feat(resources): improve CodeQL MaD extensions support

[data-douser]

Closes #261.

Summary of Changes

Implements changes required for resolution of issue #261 and first-class support for CodeQL Models-as-Data (MaD) extensions as part of agentic CodeQL development.

Add per-language library-modeling resources, a common data-extensions overview, and a procedural MCP prompt for data extension development workflows.

Resources:

• Add library-modeling for cpp, csharp, java, javascript, python, ruby (from template PR Add deterministic release version updater and pack fixes #42)
• Add data-extensions-overview.md covering MaD tuple and API Graph formats (codeql://learning/data-extensions)
• Update Go library-modeling with barrierModel and barrierGuardModel (CodeQL 2.25.2+)
• Register 6 new language resources in language-types.ts

Prompt:

• Add data_extension_development MCP prompt with 8-step procedural workflow (from template PR Build(deps-dev): bump @types/node from 25.2.2 to 25.2.3 #48)

Docs:

• Update server-overview.md, server-prompts.md, server-queries.md with new URIs and references

Outline of Changes

TODO

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
actions/actions/setup-go	4a3601121dd01d1626a1e23e37211e3254c1c06c	🟢 5.2	Details Check Score Reason Maintained 🟢 5 6 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 5 Code-Review 🟢 6 Found 11/16 approved changesets -- score normalized to 6 Binary-Artifacts 🟢 10 no binaries found in the repo Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 9 security policy file detected Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches SAST 🟢 10 SAST tool is run on all commits

Scanned Files

• .github/workflows/lint-and-format.yml

[Copilot]

Pull request overview

Adds first-class Models-as-Data (MaD) / data extensions documentation and workflow support to the CodeQL Development MCP Server, enabling agentic development of library models via new learning resources, per-language guides, and a dedicated MCP prompt.

Changes:

• Added a new codeql://learning/data-extensions resource plus per-language library-modeling resources for multiple languages.
• Introduced a new data_extension_development workflow prompt (template + registration + schema) for end-to-end MaD authoring/testing.
• Updated server documentation and tests to account for newly registered resources/prompts and expanded Go library-modeling docs with barrierModel / barrierGuardModel.

Show a summary per file

File	Description
server/test/src/resources/language-resources.test.ts	Updates expectations for additional language resources registration.
server/test/src/prompts/workflow-prompts.test.ts	Updates prompt-name count expectation for the new workflow prompt.
server/src/types/language-types.ts	Registers new per-language library-modeling markdown resources via additionalResources.
server/src/tools/codeql-resources.ts	Registers new learning resource codeql://learning/data-extensions.
server/src/resources/server-queries.md	Table formatting adjustments in bundled queries documentation.
server/src/resources/server-prompts.md	Documents the newly added data_extension_development prompt.
server/src/resources/server-overview.md	Adds references to the new data extensions resource and library-modeling resources; updates prompt count/category list.
server/src/resources/languages/cpp_library_modeling.md	Adds C/C++ library-modeling (MaD) guidance resource.
server/src/resources/languages/csharp_library_modeling.md	Adds C# library-modeling (MaD) guidance resource.
server/src/resources/languages/java_library_modeling.md	Adds Java/Kotlin library-modeling (MaD) guidance resource.
server/src/resources/languages/javascript_library_modeling.md	Adds JavaScript/TypeScript library-modeling (API graph format) guidance resource.
server/src/resources/languages/python_library_modeling.md	Adds Python library-modeling (API graph format) guidance resource.
server/src/resources/languages/ruby_library_modeling.md	Adds Ruby library-modeling (API graph format) guidance resource.
server/src/resources/languages/go_library_modeling.md	Extends Go library-modeling docs with barrierModel / barrierGuardModel (2.25.2+).
server/src/resources/data-extensions-overview.md	Adds shared overview doc covering MaD formats, predicates, packs, and workflow.
server/src/prompts/workflow-prompts.ts	Registers data_extension_development prompt, schema, and handler.
server/src/prompts/data-extension-development.prompt.md	Adds the procedural workflow prompt template for data extension development.
server/src/lib/resources.ts	Adds getDataExtensionsOverview() for serving the new learning resource.
server/dist/codeql-development-mcp-server.js	Updates the built server bundle to include new resources/prompt wiring.

Copilot's findings

• Files reviewed: 18/20 changed files
• Comments generated: 5

[Copilot]

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/graphql
  • Triggering command: /usr/bin/gh gh pr view 266 --json title,body,files la/Security_Communication_Root_CA.crt e be18160abc6298begrep cat /usr/local/.ghcu(create|run) git rtif�� ��s��tv��ny.pem la/vTrus_ECC_Root_CA.crt e git@github.com/ runtime-runc/mobdiff 5352433d1b4b2693main /usr/sbin/iptablHEAD (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[Copilot]

Copilot's findings

• Files reviewed: 20/22 changed files
• Comments generated: 1

[Copilot]

Copilot's findings

• Files reviewed: 30/32 changed files
• Comments generated: 4

[Copilot]

Copilot's findings

Comments suppressed due to low confidence (1)

server/src/codeql-development-mcp-server.ts:158

• In HTTP mode, startServer() returns early from inside the new Promise(...) block, so setupGracefulShutdown(server) is never reached. That means SIGINT/SIGTERM won’t trigger shutdownServerManager() / server.close() when running with TRANSPORT_MODE=http. Consider moving setupGracefulShutdown(server) before the mode branch and (optionally) wiring shutdown to also close the underlying httpServer.

    const host = process.env.HTTP_HOST || 'localhost';
    const port = Number(process.env.HTTP_PORT || process.env.PORT) || 3000;
    
    // Return a promise that keeps the process alive
    return new Promise<McpServer>((resolve, reject) => {
      const httpServer = app.listen(port, host, () => {
        logger.info(`HTTP server listening on http://${host}:${port}/mcp`);
        resolve(server);
      });
      
      httpServer.on('error', (error) => {
        logger.error('HTTP server error:', error);
        reject(error);
      });
    });
  }

• Files reviewed: 36/38 changed files
• Comments generated: 3

[Copilot]

Copilot's findings

Comments suppressed due to low confidence (1)

server/src/tools/codeql-resources.ts:18

• The named imports from ../lib/resources aren’t in alphabetical order (getLearningDataExtensions is listed before getDataflowMigration). Repo convention is to keep imports/specifier lists alphabetized (see .github/instructions/server_src_ts.instructions.md:16). Please reorder the specifiers accordingly.

• Files reviewed: 49/51 changed files
• Comments generated: 1

[Copilot]

LANGUAGE_RESOURCES array is missing commas after object properties / elements (e.g., after astContent: actionsAst and after each closing }), which makes this file invalid TypeScript and will break compilation. Add the missing trailing commas between object entries and after the last property in each object.