Skip to content
SPECIFICTION
Get listed

Joern

joern.io

WindowsmacOSLinuxAPISelf-hosted
Visit joern.io
Spec score 7.7 #19 of 38 in Static Analysis Tools

What it is

Joern analyzes source code, bytecode and binary code for vulnerability discovery and static program analysis research. It converts programs into code property graphs, providing a common structure for cross-language analysis. Users query those graphs with a strongly typed, extensible Scala-based domain-specific language. Features include parsing, taint analysis, search queries and passes that extend the graph representation. Joern Scan runs predefined queries and reports matching issues with their locations; queries can be selected by tag or name, and community contributions are accepted in the default database. Queries can be wrapped into custom scanners for CI. Joern also works as a library or through REST and HTTP APIs, including a server for graph construction and querying. Documented frontends cover C, C++, C#, Go, Java, JavaScript, Kotlin, PHP, Python, Ruby, Swift, x86/x64 and JVM bytecode, with varying maturity. Distributions target Linux, macOS and Windows on x86_64 and ARM64. Joern is free, Apache-2.0 licensed and requires JDK 21.

Spec sheet

Purpose
Joern analyzes source code, bytecode, and binary executables to support vulnerability discovery and static program analysis.Read 9 Oct 2026 · docs.joern.io
Deployment
The project documents Docker-based execution, including running Joern in server mode.Read 9 Oct 2026 · github.com
API
Joern can run as an HTTP server, allowing clients to query code property graphs and delegate graph construction and querying to a server machine.Read 9 Oct 2026 · docs.joern.io
License
The repository identifies Joern as open source and includes an Apache-2.0 license.Read 9 Oct 2026 · github.com
Analysis features
Joern provides static taint analysis to trace attacker-controlled data through code.Read 9 Oct 2026 · docs.joern.io
Automation
Users can run Joern in non-interactive mode with scripts containing Scala code and Joern directives.Read 9 Oct 2026 · docs.joern.io
CI use
The official site says users can wrap queries into custom scanners and run Joern-based scanners in CI.Read 9 Oct 2026 · joern.io
Code representation
It generates code property graphs, a representation designed for cross-language code analysis.Read 9 Oct 2026 · docs.joern.io
Community
The official site links to a Joern community Discord.Read 9 Oct 2026 · joern.io
Customization
Users can select Joern Scan queries by tags or names, and the default query database accepts community contributions.Read 8 Oct 2026 · docs.joern.io
Extensibility
Plugins can add queries, interact with Java libraries, and extend the code property graph schema.Read 9 Oct 2026 · docs.joern.io
HTTP API
Joern’s server exposes an HTTP API for querying code property graphs from non-JVM languages and for outsourcing graph construction and queries to a server.Read 8 Oct 2026 · docs.joern.io
Installation
Prebuilt joern-cli binaries are available, and the documentation describes installation from the project’s releases.Read 8 Oct 2026 · docs.joern.io
Integration
Joern can be used as a library or as a component through its REST API.Read 8 Oct 2026 · joern.io
Joern Scan
Joern Scan runs predefined queries against a program’s code property graph to report matched issues and their locations.Read 8 Oct 2026 · docs.joern.io
Language support
The documentation lists frontends for C/C++, Java, JavaScript, Python, x86/x64, JVM bytecode, Kotlin, PHP, Go, Ruby, Swift, and C# with varying maturity levels.Read 8 Oct 2026 · docs.joern.io
License and support
The repository identifies Joern as open source under the Apache-2.0 license and links to a Discord community.Read 8 Oct 2026 · github.com
Operating system releases
The repository lists release distributions for Linux, macOS, and Windows, with x86_64 and ARM64 builds.Read 9 Oct 2026 · github.com
Operating systems
The project repository lists platform-specific distributions for Linux, macOS, and Windows, each with x86_64 and arm64 variants.Read 8 Oct 2026 · github.com
Query language
Users can query code graphs with a strongly typed, extensible Scala-based domain-specific language.Read 8 Oct 2026 · docs.joern.io
Querying
Users can query code property graphs with a Scala-based domain-specific language.Read 9 Oct 2026 · docs.joern.io
Requirements
The repository lists JDK 21 as a requirement and says other versions may work but have not been properly tested.Read 9 Oct 2026 · github.com
Runtime requirement
The repository README lists JDK 21 as a requirement and says other versions may work but have not been properly tested.Read 8 Oct 2026 · github.com
Security limitation
The server documentation says its interpreter is not a security boundary and production environments must provide sandboxing by other means.Read 9 Oct 2026 · docs.joern.io
Supported languages
The documentation lists frontends for C, C++, C#, Go, Java, JavaScript, Kotlin, PHP, Python, Ruby, Swift, x86/x64, and JVM bytecode.Read 9 Oct 2026 · docs.joern.io

Strong points and limits

Strong points

  • Cross-language code property graphs
  • Taint analysis and extensible passes
  • Custom scanners for CI
  • REST and HTTP APIs
  • Linux, macOS and Windows distributions

Limits

  • Server has no sandboxing
  • Requires JDK 21
  • Frontend maturity varies by language
  • No free trial distinction; software is free

Who it suits

It suits security researchers and development teams building code analysis or custom security checks, including CI workflows. Users should account for the documented runtime and server limitations.

Verdict

Joern offers graph-based analysis with custom queries, scanners and API access. Its open-source model and broad platform support come with a clear requirement to avoid treating the server as a security boundary.

Where Specifiction places it

Alternatives to JoernAll alternatives →