Joern

What it does

Analysis features

Joern provides static taint analysis to trace attacker-controlled data through code.checked 9 Oct 2026

API

Joern can run as an HTTP server, allowing clients to query code property graphs and delegate graph construction and querying to a server machine.checked 9 Oct 2026

Automation

Users can run Joern in non-interactive mode with scripts containing Scala code and Joern directives.checked 9 Oct 2026

CI use

The official site says users can wrap queries into custom scanners and run Joern-based scanners in CI.checked 9 Oct 2026

Code representation

It generates code property graphs, a representation designed for cross-language code analysis.checked 9 Oct 2026

Community

The official site links to a Joern community Discord.checked 9 Oct 2026

Customization

Users can select Joern Scan queries by tags or names, and the default query database accepts community contributions.checked 8 Oct 2026

Deployment

The project documents Docker-based execution, including running Joern in server mode.checked 9 Oct 2026

Extensibility

Plugins can add queries, interact with Java libraries, and extend the code property graph schema.checked 9 Oct 2026

HTTP API

Joern’s server exposes an HTTP API for querying code property graphs from non-JVM languages and for outsourcing graph construction and queries to a server.checked 8 Oct 2026

Installation

Prebuilt joern-cli binaries are available, and the documentation describes installation from the project’s releases.checked 8 Oct 2026

Integration

Joern can be used as a library or as a component through its REST API.checked 8 Oct 2026

Joern Scan

Joern Scan runs predefined queries against a program’s code property graph to report matched issues and their locations.checked 8 Oct 2026

Language support

The documentation lists frontends for C/C++, Java, JavaScript, Python, x86/x64, JVM bytecode, Kotlin, PHP, Go, Ruby, Swift, and C# with varying maturity levels.checked 8 Oct 2026

License

The repository identifies Joern as open source and includes an Apache-2.0 license.checked 9 Oct 2026

License and support

The repository identifies Joern as open source under the Apache-2.0 license and links to a Discord community.checked 8 Oct 2026

Operating system releases

The repository lists release distributions for Linux, macOS, and Windows, with x86_64 and ARM64 builds.checked 9 Oct 2026

Operating systems

The project repository lists platform-specific distributions for Linux, macOS, and Windows, each with x86_64 and arm64 variants.checked 8 Oct 2026

Purpose

Joern analyzes source code, bytecode, and binary executables to support vulnerability discovery and static program analysis.checked 9 Oct 2026

Querying

Users can query code property graphs with a Scala-based domain-specific language.checked 9 Oct 2026

Query language

Users can query code graphs with a strongly typed, extensible Scala-based domain-specific language.checked 8 Oct 2026

Requirements

The repository lists JDK 21 as a requirement and says other versions may work but have not been properly tested.checked 9 Oct 2026

Runtime requirement

The repository README lists JDK 21 as a requirement and says other versions may work but have not been properly tested.checked 8 Oct 2026

Security limitation

The server documentation says its interpreter is not a security boundary and production environments must provide sandboxing by other means.checked 9 Oct 2026