jscpd

Overview

jscpd is a free, open-source repository scanner for duplicate code. It is best suited to developers and teams that want one clone check to run on laptops, in commits, and in CI, with a threshold that can stop a build. Its broad language coverage and integration options make it flexible, while its more ambitious semantic matching is still experimental.

Scanning is token-based. Exact clones are detected by default; renamed, near-miss, and semantic clones require opt-in. The project says it supports 224 languages, a strong fit for mixed-language repositories, although its dead-code analysis covers only JavaScript, TypeScript, Python, and Rust when compiler diagnostics are supplied. For a wider comparison, see Code Clone Detection Tools.

Key features

Detection and analysis

Repository-wide scanning can enforce a configured duplication limit and fail the build when that limit is exceeded. Exact matching is the sensible default for dependable policy checks. Renamed and near-miss modes can find less obvious repetition, but semantic detection is explicitly experimental, so it should support investigation rather than carry the same authority as an exact-clone gate.

A single run can summarize project size, duplication, complexity, dead code, and a health score. That broader dashboard is useful when clone debt is one part of a larger review, but teams should not mistake its language-limited dead-code coverage for a general dead-code analyzer.

Reports and automation

Output formats include HTML, JSON, XML, README badges, SARIF, CodeClimate, and OpenMetrics. This covers readable reports, repository badges, and ingestion by code-scanning or metrics systems without forcing one reporting workflow.

The GitHub Action scans repositories, applies the threshold, and uploads SARIF to GitHub Code Scanning. GitLab CI reporters are documented as well. Pre-commit framework, Husky, and shell-hook support moves checks earlier in the developer workflow, which is useful for teams that want duplication caught before CI.

Installation and AI workflow

Version 5 is a self-contained native binary and does not need a Node.js runtime. Direct binaries are listed for macOS, Linux, and Windows, including x64 and ARM64 variants; Docker is also supported. A built-in MCP server lets Claude, Cursor, and other MCP clients check for clones, and agent skills are provided for AI-assisted workflows. Those integrations broaden where results can be requested, but they do not change the experimental status of semantic matching.

Pricing

jscpd is free and open source. The jscpd plan costs nothing and is described as an open-source code detector. Installation is offered through curl, PowerShell, npm, pip, cargo, Homebrew, Nix, Docker, or npx. There are no paid seats, usage quotas, trial periods, or renewal terms stated for this plan. Its main trade-off is that support and operating responsibility remain with the team using the self-hosted or local tooling.

Platforms

Platforms are API, Linux, macOS, self-hosted, and Windows. Native downloads include x64 and ARM64 builds for macOS, Linux, and Windows, while Docker provides another local or CI deployment route.

Who it's for

Choose jscpd when a repository needs configurable duplication gates, many language options, machine-readable reports, and integrations spanning GitHub, GitLab, commit hooks, and MCP clients. It is particularly suitable for mixed-language codebases and teams that prefer a CLI-first, self-hosted tool.

Look elsewhere if you need mature semantic clone analysis or broad dead-code coverage beyond the languages supported by its dashboard. Teams wanting a managed service rather than local and CI operation may also find its open-source, self-run model less convenient.

Pros and cons

• Pros: supports 224 languages, making it practical for polyglot repositories.
• Pros: exact, renamed, near-miss, and experimental semantic modes let teams tune detection depth.
• Pros: threshold-based build failure and SARIF upload connect clone policy directly to CI review.
• Pros: HTML, JSON, XML, badges, SARIF, CodeClimate, and OpenMetrics serve different reporting systems.
• Pros: native binaries avoid a Node.js runtime, with x64 and ARM64 downloads plus Docker.
• Cons: semantic detection is experimental, so it is not a dependable replacement for exact-clone checks.
• Cons: dead-code analysis is limited to JavaScript, TypeScript, Python, and conditionally Rust.
• Cons: the open-source model leaves deployment and ongoing operation to the user.

Alternatives

Duplo is a free GNU GPL v2-or-later option with prebuilt Alpine Linux, macOS, and Windows binaries. PMD is a free BSD-style downloadable static code analyzer for Linux, macOS, self-hosted, and Windows. NiCad is free MIT-licensed software for Linux, macOS, self-hosted, and Windows, but requires OpenTxl 11 or later.

dcd is free and AGPL-3.0 licensed on Linux and macOS, with optional priority support at custom pricing. CloneWorks is free on Linux, macOS, and Windows, subject to acknowledgement and free-of-charge redistribution terms. Simian Similarity Analyzer is free open source under Apache License 2.0 for Linux, macOS, and Windows.

CCFinderSW is a free MIT-licensed Windows tool requiring Java Runtime Environment 8 or later. Algo VPN is a free self-hosted VPN setup tool rather than a code-clone detector, so it is not a direct substitute.

Verdict

jscpd is a strong choice for developers and CI teams that want free, repository-wide clone detection with enforceable thresholds, extensive reports, and broad platform coverage. Choose it for dependable exact-clone gates and workflow flexibility; look elsewhere when experimental semantic matching or wider dead-code analysis is central to the decision.