Skip to main content
Glama
sfncat

Joern MCP Server

by sfncat
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Local

Server Configuration

Describes the environment variables required to run the server.

NameRequiredDescriptionDefault
JOERN_HOSTYesThe host address for the Joern server
JOERN_PORTYesThe port number for the Joern server
JOERN_PASSWORDYesThe password for Joern server authentication
JOERN_USERNAMEYesThe username for Joern server authentication

Instructions

Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.

This server publishes no instructions, or was last inspected before Glama recorded them.

Capabilities

Server capabilities have not been inspected yet.

Tools

Functions exposed to the LLM to take actions

NameDescription
get_helpB

Get help information from joern server

check_connectionB

Check if the Joern MCP plugin is running

pingA

Checks if the Joern server is running and responsive by querying its version

@return: The Joern server version if successful, 'Query Failed' if the server is not responding
load_cpgB
Loads a CPG from a file if the cpg is not loaded or the cpg is not the same as the filepath.

Args:
    cpg_filepath (str): The path to the CPG file, the filepath is absolute path.

Returns:
    str: True if the CPG is loaded successfully, False otherwise.
get_method_calleesB

Retrieves a list of methods info that are called by the specified method

@param method_full_name: The fully qualified name of the source method(e.g., com.android.nfc.NfcService$6.onReceive:void(android.content.Context,android.content.Intent)) @return: List of full name, name, signature and id of methods which call the source method

get_method_callersA

Retrieves a list of methods that call the specified method

@param method_full_name: The fully qualified name of the source method(e.g., com.android.nfc.NfcService$6.onReceive:void(android.content.Context,android.content.Intent))
@return: List of full name, name, signature and id of methods called by the source method
get_class_full_name_by_idB

Retrieves the fully name of a class by its ID

@param id: The unique identifier of the class (typeDecl), the id is a Long int string, like '111669149702L'
@return: The fully name of the class (e.g., com.android.nfc.NfcService$6)
get_class_methods_by_class_full_nameB

Get the methods of a class by its fully qualified name

@param class_full_name: The fully qualified name of the class
@return: List of full name, name, signature and id of methods in the class
get_method_code_by_full_nameA

Get the code of a method by its fully name, If you know the full name of the method, you can use this tool to get the method code directly. If you only know the full name of the class and the name of the method, you should use get_method_code_by_class_full_name_and_method_name @param method_full_name: The fully qualified name of the method (e.g., com.android.nfc.NfcService$6.onReceive:void(android.content.Context,android.content.Intent)) @return: The source code of the specified method

get_method_code_by_idC

Get the code of a method by its class full name and method name

@param class_full_name: The fully qualified name of the class
@param method_name: The name of the method
@return: List of full name, name, signature and id of methods in the class
get_method_full_name_by_idA

Retrieves the fully qualified name of a method by its ID

@param id: The unique identifier of the method, the id is a Long int string, like '111669149702L'
@return: The fully qualified name of the method (e.g., com.android.nfc.NfcService$6.onReceive:void(android.content.Context,android.content.Intent))
get_call_code_by_idA

Get the source code of a specific call node from the loaded CPG by the call id

@param id: The unique identifier of the call node, the id is a Long int string, like '111669149702L'
@return: The source code of the specified call
get_method_code_by_class_full_name_and_method_nameA

Get the code of a method by its class full name and method name, this tool is usually used when you don't know the full name of the method, but you know the full name of the class and the name of the method. If there are multiple methods with the same name in the class, the code of all methods will be returned.

@param class_full_name: The fully qualified name of the class, like 'com.android.nfc.NfcService'
@param method_name: The name of the method, like 'onReceive'
@return: List of full name, name, signature and id of methods in the class
get_derived_classes_by_class_full_nameB

Get the derived classes of a class

@param class_full_name: The fully qualified name of the class
@return: The derived classes info of the class, including the full name, name and id
get_parent_classes_by_class_full_nameB

Get the parent classes of a class

@param class_full_name: The fully qualified name of the class
@return: The parent classes info of the class, including the full name, name and id
get_method_by_call_idC

Get the method info by the call id which the call is in the method

@param id: The id of the call
@return: The method info of the call
get_referenced_method_full_name_by_call_idC

Get the method info by the call id which the call is referenced the method

@param id: The id of the call
@return: The method info of the call
get_calls_in_method_by_method_full_nameC

Get the calls info by the method full name which the call is in the method

@param method_full_name: The full name of the method
@return: The calls info of the method

Prompts

Interactive templates invoked by user choice

NameDescription

No prompts

Resources

Contextual data attached and managed by the client

NameDescription

No resources

Deploy Server
One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

TDQS

B3.2/5.0

Scored across 18 tools

Disambiguation3/5

The tools have clear purposes but significant overlap exists. For example, get_method_code_by_full_name, get_method_code_by_class_full_name_and_method_name, and get_method_code_by_id all retrieve method code with different input parameters, which could confuse agents about which to use. However, descriptions help clarify the distinctions, preventing complete ambiguity.

Naming Consistency4/5

Most tools follow a consistent verb_noun pattern (e.g., get_call_code_by_id, get_method_by_call_id), with minor deviations like check_connection and ping (which are simpler verbs). The naming is generally predictable and readable, though not perfectly uniform across all tools.

Tool Count4/5

With 18 tools, the count is slightly high but reasonable for a code analysis server like Joern, which needs to handle various CPG queries. It covers multiple aspects (methods, classes, calls, loading), though it might feel a bit heavy compared to more focused servers.

Completeness5/5

The tool set provides comprehensive coverage for querying a CPG, including loading, checking connections, and retrieving details on calls, methods, and classes with full lifecycle support (e.g., get, list, derive, parent). No obvious gaps are present for its intended domain of static code analysis.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Resources