Install joern with Homebrew

Project links

• Homepage
• Repository
• Upstream docs
• Package manager page

Commands and aliases

• abap2cpg
• c2cpg.sh
• csharpsrc2cpg
• ghidra2cpg
• gosrc2cpg
• javasrc2cpg
• jimple2cpg
• joern
• joern-cpg2scpg
• joern-export
• joern-flow
• joern-parse
• joern-scan
• joern-slice
• joern-vectors
• jssrc2cpg.sh
• kotlin2cpg
• php2cpg
• pysrc2cpg
• rubysrc2cpg
• rust2cpg
• schema-extender.sh
• swiftsrc2cpg.sh

Project history

The code property graph idea was introduced in vulnerability-research work on C system code and the Linux kernel. Joern grew from that research lineage into a practical tool for creating and querying CPGs, with later research from 2014 to 2016 extending the representation and 2017 onward work at ShiftLeft turning the format into a broader static-analysis foundation.

The public joernio/joern repository was created in 2019 and the project documentation records several architectural shifts: older Joern versions used general-purpose graph databases and Gremlin, later versions moved to OverflowDB, Joern v2 changed the implementation line from Scala 2 to Scala 3, and Joern v4 moved from OverflowDB to flatgraph.

Adoption history

Joern's adoption is strongest in security research and static-analysis workflows where importing incomplete or build-hostile code is valuable. The documentation lists mature or partially mature frontends for C/C++, Java, JavaScript, Python, binary analysis through Ghidra, JVM bytecode, Kotlin, PHP, Go, Ruby, Swift, and C#.

Homebrew distribution makes Joern convenient on macOS and Linux while preserving its JVM/Scala toolchain shape through OpenJDK and sbt-related packaging.

How it is used

A typical Joern workflow parses source, bytecode, or binaries into a CPG, stores the graph in Joern's graph database, and then uses CPGQL or bundled commands such as joern-scan, joern-slice, and joern-export to inspect code patterns and vulnerability-relevant flows.

Why package nerds care

Joern matters to package nerds because it turns a research-heavy static-analysis stack into a single installable CLI formula with many frontends. It also shows the unusual packaging profile of modern security tooling: JVM runtime, Scala build tooling, external parsers, and a fast-moving release stream tied to graph storage changes.

Timeline

• 2014: Code property graphs were introduced for vulnerability discovery in C system code.
• 2014-2016: Research extended the CPG concept for interprocedural analysis, data-flow learning, dominator-tree integration, and dynamic-language analysis.
• 2017: The CPG became a foundation for static-analysis products at ShiftLeft.
• 2019: The joernio/joern GitHub repository was created.
• 2023: Joern v2 marked the Scala 2 to Scala 3 transition.
• 2026: Joern v4 documented the move from OverflowDB to flatgraph.

Related projects

• Related projects and concepts include the Code Property Graph specification, Ocular and Qwiet AI, OverflowDB, flatgraph, Ghidra frontends, and the older Gremlin/property-graph ecosystem that influenced early Joern storage and querying.

Sources

• https://api.github.com/repos/joernio/joern
• https://cpg.joern.io/
• https://docs.joern.io/
• https://docs.joern.io/code-property-graph/
• https://formulae.brew.sh/formula/joern
• https://github.com/joernio/joern