jscpd

Why it's ranked here

The engine ships as one self-contained binary under the MIT license, installable through npm, PyPI, Cargo, Homebrew, Nix and Docker, with prebuilds for eight platforms. Its CI story is concrete: a baseline mode fails a build only on new copies, so legacy debt does not block adoption, and unknown formats or missing paths exit with an error instead of passing on an empty report. The project's own benchmark, run on its fixture set, has it finishing in 84 milliseconds against 36 seconds for PMD CPD. Those numbers are self-reported, but the breadth of formats and gating options is documented in detail.

What's good

Component files and Markdown are parsed section by section, so a clone inside a Vue style block or a fenced Python snippet is attributed to that language rather than matched as flat text. The agent reporter drops code fragments and shared path prefixes; the benchmark measures about 13 tokens per clone against roughly 110 for the console output. The bundled agent guide is unusually candid: it labels the renamed and near-miss passes noisy by design, lists the boilerplate that triggers false positives, and tells teams not to gate CI on those passes until they have reviewed the hits. Exit codes and GitLab-ready reporters make pipeline wiring simple.

Tradeoffs

Detection beyond exact copies comes with caveats. The syntax-tree similarity pass works only on JavaScript, TypeScript, JSX and TSX and is a silent no-op elsewhere. The semantic pass is experimental and its default local model is a 548 MB download. Dead code analysis covers JavaScript, TypeScript and Python only. Of 224 formats, 94 have no built-in extension and must be mapped by hand. There is no Node.js binding for the current engine, so other languages read its JSON output or talk to it over MCP. The Docker image omits git, which breaks blame and baseline-from-branch. The comparative benchmark was run by the project itself on its own fixtures.

How to use it well

It fits teams that want to stop copy growth in a polyglot repository without first paying down every existing duplicate. Start with a plain exact scan, then add the baseline gate in pull requests so only new copies fail the job. Run the renamed and near-miss passes separately and treat each hit as a lead to read; the guide suggests a minimum of 70 tokens for the renamed pass and a similarity of 0.85 or higher. Keep a separate baseline per configuration, since normalized runs fingerprint clones differently. Use the compact agent reporter when feeding results to an assistant. It does not fix code; it tells you where to look.

Observed

License

MIT

Language

Rust (Cargo workspace of seven crates)

Packaging

npm (jscpd and cpd names), PyPI, crates.io, Homebrew, Nix, Docker image

Interfaces

CLI, MCP server over stdio, language server over stdio, Rust library crates, GitHub Action

Platform support

Prebuilt binaries for macOS, Linux (glibc and musl) and Windows on arm64 and x64

Language bindings

No Node.js binding for the Rust engine; other languages use the JSON reporter or MCP

Report formats

Console, JSON, XML, CSV, HTML, Markdown, badge, SARIF, Code Climate, OpenMetrics, AI, Xcode