Cyber Risks · Trail of Bits Blog

Introducing mrva, a terminal-first approach to CodeQL multi-repo variant analysis

Summary: Trail of Bits released mrva, a terminal-first, open-source alternative to GitHub's CodeQL multi-repository variant analysis (MRVA), which GitHub introduced in 2023 to run queries across thousands of projects using pre-built databases. mrva runs entirely on the local machine, downloads databases by repository, organization, or in bulk (the post's example pulls the top 1,000 Go project databases), and pretty-prints SARIF results in the terminal.

Bottom line: The tool depends on GitHub's pre-built CodeQL database API, so the speed of large-scale variant analysis still rests on repositories having code scanning configured to produce those databases. For teams with sensitive data that cannot go to the cloud, running the analysis and holding the findings locally is the difference between doing the work and not.

Read the original at Trail of Bits Blog ↗