joernio/joern

Health v2 · maintenance only

Adoption not part of the score

3453 stars · 443 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

Joern is an open-source code analysis platform that generates code property graphs (CPGs) from source code, bytecode, and binaries for C/C++, Java, JavaScript, Python, Kotlin, and more. It provides a Scala-based query language and interactive shell for mining code graphs, aimed at vulnerability discovery and static program analysis research.

Use cases

• find security vulnerabilities in C/C++ codebases
• run taint analysis to trace attacker-controlled data
• analyze binaries and JVM bytecode without source
• write custom code scanners for CI pipelines
• query code structure across multiple languages with a DSL
• research static program analysis techniques

When to choose

• you need cross-language static analysis with a graph-based code representation
• you are hunting for vulnerabilities or variants of known bug patterns
• you cannot build the target project and need robust fuzzy parsing
• you want to script custom code queries in Scala or integrate via REST API

When to avoid

• you only need simple linting or formatting rather than deep code analysis
• you require a GUI-based code review tool
• your language is unsupported or has only low-maturity support
• you need a lightweight tool without JVM/Scala dependencies

Facets

framework · maturity active

security parser search-engine security developer-tools programming-languages cross-platform cli jvm code-property-graph static-analysis vulnerability-discovery taint-analysis scala code-scanning ghidra soot static analysis docker

Member repositories

For agents

markdown · JSON · MCP: product_card(name="joernio/joern")