Joern MCP
@Lekssays
A Model Context Protocol (MCP) server that provides AI assistants with static code analysis capabilities using Joern's Code Property Graph (CPG) technology.
Overview
What is Joern MCP?
Joern MCP is a Model Context Protocol (MCP) server that provides AI assistants with static code analysis capabilities using Joern’s Code Property Graph (CPG) technology. It supports multi‑language analysis (Java, C/C++, JavaScript, Python, Go, Kotlin, C#, Ghidra, Jimple, PHP, Ruby, Swift), runs each analysis session in a Docker container, and can analyze repositories directly from GitHub URLs.
How to use Joern MCP?
To use Joern MCP, clone the repository, install Python dependencies, run ./setup.sh to build the Joern Docker image and start Redis, then launch the server with python main.py. The server uses Streamable HTTP transport and is available at http://localhost:4242. Integration with GitHub Copilot is done by adding the server URL to VS Code’s settings.json.
Key features of Joern MCP
- Multi‑language static analysis via Joern’s CPG
- Docker isolation per analysis session
- GitHub repository analysis directly from URLs
- Persistent CPG sessions with automatic cleanup
- Redis‑backed caching and session management
- Async CPG generation and query execution
Use cases of Joern MCP
- Run custom CPGQL queries on any supported codebase
- Explore code structure (methods, calls, files, code snippets)
- Find security vulnerabilities with taint analysis and program slicing
- Check method reachability and build call graphs
- Search for hard‑coded secrets or dangerous API usage
FAQ from Joern MCP
What languages does Joern MCP support?
Java, C/C++, JavaScript, Python, Go, Kotlin, C#, Ghidra, Jimple, PHP, Ruby, and Swift.
What are the runtime requirements?
Python 3.8+, Docker, Redis, and Git are required.
How does the server handle data persistence?
Sessions, query results, and CPG data are cached in Redis and automatically cleaned up based on a configurable TTL and concurrency limit.
Which transport protocol does the server use?
The server uses Streamable HTTP transport, making it network‑accessible and able to handle multiple concurrent clients.
Can I configure memory limits for large projects?
Yes, memory limits for Joern can be set via environment variables (JOERN_MEMORY_LIMIT, JOERN_JAVA_OPTS) or in the config.yaml file.
