GitHub CodeQL vs Joern
GitHub CodeQL
codeql.github.com
Joern
joern.ioSide by side
| Figure | GitHub CodeQL | Joern |
|---|---|---|
| Price from | $30/mo | — |
| Free plan | Yes | — |
| Free trial | — | — |
| Open source | — | — |
| Web | Yes | — |
| Windows | Yes | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| API | — | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 5 | 0 |
| Spec score · Static Application Security Testing Sast | 8.5 (#4) | 7.6 (#13) |
| Spec score · SAST Tools | 8.5 (#5) | 7.7 (#16) |
| Spec score · Static Analysis Tools | 8.5 (#8) | 7.7 (#18) |
| Purpose | CodeQL is a language and toolchain for code analysis that treats code as data. | Joern analyzes source code, bytecode, and binary executables to support vulnerability discovery and static program analysis. |
| Supported languages | CodeQL supports C/C++, C#, Go, Java, Kotlin, JavaScript, TypeScript, Python, Ruby, Rust, Swift, and GitHub Actions workflows. | The documentation lists frontends for C, C++, C#, Go, Java, JavaScript, Kotlin, PHP, Python, Ruby, Swift, x86/x64, and JVM bytecode. |
Plans
GitHub CodeQL
- Free for research and open sourceFree
- GitHub Code Security$30 a month
- CodeQL for open source and researchFree
- GitHub Code Security$30 a month
- GitHub Free with CodeQL code scanningPrice not published
In their own words
GitHub CodeQL
GitHub CodeQL has no write-up on Specifiction yet; its figures are above.
Joern
Joern analyzes source code, bytecode and binary code for vulnerability discovery and static program analysis research. It converts programs into code property graphs, providing a common structure for cross-language analysis. Users query those graphs with a strongly typed, extensible Scala-based domain-specific language. Features include parsing, taint analysis, search queries and passes that extend the graph representation. Joern Scan runs predefined queries and reports matching issues with their locations; queries can be selected by tag or name, and community contributions are accepted in the default database. Queries can be wrapped into custom scanners for CI. Joern also works as a library or through REST and HTTP APIs, including a server for graph construction and querying. Documented frontends cover C, C++, C#, Go, Java, JavaScript, Kotlin, PHP, Python, Ruby, Swift, x86/x64 and JVM bytecode, with varying maturity. Distributions target Linux, macOS and Windows on x86_64 and ARM64. Joern is free, Apache-2.0 licensed and requires JDK 21.