Joern vs PMD
Joern
joern.ioPMD
pmd.github.ioSide by side
| Figure | Joern | PMD |
|---|---|---|
| Price from | — | Free |
| Free plan | — | Yes |
| Free trial | — | — |
| Open source | — | — |
| Windows | Yes | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| API | Yes | — |
| Self-hosted | Yes | Yes |
| Plans published | 0 | 1 |
| Spec score · Static Analysis Tools | 7.7 (#18) | 8.2 (#12) |
| Installation | Prebuilt joern-cli binaries are available, and the documentation describes installation from the project’s releases. | PMD requires Java 8 or above and is distributed as a ZIP archive containing PMD and CPD. |
| License | The repository identifies Joern as open source and includes an Apache-2.0 license. | The project identifies its license as BSD-style. |
| Operating systems | The project repository lists platform-specific distributions for Linux, macOS, and Windows, each with x86_64 and arm64 variants. | The documentation provides execution instructions for Linux/Unix and Windows, using pmd or pmd.bat. |
| Purpose | Joern analyzes source code, bytecode, and binary executables to support vulnerability discovery and static program analysis. | PMD is an extensible cross-language static code analyzer that finds common programming flaws. |
Plans
In their own words
Joern
Joern analyzes source code, bytecode and binary code for vulnerability discovery and static program analysis research. It converts programs into code property graphs, providing a common structure for cross-language analysis. Users query those graphs with a strongly typed, extensible Scala-based domain-specific language. Features include parsing, taint analysis, search queries and passes that extend the graph representation. Joern Scan runs predefined queries and reports matching issues with their locations; queries can be selected by tag or name, and community contributions are accepted in the default database. Queries can be wrapped into custom scanners for CI. Joern also works as a library or through REST and HTTP APIs, including a server for graph construction and querying. Documented frontends cover C, C++, C#, Go, Java, JavaScript, Kotlin, PHP, Python, Ruby, Swift, x86/x64 and JVM bytecode, with varying maturity. Distributions target Linux, macOS and Windows on x86_64 and ARM64. Joern is free, Apache-2.0 licensed and requires JDK 21.
PMD
PMD is a free, extensible static code analyzer that checks source code for programming flaws such as unused variables, empty catch blocks, and unnecessary object creation. It includes more than 400 built-in rules, and teams can write custom rules in Java or XPath. Its bundled CPD tool finds duplicated code across many programming languages. PMD checks source directories from the command line and can run as a Maven, Ant, Gradle, or bld build operation. Supported languages include Java, JavaScript, Salesforce Apex and Visualforce, Kotlin, Swift, Modelica, PL/SQL, Apache Velocity, JSP, WSDL, Maven POM, HTML, XML, and XSL; Scala is supported without Scala rules. It runs on Linux, macOS, and Windows and requires Java 8 or above. For CI, its GitHub Action can create SARIF reports and fail builds based on violation counts; documentation also covers GitLab, Jenkins, and Bamboo integrations. IDE integrations include Eclipse, IntelliJ IDEA, and Visual Studio Code, though some listed plugins are not actively maintained. Only the latest major version is actively developed.