Infer vs Joern
Infer
fbinfer.com
Joern
joern.ioSide by side
| Figure | Infer | Joern |
|---|---|---|
| Price from | Free | — |
| Free plan | Yes | — |
| Free trial | — | — |
| Open source | — | — |
| Web | Yes | — |
| Windows | — | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| API | — | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 0 |
| Spec score · Static Analysis Tools | 8.6 (#7) | 7.7 (#18) |
| CI use | The recommended CI flow is to identify modified files and run analysis in reactive mode starting from those files. | The official site says users can wrap queries into custom scanners and run Joern-based scanners in CI. |
| Deployment | Infer runs in Meta's continuous-integration pipeline to verify select properties of code modifications for projects including Facebook, Messenger, Instagram, and WhatsApp. | The project documents Docker-based execution, including running Joern in server mode. |
| Installation | Infer can be installed from binary releases, built from source, or run using Docker images. | Prebuilt joern-cli binaries are available, and the documentation describes installation from the project’s releases. |
| License | The Infer repository states that Infer is MIT-licensed, while noting that enabling Java support may require GPL-licensed components. | The repository identifies Joern as open source and includes an Apache-2.0 license. |
| Purpose | Infer is a static analysis tool that produces a list of potential bugs from Java or C/C++/Objective-C code. | Joern analyzes source code, bytecode, and binary executables to support vulnerability discovery and static program analysis. |
| Supported languages | Infer is a static program analyzer for Java, C, C++, Objective-C, and Erlang, written in OCaml. | The documentation lists frontends for C, C++, C#, Go, Java, JavaScript, Kotlin, PHP, Python, Ruby, Swift, x86/x64, and JVM bytecode. |
Plans
In their own words
Infer
Infer is a static analysis tool that examines compiled Java, C, C++, Objective-C, and Erlang code and reports potential bugs before release. Its checks include null pointer problems, resource or memory leaks, coding conventions, unavailable APIs, and concurrency issues such as data races. Some analyses can follow an issue across multiple functions or methods and files. Pulse provides memory-safety analysis, while RacerD checks thread safety. Cost analysis estimates asymptotic function complexity for Java and C-family languages; Hack support is experimental, and Python, Rust, and Swift are not supported by that analysis. Infer captures compilation commands, analyzes the captured files, and writes reports that can be reviewed with `infer explore`; files that are not compiled are not analyzed. Integrations are documented for build tools including Buck, CMake, Gradle, Make, Maven, Xcodebuild, and xctool. It can be installed from binary releases, built from source, or run in Docker. The free plan costs nothing. Infer runs on Linux and macOS, with web and self-hosted options; Windows is not supported.
Joern
Joern analyzes source code, bytecode and binary code for vulnerability discovery and static program analysis research. It converts programs into code property graphs, providing a common structure for cross-language analysis. Users query those graphs with a strongly typed, extensible Scala-based domain-specific language. Features include parsing, taint analysis, search queries and passes that extend the graph representation. Joern Scan runs predefined queries and reports matching issues with their locations; queries can be selected by tag or name, and community contributions are accepted in the default database. Queries can be wrapped into custom scanners for CI. Joern also works as a library or through REST and HTTP APIs, including a server for graph construction and querying. Documented frontends cover C, C++, C#, Go, Java, JavaScript, Kotlin, PHP, Python, Ruby, Swift, x86/x64 and JVM bytecode, with varying maturity. Distributions target Linux, macOS and Windows on x86_64 and ARM64. Joern is free, Apache-2.0 licensed and requires JDK 21.