Cppcheck vs Joern

Cppcheck is a static analysis tool for C and C++ code that detects bugs, undefined behavior, and dangerous coding constructs. It can analyze non-standard syntax commonly found in embedded projects. The tool fully supports C++11, C++14, and C++17, with partial support for C++20, and lists integrations with Visual Studio, VSCode, Keil, Eclipse, CLion, Qt Creator, and C++ Builder. Its Soundy mode is intended to help find hard-to-find bugs discovered during testing. The free Open-source plan provides core static analysis. Premium adds checks for safety and security standards, with compliance reports for supported standards; the maker describes Premium as TÜV SÜD certified for safety-critical development. A three-week free trial is offered without a credit card or commitment. Individual licensing excludes CI environments, virtual machines, and containers, while Enterprise supports those environments and air-gapped use. Project requires at least five users and one Git repository. Paid plan prices are available by tailored quotation.

Joern analyzes source code, bytecode and binary code for vulnerability discovery and static program analysis research. It converts programs into code property graphs, providing a common structure for cross-language analysis. Users query those graphs with a strongly typed, extensible Scala-based domain-specific language. Features include parsing, taint analysis, search queries and passes that extend the graph representation. Joern Scan runs predefined queries and reports matching issues with their locations; queries can be selected by tag or name, and community contributions are accepted in the default database. Queries can be wrapped into custom scanners for CI. Joern also works as a library or through REST and HTTP APIs, including a server for graph construction and querying. Documented frontends cover C, C++, C#, Go, Java, JavaScript, Kotlin, PHP, Python, Ruby, Swift, x86/x64 and JVM bytecode, with varying maturity. Distributions target Linux, macOS and Windows on x86_64 and ARM64. Joern is free, Apache-2.0 licensed and requires JDK 21.