jscpd

Duplicate code detector for 220+ languages — plus dead code, complexity hotspots, duplication and health trends over git history, and one health score for the whole codebase. Rust engine, self-contained binary, AI-ready with an MCP server and a token-efficient reporter.

Documentation: https://jscpd.dev

jscpd tokenizes each of its 224 supported formats the way that language defines it — its own comment and string rules, not generic text — then finds duplicated token sequences across files with a rolling Rabin-Karp hash. Opt-in passes catch copies that differ only in names or values (Type-2) or that have a few edited lines (Type-3), and an experimental one uses a code embedding model for functions that do the same thing written differently (Type-4). See How detection works for the full mechanism, and Supported formats for the full list.

Beyond duplicates, jscpd also finds dead code (--dead-code), ranks files by complexity (--complexity), tracks duplication and health over git history (--history), and rolls it all into one health score (--health) — see Features below.

Quick Start

# macOS / Linux
curl -fsSL https://jscpd.dev/install.sh | bash

# Windows (PowerShell)
irm https://jscpd.dev/install.ps1 | iex

# No install — run once with npx (Node.js)
npx jscpd .

Then scan a project:

jscpd /path/to/code

Other install methods

GitHub Action

- uses: kucherenko/jscpd@v5
  with:
    threshold: 5

Uploads SARIF results to GitHub Code Scanning by default. See CI & Pre-Commit Hooks for all inputs and outputs.

Related MCP server: tree-sitter-analyzer

Documentation

Features

jscpd v5 is a Rust engine that ships as a self-contained binary — no runtime required — under two npm names (jscpd installs the jscpd command, cpd installs cpd), on PyPI, crates.io, Homebrew, Nix, Docker, and as a GitHub Action.

Duplicate detection

• Language-aware tokenization — per-format comment and string syntax for all 224 formats, the oxc parser for JavaScript/TypeScript/JSX/TSX, embedded-language extraction for Vue, Svelte, Astro, Markdown and Razor, and keyword/identifier/literal classification, so a clone is a repeated sequence of language tokens, never a repeated run of text (see How detection works)

• 224 language formats, with cross-format detection (Vue SFC, Svelte, Astro, Markdown) and --cross-formats groups to match clones across JavaScript and TypeScript

• Type-2 clones — --ignore-identifiers, --ignore-literals and --ignore-annotations find blocks that differ only in names, literal values or annotations, reported as renamed. A name must stand for one name on the other side, so x = x + x does not match d = a + b; --ignore-identifiers=blind matches any names, as 5.4 did (see docs)

• Type-3 near-miss clones — --max-gap-lines N merges a copy with a few inserted or changed lines into one similar clone with a similarity score; --similarity compares whole functions of JavaScript, TypeScript, Python, Java, Kotlin, Scala, C#, Go, Rust, C, C++, PHP, Ruby, Swift and Clojure by the subtrees of their normalized syntax trees, in code blocks of Markdown and components as well: renamed locals (each standing for one name on the other side) and other literals match, other called functions or operators do not, and test files are left out; the edn reporter lists every pair with its score (see docs)

• Type-4 semantic clones (experimental) — --semantic embeds the functions of JavaScript, TypeScript, Vue, Svelte, Astro, Python, Rust, Go, Java, Kotlin, C#, C, C++, PHP, Ruby, Scala and Swift files with a code embedding model, either one jscpd runs itself (after jscpd --semantic-download once) or any OpenAI-compatible API, and reports functions that do the same thing written differently: the same feature implemented twice in one language, or a rule your Rust backend enforces and your Svelte frontend repeats (see Semantic clones below)

• Port progress and parity (experimental): jscpd --compare python/ typescript/ pairs the functions of two folders with the same model and lists which functions of each have a counterpart in the other: what is left to port to another language or platform, or what the Android version of an app has that the iOS one lacks (see Comparing two codebases below)

• Boundaries: rules in .jscpd.json keep the code of a module, a folder, a file or a method inside its boundary, such as money that only the backend may calculate. A copy of it in a place a rule keeps it out of fails the run, whether someone copied it, edited the copy or wrote the logic again in another language (see Boundaries below)

• Clone kinds everywhere — exact, renamed or similar in the console, JSON (kind, similarity, method), XML, HTML, Xcode, SARIF (jscpd/duplicate-code, jscpd/renamed-code, jscpd/similar-code, jscpd/similar-function, jscpd/semantic-code) and Code Climate output; default runs still report only exact clones

• --kind — keep only the clone kinds you care about: --kind renamed, or --kind gap,ast for near-miss clones only. Statistics and --threshold follow the filter; a kind whose detector is off warns, an unknown kind errors (see docs)

• 15 reporters: console, console-full, json, xml, csv, html, markdown, badge, sarif, codeclimate, openmetrics, ai, xcode, threshold, silent

• Clone baseline — gate CI on new duplication only. --baseline .jscpd-baseline.json --fail-on-new-clones[=N] tolerates legacy clones and fails the build on regressions; --baseline-from-ref origin/main does the same without a committed file (see docs)

• Only the files you changed — jscpd --changed . reports the clones of the files git status lists, matched against the whole project, and marks the ones HEAD didn't have as new; --changed-only compares the changed files only with one another. The baseline of HEAD is saved on the first run and built again after a commit (see docs)

• Exit codes you can gate on — an unknown --format, a missing scan path or a reporter that can't write its file now exit 1 instead of passing with an empty report; --fail-on-empty fails a scan that analyzed no files (see Exit codes)

• GitLab-ready reporters — codeclimate (gl-code-quality-report.json) and openmetrics (jscpd-metrics.txt) plug into artifacts:reports

• Git blame with side-by-side author comparison (--blame --reporters console-full)

• --skip-local — report only clones that cross the scan roots: jscpd packages/api packages/web --skip-local drops pairs inside either tree, keeping only api-to-web duplication

• --skip-isolated — ignore duplication between monorepo folders owned by different teams (--skip-isolated "packages/team-a|packages/team-b")

Beyond duplication

• --history — duplication and health trend over git history: jscpd --history scans the current folder over the last 30 commits of the branch, jscpd src --history v5.0.0..HEAD the commits of a range, a merged branch as its merge commit. It prints bar charts of the duplication percentage and the health score, a per-commit table with the change between points, the trends with the score of each health dimension at both ends, and how far --threshold could be tightened; --health and --dashboard print the series too (see docs)

• --dead-code — find code nothing runs, not just code written twice: unused files, exports, declarations and imports across JavaScript, TypeScript and Python. Builds the import graph from your entry points (package.json, pyproject.toml, framework conventions) and walks it, so dead code cascades — a helper whose only caller is dead gets reported too, each finding with a confidence score and, below 100, why it might be wrong. Also ships standalone as basta (see docs)

• --summary — refactoring hotspots straight from the scan: top files and folders by tokens, lines, size, and a complexity estimate (see docs)

• --complexity — the complexity ranking alone, without clone detection: most complex files and folders from one tokenizing pass, in the console, ai or json (see docs)

• --health — one 0-100 score with a grade, from the share of code that's duplicated, dead, or concentrated in complex files; size-aware, calibrated on 42 open-source projects, extensible with coverage, test or security metrics via --health-input. Console badge, JSON, SVG badge (see docs)

• --dashboard — the whole picture on one screen, under the health badge: project size with the largest code files, duplication by clone kind with the most duplicated files, the most complex files, and dead code by category for JavaScript, TypeScript and Python (see docs)

AI and operations

• --mcp — built-in MCP server over stdio with fully described tools: point your AI assistant at the binary and it can check a snippet against your codebase for all four types of clone (exact, renamed, near-miss and semantic), list a file's clones, and compare two folders function by function (see docs)

• --lsp: a language server over stdio. Clones, similar functions, semantic clones, dead code and complexity show up as diagnostics in the files you edit and follow the text as you type, each analysis with a switch of its own (see Editors below)

• AI reporter — token-efficient output for LLM pipelines (~79% fewer tokens than console)

• Prebuilt for 8 platforms — macOS arm64/x64, Linux arm64/x64 (glibc and musl), Windows arm64/x64

• --workers — control parallelism for file tokenization and detection (default: all CPU cores)

• Config discovery — .jscpd.json, .config/jscpd.json, or the jscpd key in package.json

• Symbolic links are skipped unless --follow-symlinks — v4 followed them by default. With the flag, a file reached through a link is reported by the path it was found at, and a file reachable through several paths is counted once

• Quiet in pipelines — tips and sponsor lines print only on an interactive terminal; --no-tips, CI or JSCPD_NO_TIPS switch them off everywhere

See the Rust docs for the full CLI reference and rust/CHANGELOG.md for release notes.

Looking for v4?

jscpd v4 (TypeScript engine, Node.js API, LevelDB/Redis stores) is maintained on the master-v4 branch and published as jscpd@4 / the latest-4 dist-tag. README-v4.md describes it in one page (install, CLI, API, packages, maintenance policy); the same content is at https://jscpd.dev/getting-started/v4.

Packages

Who Uses jscpd

The jscpd npm package is downloaded 10M+ times per month, and ~5,000 repositories declare it on GitHub's dependents graph.

Bundled by analysis platforms:

• GitHub Super Linter — official GitHub linter aggregator, bundles jscpd as its copy/paste detector and runs it by default; 15,500+ workflow files on GitHub reference Super Linter (as of Sep 2026)

• MegaLinter — open-source linter aggregator for CI, ships jscpd in every flavor including ci_light

• Codacy — automated code analysis platform, jscpd powers the duplication engine

Explicitly enabled in Super Linter (VALIDATE_JSCPD: true) by dozens of public repositories, including:

• A2A — Google's Agent2Agent protocol (25k+ stars)

• RimSort — mod manager for RimWorld (1.2k+ stars); also runs jscpd directly with its own .jscpd.json

• Contact Center AI samples — official Google Cloud samples, with a dedicated jscpd config

• Drifty — open-source download manager

Used in notable projects:

• OpenClaw — personal AI assistant, runs jscpd as a duplication gate in its check scripts

• DeepSeek Harness — DeepSeek's plugin harness, jscpd config in CI

• degit — Rich Harris's project scaffolder

• MEGA webclient — the MEGA.nz web client

• Microsoft TypeAgent

• Salesforce DX VS Code

• Alibaba AppWorks — embeds jscpd as a library

• OVHcloud manager — OVHcloud's customer control panel

• KiroCrew — self-improving persistent development workspace

Recommended aggregator settings

Super Linter and MegaLinter both run jscpd with threshold: 0 by default, which fails a build on any duplication at all, including clones that were already there. That is the most common reason projects end up setting VALIDATE_JSCPD: false. Gate on new duplication instead, and leave the threshold out:

jscpd . --baseline-from-ref origin/main --fail-on-new-clones 0

--baseline-from-ref scans the base ref's tree with the same configuration and marks the clones that are absent from it as new, and --fail-on-new-clones 0 fails the run when there is one. Every clone is still reported, and --threshold still compares the duplication of the whole tree, so keep threshold: 0 out of the config, or the old clones fail the build as before. The base ref has to be in the checkout: with actions/checkout set fetch-depth: 0, or run git fetch origin main first, otherwise jscpd stops with an error. jscpd needs the whole tree to find clones, so VALIDATE_ALL_CODEBASE: false does not narrow the scan.

Super Linter takes the same gate from .github/linters/.jscpd.json, on v9.0.0 or later: see Using jscpd with Super Linter.

When several linters write into one reports directory, give jscpd its own file name so parallel runs cannot overwrite each other:

jscpd . --reporters json --output reports --report-name megalinter-jscpd
# -> reports/megalinter-jscpd.json

--report-name sets the base name for the json, xml, csv, html, markdown, sarif and edn reports, and defaults to jscpd-report. It can also be set as reportName in .jscpd.json, or with the report-name input of the GitHub Action. The name is a plain file name, so a path, an extension or an empty name is an error. The badge, OpenMetrics and CodeClimate files (jscpd-badge.svg, jscpd-metrics.txt, gl-code-quality-report.json) keep their names, so the pipelines that read them keep working. When two runs write those too, give each run its own --output.

Benchmark

Compared against other copy/paste detectors on the fixtures/ corpus (547 files, 150+ formats), default thresholds, wall-clock time on Apple Silicon:

Methodology, cross-format detection and AI-token-efficiency comparisons: benchmark/BENCHMARK.md. Re-run with benchmark/benchmark.sh.

Semantic clones (experimental)

Token matching finds code that someone copied. It cannot find two functions that do the same job with different code, such as a validation rule that a Rust backend enforces and a Svelte frontend writes again, or two helpers that two people wrote for the same task. --semantic looks for these pairs with a code embedding model. jscpd turns every function into a vector and reports two functions as a semantic clone when each is the other's closest match and their vectors are similar enough.

jscpd --semantic-download                                    # once: CodeRankEmbed, 548 MB, into the jscpd cache
jscpd --semantic src/                                        # pairs within one language and across languages
jscpd --semantic --semantic-scope cross backend/ frontend/   # only pairs across languages
jscpd --semantic --kind semantic -r ai .                     # only semantic clones, one line each

The model runs inside jscpd on the CPU, so a scan makes no network call. The default model is CodeRankEmbed (MIT), and jscpd can also run jina-embeddings-v2-base-code. jscpd --semantic-models lists nine models with the thresholds jscpd calibrated for each one, and --semantic-model picks one of them. To use a model that jscpd does not run itself, point --semantic-url at an OpenAI-compatible embeddings API such as Ollama, LM Studio or llama-server. jscpd reads an API key only from the JSCPD_SEMANTIC_API_KEY environment variable.

jscpd compares the functions of JavaScript, TypeScript, JSX, TSX, Vue, Svelte, Astro, Python, Rust, Go, Java, Kotlin, C#, C, C++, PHP, Ruby, Scala and Swift files. A pair within one language needs a higher similarity than a pair across languages, because code in one language resembles other code in that language whatever it does. With CodeRankEmbed the two thresholds are 0.4125 and 0.6375, and --semantic-threshold and --semantic-same-threshold change them. jscpd caches the vectors, so a second run embeds only the functions whose code changed.

The console, ai, JSON, SARIF and Code Climate reporters mark these clones as kind semantic with their similarity. The mode is experimental. Besides real duplicates it reports related code, such as a client function and the server endpoint it calls, so review a pair before you merge the two functions. The docs describe the rules, fixtures/semantic-demo is a runnable example with a Rust backend and a SvelteKit frontend, and Embedding Models compares the nine models.

Comparing two codebases (experimental)

--compare takes two folders and pairs their functions with the --semantic model. During a port, such as a library moving to another language or an iOS app moving to Android, it shows which functions of the source already have a version in the target and which are still to port. For two implementations of one app, such as the Android and the iOS one, it shows what both have and what only one of them has.

jscpd --compare python typescript        # progress of a port: the source first, the target second
jscpd --compare ios android -r console-full  # parity, with every pair and its similarity

Code
 71% 5 of 7 functions in python have a counterpart in typescript
 80% 4 of 5 functions in typescript have a counterpart in python

Paired under other names (1):
  python                        typescript              similarity
  billing.py:28 tax_for_region  billing.ts:27 salesTax  0.87 high

Only in python (2):
  billing.py (1)
    46  due_date                6 lines
  shipping.py (1)
    18  estimate_delivery_days  8 lines

Tests
 75% 3 of 4 tests in python have a counterpart in typescript
100% 3 of 3 tests in typescript have a counterpart in python

A function pairs with its counterpart when the model finds them each other's closest match. A short function the model cannot place pairs by name when the names match once case and underscores are ignored (encodeBinary, encode_binary) and the code is similar enough. jscpd measures tests and code in two blocks and pairs a test only with a test. It tells a test by the conventions of its language, such as *_test.go, test_*.py, *.test.ts, src/test/ or Rust's #[cfg(test)]. Every pair has its similarity and a level, high, medium or low, on the scale of the model, and the report lists the pairs under other names on their own, since nobody finds those by searching for a name. The console, JSON and Markdown reporters print the totals per side and per file with the mean similarity, the functions with no counterpart, and the pairs. -r html writes a migration map, a page that draws both sides as dependency graphs with the pairs bridging them and marks the functions ready to port, the ones whose callees all have a counterpart already. A second tab lists the same pairs as a table you can sort. The docs describe the rules and how they did on two real codebases, and fixtures/compare-demo is a runnable example.

Boundaries

Some code must stay where it is. In a bank or a shop only the backend calculates money, and a frontend that calculates it too shows one price and charges another as soon as the formula changes. A boundary rule names that code and the places its copies must stay out of:

{
  "boundaries": [
    {
      "name": "money",
      "code": ["backend/billing", "backend/loans/Interest.kt#monthlyPayment"],
      "notIn": ["web/**", "mobile/**"],
      "allow": ["web/e2e/**"]
    }
  ]
}

code takes modules, folders, files or methods, by name (#monthlyPayment) or by a pattern of names (#(*Payments)). Without notIn, every place outside code counts. Every clone run checks the rules with every method jscpd has: token clones for copy-paste, --similarity for an edited copy, and the model of --semantic for the same logic written again in another language, such as the annuity formula of a Kotlin backend in a TypeScript widget. A copy fails the run with exit code 1:

Boundaries:
money: 1 copy outside the boundary
  web/src/loan/payment.ts:4-14 monthlyPayment
    looks like backend/loans/Interest.kt:8-15 monthlyPayment (semantic ~0.82)

The logic written again in another language needs the embedding model, so run jscpd --semantic-download once, or point --semantic-url at an embeddings API. Without it jscpd prints a warning and still finds the copies and the edited copies. Each rule can set its own thresholds, and disable turns kinds of copies off: "disable": ["semantic"] for a rule that needs no model, or ["ast", "semantic"] for one that reports copy-paste only. The docs describe the rules, and fixtures/boundaries-demo is a runnable example.

Editors

jscpd --lsp runs jscpd as a language server. An editor starts it for a workspace, and the files you edit get what jscpd finds as diagnostics, updated as you type: clones by default, and similar functions, semantic clones, dead code and complexity when --lsp-analyses or the lsp section of .jscpd.json turns them on. A clone comes with "Go to the other copy" and "Ignore this clone" actions. In Neovim 0.11:

vim.lsp.config('jscpd', { cmd = { 'jscpd', '--lsp' }, root_markers = { '.jscpd.json', '.git' } })
vim.lsp.enable('jscpd')

Editors has the setup for Helix, Sublime Text, Emacs and JetBrains IDEs too, and fixtures/lsp-demo is a project that shows each analysis. Clients for VS Code and Zed will follow in a repository of their own.

AI-Ready Features

jscpd integrates into AI-powered workflows through three mechanisms:

AI Reporter

Token-efficient output for LLM pipelines (~79% fewer tokens than the default console reporter):

jscpd --reporters ai /path/to/source              # compact clone list
jscpd --reporters ai --summary /path/to/source    # + compact codebase summary
jscpd --reporters ai --complexity /path/to/source # most complex files, no clone detection

Agent Skills

Installable skills that teach AI coding assistants how to use jscpd, refactor detected duplications, and clean up a codebase more broadly:

After installation, ask your agent to "find and fix code duplication" and it will invoke jscpd with the right options and act on the results — or "clean up this codebase" for the broader pass, or "port this Python library to Rust" for a migration.

MCP Server

jscpd --mcp /path/to/project scans the project and serves the Model Context Protocol over stdio. An assistant can check a snippet against the codebase before writing it, list a file's clones, scan the working directory again and compare two folders function by function. The tools that find clones can look for exact (Type-1), renamed (Type-2), near-miss (Type-3) and semantic (Type-4) ones.

See AI-Ready docs for full details.

Citation

If jscpd is part of your research, cite it via the repository's CITATION.cff (GitHub's "Cite this repository" button produces BibTeX and APA) or with:

@software{jscpd,
  title        = {jscpd: copy/paste detector for programming source code},
  author       = {Kucherenko, Andrey},
  year         = {2026},
  version      = {5.3.0},
  license      = {MIT},
  url          = {https://github.com/kucherenko/jscpd},
}

Contributing

See CONTRIBUTING.md for the development setup, test policy, and pull request requirements. In short:

cd rust
cargo nextest run --workspace
cargo clippy --workspace --all-targets -- -D warnings
cargo fmt --all --check

Security issues go through the security policy, not public issues.

Backers

Thank you to all our backers! 🙏 [Become a backer]

Sponsors

Support this project by becoming a sponsor. Your logo will show up here with a link to your website. [Become a sponsor]

License

MIT © Andrey Kucherenko