resources/server-queries.md	Table formatting adjustments in bundled queries documentation.
server/src/resources/server-prompts.md	Documents the newly added `data_extension_development` prompt.
server/src/resources/server-overview.md	Adds references to the new data extensions resource and library-modeling resources; updates prompt count/category list.
server/src/resources/languages/cpp_library_modeling.md	Adds C/C++ library-modeling (MaD) guidance resource.
server/src/resources/languages/csharp_library_modeling.md	Adds C# library-modeling (MaD) guidance resource.
server/src/resources/languages/java_library_modeling.md	Adds Java/Kotlin library-modeling (MaD) guidance resource.
server/src/resources/languages/javascript_library_modeling.md	Adds JavaScript/TypeScript library-modeling (API graph format) guidance resource.
server/src/resources/languages/python_library_modeling.md	Adds Python library-modeling (API graph format) guidance resource.
server/src/resources/languages/ruby_library_modeling.md	Adds Ruby library-modeling (API graph format) guidance resource.
server/src/resources/languages/go_library_modeling.md	Extends Go library-modeling docs with `barrierModel` / `barrierGuardModel` (2.25.2+).
server/src/resources/data-extensions-overview.md	Adds shared overview doc covering MaD formats, predicates, packs, and workflow.
server/src/prompts/workflow-prompts.ts	Registers `data_extension_development` prompt, schema, and handler.
server/src/prompts/data-extension-development.prompt.md	Adds the procedural workflow prompt template for data extension development.
server/src/lib/resources.ts	Adds `getDataExtensionsOverview()` for serving the new learning resource.
server/dist/codeql-development-mcp-server.js	Updates the built server bundle to include new resources/prompt wiring.

Copilot's findings

Files reviewed: 18/20 changed files
Comments generated: 5

…eview feedback Agent-Logs-Url: https://github.com/advanced-security/codeql-development-mcp-server/sessions/4266e55f-3c7d-4ab3-9bd9-338cdb43bbee Co-authored-by: data-douser <70299490+data-douser@users.noreply.github.com>

Copilot · 2026-04-24T20:09:03Z

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

https://api.github.com/graphql
- Triggering command: /usr/bin/gh gh pr view 266 --json title,body,files la/Security_Communication_Root_CA.crt e be18160abc6298begrep cat /usr/local/.ghcu(create|run) git rtif�� s��tv��ny.pem la/vTrus_ECC_Root_CA.crt e git@github.com/ runtime-runc/mobdiff 5352433d1b4b2693main /usr/sbin/iptablHEAD (http block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Bumps [actions/setup-go](https://github.com/actions/setup-go) from 5.6.0 to 6.4.0. - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](actions/setup-go@40f1582...4a36011) --- updated-dependencies: - dependency-name: actions/setup-go dependency-version: 6.4.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Nathan Randall <70299490+data-douser@users.noreply.github.com>

Copilot

Copilot's findings

Files reviewed: 20/22 changed files
Comments generated: 1

* Initial plan * Fix invalid JSON Schema for query_results_cache_retrieve (use z.object for lineRange/resultIndices) Agent-Logs-Url: https://github.com/advanced-security/codeql-development-mcp-server/sessions/950558d1-9e5d-4eec-bdd3-0668c904dd1f Co-authored-by: data-douser <70299490+data-douser@users.noreply.github.com> * Add server tool-schema-validation.test.ts Adds tests to generically avoid regressions due to invalid schema for any MCP tool. * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: Nathan Randall <70299490+data-douser@users.noreply.github.com> * Address PR review feedback --------- Signed-off-by: Nathan Randall <70299490+data-douser@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: data-douser <70299490+data-douser@users.noreply.github.com> Co-authored-by: Nathan Randall <data-douser@github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Bumps [actions/setup-node](https://github.com/actions/setup-node) from 6.3.0 to 6.4.0. - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@53b8394...48b55a0) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: 6.4.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…elopment-mcp-server into dd/mad-ql/1

Implements changes required for resolution of issue #261 and first-class support for CodeQL Models-as-Data (MaD) extensions as part of agentic CodeQL development. Add per-language library-modeling resources, a common data-extensions overview, and a procedural MCP prompt for data extension development workflows. Resources: - Add library-modeling for cpp, csharp, java, javascript, python, ruby (from template PR #42) - Add data-extensions-overview.md covering MaD tuple and API Graph formats (codeql://learning/data-extensions) - Update Go library-modeling with barrierModel and barrierGuardModel (CodeQL 2.25.2+) - Register 6 new language resources in language-types.ts Prompt: - Add data_extension_development MCP prompt with 8-step procedural workflow (from template PR #48) Docs: - Update server-overview.md, server-prompts.md, server-queries.md with new URIs and references

…eview feedback Agent-Logs-Url: https://github.com/advanced-security/codeql-development-mcp-server/sessions/4266e55f-3c7d-4ab3-9bd9-338cdb43bbee Co-authored-by: data-douser <70299490+data-douser@users.noreply.github.com>

…elopment-mcp-server into dd/mad-ql/1

Copilot

Copilot's findings

Files reviewed: 30/32 changed files
Comments generated: 4

Copilot · 2026-04-24T22:16:56Z

+    - **MaD tuple format** (9–10 column tuples): C/C++ (`codeql/cpp-all`), C# (`codeql/csharp-all`), Go (`codeql/go-all`), Java/Kotlin (`codeql/java-all`)
+    - **API Graph format** (3–5 column tuples): JavaScript/TypeScript (`codeql/javascript-all`), Python (`codeql/python-all`), Ruby (`codeql/ruby-all`)


The model-format quick reference omits Swift (which this PR registers under codeql://languages/swift/library-modeling) and doesn’t mention Rust’s distinct crate-path format. This can mislead users into picking the wrong YAML tuple shape; update the bullets to include Swift in the MaD tuple list and call out Rust as its own format (or explicitly defer to the per-language library-modeling resource).

Suggested change

- **MaD tuple format** (9–10 column tuples): C/C++ (`codeql/cpp-all`), C# (`codeql/csharp-all`), Go (`codeql/go-all`), Java/Kotlin (`codeql/java-all`)

- **API Graph format** (3–5 column tuples): JavaScript/TypeScript (`codeql/javascript-all`), Python (`codeql/python-all`), Ruby (`codeql/ruby-all`)

- **MaD tuple format** (9–10 column tuples): C/C++ (`codeql/cpp-all`), C# (`codeql/csharp-all`), Go (`codeql/go-all`), Java/Kotlin (`codeql/java-all`), Swift (`codeql/swift-all`)

- **API Graph format** (3–5 column tuples): JavaScript/TypeScript (`codeql/javascript-all`), Python (`codeql/python-all`), Ruby (`codeql/ruby-all`)

- **Rust format**: Rust (`codeql/rust-all`) uses its own crate-path-based model format; follow `codeql://languages/rust/library-modeling`

Copilot · 2026-04-24T22:16:56Z

+    // Access registered tools via internal SDK handle — same code path as
+    // the live `tools/list` JSON-RPC handler.
+    const registered = (server as any)._registeredTools as
+      Record<string, { inputSchema?: unknown }>;
+


This test reaches into (server as any)._registeredTools, which is an SDK-internal/private field. That makes the test brittle to MCP SDK upgrades (a rename/encapsulation would break tests without any server-side behavior change). Prefer asserting via a public surface (e.g., the tools/list response path, similar to the VS Code integration test) or factoring the schema generation into a server-owned helper that can be unit-tested without private-field access.

Copilot · 2026-04-24T22:16:56Z

+    describe('JSON Schema serialization (issue: GitHub Copilot Chat strict validation)', () => {
+      beforeEach(() => {
+        vi.spyOn(sessionDataManager, 'getConfig').mockReturnValue({
+          storageLocation: testStorageDir,
+          autoTrackSessions: true,
+          retentionDays: 90,
+          includeCallParameters: true,
+          includeCallResults: true,
+          maxActiveSessionsPerQuery: 3,
+          scoringFrequency: 'per_call',
+          archiveCompletedSessions: true,
+          enableAnnotationTools: true,
+          enableRecommendations: true,
+          enableMonitoringTools: false,
+        });
+      });
+
+      /**
+       * Regression test for the bug where `lineRange` and `resultIndices`
+       * (defined via `z.tuple([...])`) serialized to a bare array as the
+       * JSON Schema value (e.g. `[{"type":"integer"}, {"type":"integer"}]`),
+       * which the GitHub Copilot Chat backend rejects with HTTP 400:
+       *   "[...] is not of type 'object', 'boolean'."
+       *
+       * Every property's JSON Schema MUST itself be an object (or boolean),
+       * never an array.
+       */
+      it('produces a strict-JSON-Schema-valid input schema for every cache tool', async () => {
+        // Use the real McpServer + SDK tool registration path so we exercise


The JSON-schema serialization checks here largely overlap with the new server/test/src/tools/tool-schema-validation.test.ts (which validates schema serialization across all tools) and the VS Code extension e2e schema test. Consider consolidating to a single canonical place (e.g., keep the cross-tool test + a small cache-tool spot check) to avoid having to update the same expectations in 2–3 suites whenever the SDK’s JSON schema output changes.

- Register data-extension-development.prompt.md in prompt-loader - Add index signature to PromptResult for MCP SDK compat - Fix startServer HTTP branch to return Promise<McpServer> - Add hints field to QueryFilesResult interface - Narrow unknown types in mermaid graph evaluator - Update EXPECTED_PROMPT_FILES in prompt-loader tests - Add test for object-based mermaid graph tuples

data-douser self-assigned this Apr 24, 2026

data-douser added the documentation Improvements or additions to documentation label Apr 24, 2026

Copilot AI review requested due to automatic review settings April 24, 2026 18:39

data-douser added enhancement New feature or request server testing labels Apr 24, 2026

Copilot started reviewing on behalf of data-douser April 24, 2026 18:40 View session

Copilot AI reviewed Apr 24, 2026

View reviewed changes

Sync server/dist/**

e1287a3

Copilot started work on behalf of data-douser April 24, 2026 19:55 View session

Copilot AI review requested due to automatic review settings April 24, 2026 20:05

data-douser review requested due to automatic review settings April 24, 2026 20:05

Copilot finished work on behalf of data-douser April 24, 2026 20:09

Merge branch 'main' into dd/mad-ql/1

228b68f

Copilot AI review requested due to automatic review settings April 24, 2026 20:32

Copilot started reviewing on behalf of data-douser April 24, 2026 20:32 View session

Copilot AI reviewed Apr 24, 2026

View reviewed changes

Comment thread server/src/resources/data-extensions-overview.md Outdated

data-douser and others added 8 commits April 24, 2026 15:20

Update MaD tuple format in overview resource

b80df0d

Update MaD tuple format in overview resource

d74ee0f

Merge branch 'dd/mad-ql/1' of github.com:advanced-security/codeql-dev…

46fdc62

…elopment-mcp-server into dd/mad-ql/1

Sync server/dist/**

9787e0a

data-douser added 3 commits April 24, 2026 16:07

Update MaD tuple format in overview resource

4a69c81

Rebuild server/dist/codeql-development-mcp-server.js.map

93ab431

Merge branch 'dd/mad-ql/1' of github.com:advanced-security/codeql-dev…

b573add

…elopment-mcp-server into dd/mad-ql/1

Copilot AI review requested due to automatic review settings April 24, 2026 22:10

Copilot started reviewing on behalf of data-douser April 24, 2026 22:10 View session

Copilot AI reviewed Apr 24, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(resources): improve CodeQL MaD extensions support#266

feat(resources): improve CodeQL MaD extensions support#266
data-douser wants to merge 17 commits intomainfrom
dd/mad-ql/1

data-douser commented Apr 24, 2026

Uh oh!

github-actions Bot commented Apr 24, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI commented Apr 24, 2026

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI Apr 24, 2026

Uh oh!

Copilot AI Apr 24, 2026

Uh oh!

Copilot AI Apr 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		- MaD tuple format (9–10 column tuples): C/C++ (`codeql/cpp-all`), C# (`codeql/csharp-all`), Go (`codeql/go-all`), Java/Kotlin (`codeql/java-all`)
		- API Graph format (3–5 column tuples): JavaScript/TypeScript (`codeql/javascript-all`), Python (`codeql/python-all`), Ruby (`codeql/ruby-all`)

Conversation

data-douser commented Apr 24, 2026

Summary of Changes

Outline of Changes

Uh oh!

github-actions Bot commented Apr 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency Review

OpenSSF Scorecard

Scanned Files

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI commented Apr 24, 2026

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot's findings

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot's findings

Uh oh!

Uh oh!

Copilot AI Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

github-actions Bot commented Apr 24, 2026 •

edited

Loading