MCP Joern

An MCP server project based on Joern, providing code review and security analysis functions.

Security Developer tools #Code review #Security analysis #Joern tool .Python

rating : 2.5 points

downloads : 20

update time : 2025-04-28

What is Joern MCP Server?

The Joern MCP Server is a specialized service that enhances Joern's code analysis capabilities by providing a protocol for model context interaction. It helps developers identify security vulnerabilities and review code more efficiently.

How to use Joern MCP Server?

The server runs alongside Joern and processes requests for code analysis. You interact with it through configured clients that send analysis requests and receive structured results.

Use Cases

Ideal for security researchers analyzing code vulnerabilities, developers conducting code reviews, and teams implementing automated security checks in their CI/CD pipeline.

Key Features

Advanced Code AnalysisLeverages Joern's code property graphs to perform deep static analysis of source code.

AI-Assisted ReviewIntegrates with large language models to provide intelligent code review suggestions.

Extensible ToolsetSupports custom analysis tools written in Scala that can be imported into the server.

Pros and Cons

Advantages

Provides structured access to Joern's analysis capabilities

Supports custom analysis tools for specialized use cases

Enables integration with AI models for enhanced code review

Limitations

Requires significant memory resources (40GB+ recommended)

Setup involves multiple configuration steps

Limited to languages supported by Joern

Getting Started

Install Dependencies

Ensure you have Python 3.10+ and Joern installed on your system.

Set Up the Environment

Clone the repository and install Python dependencies using uv.

Start Joern Server

Launch the Joern server with the required configuration.

Configure MCP Client

Update the .env file with your server credentials and test the connection.

Example Use Cases

Identifying VulnerabilitiesFind potential security vulnerabilities in a codebase by analyzing data flows.

API Usage AnalysisIdentify all external API calls and their parameters in the code.

Frequently Asked Questions

What are the system requirements?

How do I add custom analysis tools?

Can I use this with other code analysis tools?

Additional Resources

Joern Documentation

Official documentation for Joern server

JEB MCP Reference

Reference implementation of MCP protocol

Joern Interpreter Guide

Guide to Joern's query language

🚀 Joern MCP Server

A simple MCP server based on Joern that offers a range of features to assist developers in code review and security analysis.

🚀 Quick Start

The Joern MCP Server is designed to facilitate code review and security analysis. Here's a quick overview of how to get started.

✨ Features

Based on Joern, providing powerful code analysis capabilities.
Offers a series of functions for code review and security analysis.

📦 Installation

Environment Requirements

Python >= 3.10 (default is 3.12) & uv
Joern

Installation Steps

Clone the project locally:

git clone https://github.com/sfncat/mcp-joern.git
cd mcp-joern

Install Python dependencies:

uv venv .venv
source .venv/bin/activate
uv sync

📚 Documentation

Project Structure

├── server.py                       # Main program of the MCP server
├── test_mcp_client.py              # Test program for testing the Joern server and mcp tools
├── test_sc_tools.py                # Test program for directly testing sc tools
├── common_tools.py                 # Common utility functions
├── server_tools.py                 # Server utility functions
├── server_tools.sc                 # Server utility functions implemented in Scala
├── server_tools_source.sc          # Server utility functions implemented in Scala using sourceCode to get method source code
├── requirements.txt                # Python dependency file
├── sample_cline_mcp_settings.json  # Example cline mcp configuration file
└── env_example.txt                 # Example file for environment variables

Usage Instructions

Start the Joern server:

joern -J-Xmx40G --server --server-host 127.0.0.1 --server-port 16162 --server-auth-username user --server-auth-password password --import server_tools.sc
Or
joern -J-Xmx40G --server --server-host 127.0.0.1 --server-port 16162 --server-auth-username user --server-auth-password password --import server_tools_source.sc

Copy env_example.txt to the .env file Modify the configuration information to match the startup configuration of the Joern server.
Run the connection test: Modify the information in test_mcp_client.py to confirm whether the Joern server is running normally.

uv run test_mcp_client.py
Starting MCP server test...
==================================================
Testing server connection...
[04/16/25 20:38:54] INFO     Processing request of type CallToolRequest                                                                                                                     server.py:534
Connection test result: Successfully connected to the Joern MCP, and the Joern server version is XXX

Configure the MCP server Configure the MCP server in the console. Please refer to sample_cline_mcp_settings.json.
Use the MCP server Ask questions to the large language model. Please refer to prompts_en.md

Development Notes

The .env file is used to store environment variables.
The .gitignore file defines the files to be ignored by Git version control.
pyproject.toml defines the Python configuration of the project.
MCP tool development:
- Implement functions in server_tools.sc, add definitions in server_tools.py, and add tests in test_mcp_client.py.