CheckOps home

Tools directory

J

CheckOps

Joern

Joern is an Apache-2.0 code analysis platform that builds code property graphs for C/C++, Java, JavaScript, Python, Kotlin, binaries and more, queried with a Scala-based DSL.

Visit website

Latest public signals

Not refreshed yet. Refresh reads the public site and, when the entry has a GitHub repository, the latest release.

Visit Website

Introduction

Joern, “the bug hunter’s workbench”, analyses source code, bytecode and binary executables. It generates code property graphs (CPGs), a graph representation of code for cross-language analysis, stored in a custom graph database and mined with queries in a Scala-based domain-specific language.

The source code is at joernio/joern on GitHub under the Apache-2.0 licence, with about 3,600 stars; the most recent commit was on 10 November 2026.

Features

  1. Code property graphs: Combine AST, control flow and data flow.
  2. Many languages: C/C++, Java, JavaScript, Python, Kotlin, binaries and more.
  3. Interactive shell: Explore code interactively.
  4. Scripting: Automate queries.
  5. Taint analysis: Find data flows from sources to sinks.

Pros

  1. Free to use: Open source under Apache-2.0.
  2. Maintained: Commits as recent as 10 November 2026.
  3. Community: About 3,600 GitHub stars.

Cons

  1. Expert tool: Best for security researchers comfortable with queries.
  2. Scala DSL: Learning curve for queries.
joern
joern> importCode("path/to/project")
joern> cpg.call.name("strcpy").l

Resources:

Pricing

Joern is free and open source under the Apache-2.0 licence.

  1. Security researchers hunting bugs.
  2. Teams building custom analyses.
  3. Not a fit for plug-and-play CI scanning.

Conclusion

Joern is a powerful, research-grade code analysis workbench.

Alternatives

Other tools on CheckOps that cover similar ground. Open a page, or compare one with Joern side by side.