Skip to content
SPECIFICTION
Get listed

jscpd

jscpd.dev

Free plan Open source WindowsmacOSLinuxAPISelf-hosted
Visit jscpd.dev
Spec score 8.6 #2 of 23 in Code Clone Detection Tools

What it is

jscpd is a free, open-source tool for finding repeated code in repositories. It can fail a build when duplication exceeds a configured threshold, making it usable in local development and CI. The project says it supports 224 languages. Exact clones are detected by default, while renamed, near-miss, and semantic clone checks are optional; semantic detection is experimental.

Version 5 is available as a self-contained native binary that does not need Node.js, with direct macOS, Linux, and Windows binaries for x64 and ARM64. Reports include HTML, JSON, XML, README badges, SARIF, CodeClimate, and OpenMetrics. The GitHub Action can enforce a threshold and upload SARIF for GitHub Code Scanning, and GitLab CI reporters are documented. Developers can also use pre-commit hooks or Docker. A dashboard summarizes project size, duplication, complexity, dead code, and a health score. Dead-code analysis covers JavaScript, TypeScript, and Python, plus Rust when compiler diagnostics are supplied.

Spec sheet

What it does
jscpd detects duplicated source-code blocks and can fail builds when configured duplication thresholds are exceeded.Read 15 Oct 2026 · jscpd.dev
Purpose
jscpd scans source code for duplicate code and can fail a build when duplication exceeds a configured threshold.Read 29 Sep 2026 · jscpd.dev
License
The project and its published packages use the permissive MIT license.Read 15 Oct 2026 · pypi.org
Maker
The site credits Andrey Kucherenko and contributors; it does not state a headquarters or founding year in the pages opened.Read 29 Sep 2026 · jscpd.dev
Agent skills
Five installable skills provide workflows for duplication cleanup, dead-code removal and code migration tasks.Read 15 Oct 2026 · jscpd.dev
AI integrations
A built-in MCP server lets Claude, Cursor, or another MCP client check code for clones, and the project provides agent skills.Read 29 Sep 2026 · jscpd.dev
API limitation
The v5 CLI crate library target is internal and may change without notice; other languages are directed to JSON output or MCP.Read 15 Oct 2026 · jscpd.dev
CI integrations
The official GitHub Action accepts a duplication threshold and uploads SARIF results to GitHub Code Scanning; GitLab and generic CI workflows are documented.Read 15 Oct 2026 · github.com
Clone types
It detects exact clones by default and offers opt-in detection for renamed, near-miss, and semantic clones; semantic detection is described as experimental.Read 29 Sep 2026 · jscpd.dev
Codebase analysis
The dashboard summarizes project size, duplication, complexity, dead code, and a health score in one run.Read 29 Sep 2026 · jscpd.dev
Codebase comparison
Experimental compare mode pairs functions in two folders to measure porting progress or implementation parity.Read 15 Oct 2026 · jscpd.dev
Community distribution
Open Collective says the tool is used in pipelines at Microsoft, Salesforce and Deutsche Bahn and bundled by Super-Linter, Mega-Linter and Codacy.Read 15 Oct 2026 · opencollective.com
Complexity analysis
The complexity mode ranks files and folders by complexity without running a clone scan.Read 15 Oct 2026 · jscpd.dev
Dashboard and health
Dashboard and health modes combine duplication, dead-code and complexity measures into a scored project view.Read 15 Oct 2026 · jscpd.dev
Dead-code analysis
The dead-code mode reports unused files, exports, symbols and imports for JavaScript, TypeScript and Python.Read 15 Oct 2026 · jscpd.dev
Dead-code limits
The dashboard documentation says dead-code analysis covers JavaScript, TypeScript, and Python, plus Rust when compiler diagnostics are supplied.Read 29 Sep 2026 · jscpd.dev
Developer workflow
It can run in pre-commit hooks through the pre-commit framework, Husky, or a shell hook.Read 29 Sep 2026 · jscpd.dev
Documentation depth
Documentation includes installation, guides, concepts, CLI and configuration references, reporters, supported formats, Rust crates, MCP, benchmarks and migration material.Read 15 Oct 2026 · jscpd.dev
Editor integration
The language server supplies diagnostics and navigation actions for Neovim, Helix, Sublime Text, Emacs and JetBrains editors.Read 15 Oct 2026 · jscpd.dev
Exact clones
Default detection finds identical token sequences while ignoring whitespace, layout and comments.Read 15 Oct 2026 · jscpd.dev
Git history
The history mode scans commits over a range and charts duplication changes over time.Read 15 Oct 2026 · jscpd.dev
Independent maintenance signal
Snyk classified the project maintenance as healthy and reported one maintainer, active repository metadata and recent releases.Read 15 Oct 2026 · security.snyk.io
Install platforms
Official installers provide macOS and Linux shell builds plus Windows x64 and ARM64 PowerShell builds; Docker publishes amd64 and arm64 images.Read 15 Oct 2026 · jscpd.dev
Languages
The site says jscpd supports 224 languages.Read 29 Sep 2026 · jscpd.dev
Limit: CI success ambiguity
GitTested found unknown formats, missing paths, unwritable output, invalid modes and misspelled configuration keys could still exit with status zero.Read 15 Oct 2026 · gittested.com
Limit: human review required
GitTested noted that jscpd identifies repeated passages but does not decide whether repetition should be refactored or retained.Read 15 Oct 2026 · gittested.com
Local use
The site describes a CLI-first tool for laptops and CI/CD, and provides Docker installation.Read 29 Sep 2026 · jscpd.dev
Maintainer identity
An iForum speaker profile identifies Andriy Kucherenko as the author of the open-source jscpd project and a lead software engineer at EPAM Systems in 2019.Read 15 Oct 2026 · 2019.iforum.ua
MCP server
A built-in stdio MCP server works with Claude, Cursor, Copilot and other clients and exposes read-only clone-analysis tools.Read 15 Oct 2026 · jscpd.dev
Native binary
The v5 release is a self-contained native binary that does not require a Node.js runtime.Read 29 Sep 2026 · jscpd.dev
Near-miss clones
Gap and syntax-tree similarity modes detect copies with inserted, removed or changed lines and structurally similar functions.Read 15 Oct 2026 · jscpd.dev
Package provenance
PyPI records a release uploaded October 9, 2026, credits Andrey Kucherenko as author and requires Python 3.8 or newer.Read 15 Oct 2026 · pypi.org
Praise: practical detection
GitTested found verified file-and-line locations and judged 16 of its 20 highest-impact clone groups plausible consolidation candidates in a production monorepo scan.Read 15 Oct 2026 · gittested.com
Praise: workflow breadth
GitTested reported successful JSON, HTML, XML, CSV, Markdown, badge, SARIF, AI, console, summary and MCP outputs in its test.Read 15 Oct 2026 · jscpd.dev
Project history
Open Collective describes jscpd as maintained by a single developer since 2013.Read 15 Oct 2026 · opencollective.com
Release news
The changelog records jscpd v5.4.0 released on September 30, 2026 with a language server and experimental codebase comparison.Read 15 Oct 2026 · jscpd.dev
Renamed clones
Optional identifier and literal normalization detects copies whose variable names or values changed.Read 15 Oct 2026 · jscpd.dev
Reporters
The Rust release provides reporters including console, JSON, XML, CSV, HTML, Markdown, SARIF, CodeClimate, OpenMetrics, badge, Xcode, AI and silent outputs.Read 15 Oct 2026 · jscpd.dev
Reports
Reporters include HTML, JSON, XML, README badges, SARIF, CodeClimate, and OpenMetrics formats.Read 29 Sep 2026 · jscpd.dev
Rust API and SDKs
Rust developers can embed cpd-finder, cpd-core, cpd-tokenizer, cpd-reporter and cpd-semantic crates, while the v4 Node.js API remains on a separate branch.Read 15 Oct 2026 · jscpd.dev
Security statement
Snyk reports no direct vulnerabilities and no known security issues for the version it analyzed, excluding dependency vulnerabilities.Read 15 Oct 2026 · security.snyk.io
Self-hosting
The product is distributed as a local binary, package, container or source build and has no vendor-hosted execution requirement stated.Read 15 Oct 2026 · jscpd.dev
Semantic clones
Experimental semantic mode compares function embeddings within or across languages.Read 15 Oct 2026 · jscpd.dev
Semantic release news
The changelog records experimental semantic-clone detection introduced in v5.3.3 on September 28, 2026.Read 15 Oct 2026 · jscpd.dev
Supported formats
The project states that jscpd supports 224 programming languages and formats.Read 15 Oct 2026 · jscpd.dev
System requirements
The native binary needs no runtime; the npm launcher requires Node.js 18 or newer, and Python packaging supplies platform wheels.Read 15 Oct 2026 · jscpd.dev

Plans and prices

jscpd Free Open-source code detector · installs via curl, PowerShell, npm, pip, cargo, Homebrew, Nix, Docker, or npx Read 29 Sep 2026 · jscpd.dev
jscpd open-source distribution Free self-hosted CLI; installation via npm, PyPI, Cargo, Homebrew, Nix, Docker or installers Read 15 Oct 2026 · github.com

Every jscpd plan and price →

Strong points and limits

Strong points

  • Supports 224 languages, according to the project.
  • Can enforce duplication thresholds in builds.
  • Provides SARIF and several other report formats.
  • Native binaries are listed for three operating systems.

Limits

  • Semantic clone detection is experimental.
  • Dead-code analysis covers only listed languages.

Who it suits

jscpd suits developers who want to check repositories for duplication locally or in CI. Its threshold enforcement, CI integrations, and pre-commit options fit teams adding clone checks to their development workflow.

jscpd in depth

Read the full write-up

jscpd is a repository-level code clone detector for developers who want duplication checks on laptops and in CI. It is strongest as a configurable, token-based guardrail; it is a less complete choice for teams expecting mature semantic matching or broad dead-code analysis.

Overview

Scanning defaults to exact clones, with optional detection for renamed and near-miss clones as well as semantic clones. The project says it supports 224 languages, making it a practical fit for repositories that span several languages. Semantic detection is experimental, however, so teams should not treat it as equivalent in maturity to the default exact-clone check.

jscpd can fail a build when duplication passes a configured threshold. That makes it useful not only for finding existing repetition but also for setting a limit on new duplication in a repository. Its CLI-first approach supports local work and CI/CD, and Docker is another installation route.

For a broader comparison, see Code Clone Detection Tools.

Key features

Detection and reporting

Token-based scanning underpins the clone detector. Reports can be generated as HTML, JSON, XML, SARIF, CodeClimate, and OpenMetrics, or as README badges. The range suits teams that need either a readable report or output for automated tooling; the useful format depends on the systems already in their workflow.

CI and commit-time checks

The GitHub Action scans repositories, enforces a threshold, and uploads SARIF for GitHub Code Scanning. GitLab CI reporters are also documented. Teams can bring checks earlier in the development cycle with the pre-commit framework, Husky, or a shell hook. These options make jscpd more than an occasional reporting utility: it can be part of a continuing duplication policy.

Native and AI-assisted workflows

The v5 release is a self-contained native binary, so it does not require a Node.js runtime. Direct binaries are offered for macOS, Linux, and Windows, including x64 and ARM64 variants. A built-in MCP server lets Claude, Cursor, and other MCP clients check for clones, and the project provides agent skills. These integrations may suit teams already using those tools, while the native binary keeps the basic scanner usable without a Node.js setup.

Project dashboard

A single run can summarize project size, duplication, complexity, dead code, and a health score. Dead-code coverage is narrower than clone detection: it covers JavaScript, TypeScript, and Python, plus Rust when compiler diagnostics are supplied. Teams working in other languages should not rely on the dashboard for dead-code analysis.

Pricing

jscpd is open-source software with a free plan priced at free. The plan is an open-source code detector, with installation through curl, PowerShell, npm, pip, cargo, Homebrew, Nix, Docker, or npx. There are no paid tiers to weigh against reduced features; its appeal is that the repository scanner and its documented workflows come at no software charge. The provided plan does not state seat or scan quotas.

Platforms

jscpd supports Linux, macOS, and Windows, including direct x64 and ARM64 binaries, and can be self-hosted. The project also provides an API and a Docker installation route. Its native v5 binary removes the Node.js runtime requirement, which is useful for teams that want a standalone executable rather than a Node-based installation.

Who it's for

jscpd is a good fit for developers and teams that want repository-wide clone detection, a threshold that can block builds, and reporting that can feed CI systems. It is particularly suited to mixed-language repositories and teams that value both local hooks and automated checks. It is not the right choice for a team whose main need is reliable semantic clone detection or dead-code coverage across languages beyond those named.

Pros and cons

Broad language reach: support for 224 languages makes it suitable for repositories with varied source code.

Useful enforcement paths: threshold failures, GitHub Action and GitLab CI reporting, and commit hooks let teams place checks at several points in a workflow.

Flexible outputs: formats from HTML and README badges to SARIF and OpenMetrics can serve both developers and automated systems.

Standalone distribution: the native binary avoids requiring a Node.js runtime, with x64 and ARM64 builds across the named desktop platforms.

Important scope limits: semantic detection is experimental, and dead-code analysis covers only JavaScript, TypeScript, Python, and conditionally Rust.

Alternatives

Duplo is another free code-clone detection option, with prebuilt binaries for Alpine Linux, macOS, and Windows under GNU GPL v2 or later. PMD may suit readers seeking a free, BSD-style licensed static code analyzer instead. Simian Similarity Analyzer is a free, open-source option under Apache License 2.0, while CloneWorks is free under terms requiring acknowledgement and free redistribution and derivatives. dcd is a free AGPL-3.0 alternative for Linux and macOS; it also offers priority direct email support from the developer at a price not listed. NiCad is free under MIT terms and requires OpenTxl 11 or later. QuickDup is another free option for Linux, macOS, and Windows. Algo VPN is also listed as an alternative.

Verdict

Choose jscpd if you want a free, open-source repository scanner that can enforce duplication thresholds and fit into local hooks and CI without requiring a Node.js runtime for its native binary. Its language reach and reporting options are substantial strengths. Look elsewhere if semantic matching is central to your decision, or if you need dead-code analysis beyond its documented language coverage.

Verdict

jscpd offers repository scanning, threshold enforcement, and multiple CI and reporting paths at no cost. Semantic detection remains experimental, and dead-code coverage is limited to the named languages.

Where Specifiction places it

Alternatives to jscpdAll alternatives →