phpcpd-next

What phpcpd-next is

phpcpd-next is a free, MIT-licensed token-based detector for copied and similar PHP code across a repository. It targets PHP 8.4 and later and is a successor to Sebastian Bergmann’s phpcpd. By default, it combines Rabin-Karp exact matching with TokenBag detection for reordered code. An optional unified engine looks for exact, renamed, gapped, and reordered clones, while optional orphan detection identifies unreferenced classes, interfaces, traits, enums, and functions. Reports can be produced in the console, PMD-CPD XML, JSON, or SARIF 2.1.0. For CI, it offers meaningful exit codes, result caching, and a per-file incremental index; clone findings produce exit status 1. Documented integrations include PHPUnit, an in-process headless API, framework presets, and SARIF upload to GitHub Code Scanning. Installation options are Composer as a development dependency or global package, and source. It requires PHP 8.4 or later, ext-dom, and ext-mbstring, with zero Composer runtime dependencies. The project describes advanced engines as research-grade and says they can produce more false positives than the default detection set.

Who it suits

It suits PHP developers who want repository-level clone detection in CI or through documented PHPUnit and GitHub Code Scanning integrations. Users need PHP 8.4 or later and the required extensions.

Limits

The free, MIT-licensed plan requires PHP 8.4 or later, ext-dom, and ext-mbstring. Optional advanced engines are described as research-grade and may produce more false positives than the default set.

Getting started

1. Open the project website on GitHub.
2. Install it as a Composer development dependency, a global Composer package, or from source.
3. Use PHP 8.4 or later and install ext-dom and ext-mbstring.
4. Run it against a PHP repository; enable optional detection modes if needed.

Verdict

phpcpd-next offers several clone-detection modes and output formats, including options for CI workflows. Its advanced engines carry a stated false-positive caveat, and the duplicated-line percentage cannot replace review of structural repetition in code design.