Skip to content
SPECIFICTION
Get listed

phpcpd-next

github.com

Free plan LinuxAPISelf-hosted
Visit github.com
Spec score 7.4 #9 of 18 in Code Duplication Detection Tools

What it is

phpcpd-next is a free, MIT-licensed, token-based detector for copied PHP code in repositories. It targets PHP 8.4 and later and succeeds Sebastian Bergmann’s phpcpd. The default run combines Rabin-Karp exact matching with TokenBag detection for reordered code. An opt-in unified engine detects exact, renamed, gapped and reordered clones, while optional orphan mode identifies unreferenced classes, interfaces, traits, enums and functions. Results can be printed to the console or written as PMD-CPD XML, JSON and SARIF 2.1.0. Meaningful exit codes, result caching and a per-file incremental index support continuous integration; clone findings return status 1. Documented integrations include PHPUnit, an in-process headless API, framework presets and SARIF upload to GitHub Code Scanning. Installation is available through Composer as a development dependency or global package, or from source. Requirements are PHP 8.4+, ext-dom and ext-mbstring, with zero Composer runtime dependencies. Advanced engines are described as research-grade and may produce more false positives than the default set.

Spec sheet

Purpose
phpcpd-next is a token-based copy/paste detector for PHP 8.4+ and a successor to Sebastian Bergmann’s phpcpd.Read 5 Oct 2026 · github.com
Integrations
The project documents PHPUnit integration, an in-process headless API, framework presets, and SARIF upload to GitHub Code Scanning.Read 5 Oct 2026 · github.com
Support
The opened project page describes contribution guidance and a Contributor License Agreement; it does not state a paid support plan.Read 5 Oct 2026 · github.com
License
The project states that phpcpd-next is licensed under MIT.Read 5 Oct 2026 · github.com
Founded
2026Read 28 Sep 2026 · github.com
CI use
Meaningful exit codes, result caching, and a per-file incremental index support CI use; clone findings produce exit status 1.Read 5 Oct 2026 · github.com
Detection
Its default run combines Rabin-Karp exact matching with TokenBag detection of reordered code; an opt-in unified engine detects exact, renamed, gapped, and reordered clones.Read 5 Oct 2026 · github.com
Limit: design repetition
The README says the duplicated-line percentage measures copied tokens and cannot substitute for reviewing structural repetition in code design.Read 5 Oct 2026 · github.com
Limit: research engines
The README describes advanced engines as opt-in and research-grade, with higher false-positive rates on real-world code than the default set.Read 5 Oct 2026 · github.com
Orphan detection
The optional --orphans mode finds unreferenced classes, interfaces, traits, enums, and functions.Read 5 Oct 2026 · github.com
Reports
It provides console, PMD-CPD XML, JSON, and SARIF 2.1.0 output formats.Read 5 Oct 2026 · github.com
Requirements
It requires PHP 8.4+, ext-dom, and ext-mbstring, and lists zero Composer runtime dependencies.Read 5 Oct 2026 · github.com
Setup
The documented installation is as a Composer development dependency, as a global Composer package, or from source.Read 5 Oct 2026 · github.com

Plans and prices

Open source Free MIT licensed · requires PHP 8.4+ with ext-dom and ext-mbstring · install via Composer Read 5 Oct 2026 · github.com

Every phpcpd-next plan and price →

Strong points and limits

Strong points

  • Free MIT-licensed open-source project
  • Detects exact and reordered token clones
  • Optional orphan detection for unused declarations
  • SARIF, JSON, XML and console reports
  • Caching and incremental indexing for CI

Limits

  • Requires PHP 8.4 or newer
  • Requires ext-dom and ext-mbstring
  • Advanced engines may increase false positives
  • No IDE integration is listed

Who it suits

It suits PHP teams scanning repositories for copied or reordered code, including CI workflows. Developers needing console, JSON, XML or SARIF results can use the documented output options.

Verdict

phpcpd-next offers repository-level PHP clone detection with CI-oriented exit codes, caching and multiple report formats. Its optional engines broaden detection but carry the project’s stated research-grade false-positive limitation.

Where Specifiction places it

Alternatives to phpcpd-nextAll alternatives →