Overview

jscpd is a free, open-source tool for finding duplicated code across a repository, with checks that can run locally or in CI. It is best suited to teams that want a configurable duplication threshold enforced in existing development workflows. Its broad language reach and reporting options are practical strengths; semantic clone detection is experimental, and its dead-code analysis covers a narrower set of languages.

Token-based scanning detects exact clones by default, while renamed, near-miss, and semantic clone checks are optional. Supporting 224 languages makes jscpd a plausible fit for mixed-language repositories, but it does not mean every analysis feature applies to every language.

For a broader comparison, see Code Clone Detection Tools.

Key features

Clone detection and reports

Report output spans HTML, JSON, XML, README badges, SARIF, CodeClimate, and OpenMetrics. Teams can use readable reports for review and machine-oriented formats to connect clone findings to other tooling. The default exact-clone mode is the sound place to start; the experimental status of semantic detection makes it a less suitable basis for enforcement.

CI and developer workflows

The GitHub Action scans repositories, applies a duplication threshold, and uploads SARIF for GitHub Code Scanning. GitLab CI reporters are also documented. Hooks via the pre-commit framework, Husky, or a shell script move checks earlier than CI, which is useful for teams wanting developers to see clone findings before a change is pushed.

Native and AI-assisted workflows

The v5 self-contained native binary removes the Node.js runtime requirement, and direct binaries are offered for macOS, Linux, and Windows, including x64 and ARM64 variants. That is a meaningful deployment advantage for teams that do not want to add Node.js to a build environment. A built-in MCP server lets Claude, Cursor, and other MCP clients check for clones, and the project also provides agent skills; these integrations extend the workflow but do not change the experimental status of semantic detection.

Repository dashboard

A single run can summarize project size, duplication, complexity, dead code, and a health score. Dead-code analysis covers JavaScript, TypeScript, and Python, with Rust support when compiler diagnostics are supplied. Teams working mainly in other languages can use the clone detection, but should not expect the dashboard's dead-code coverage to match its stated clone-detection breadth.

Pricing

jscpd: 0.00 USD per free. The open-source detector can be installed through curl, PowerShell, npm, pip, cargo, Homebrew, Nix, Docker, or npx. With no paid plan to move up to, the main trade-off is not a tier limit but whether its repository-level, token-based approach and feature-specific language scope meet the team's needs.

Platforms

jscpd supports API, Linux, macOS, self-hosted, and Windows environments. Its CLI-first design targets laptops and CI/CD, with Docker installation as another deployment route. Direct native binaries for macOS, Linux, and Windows, including x64 and ARM64 variants, make it easier to use without installing a Node.js runtime.

Who it's for

jscpd is a strong fit for developers and teams that want to detect repository-level duplication and prevent it from crossing a chosen threshold in CI. Its hooks and GitHub and GitLab workflows suit teams that want checks integrated into existing pipelines, while varied report formats help connect findings to different review and analysis systems. It is less compelling when the primary need is mature semantic clone detection or broad dead-code analysis across languages beyond JavaScript, TypeScript, Python, and the stated Rust case.

Pros and cons

Pro: Supports 224 languages for clone detection, which makes it useful for repositories spanning multiple languages.
Pro: Threshold enforcement, CI integrations, and pre-commit hooks give teams several ways to make clone checks part of normal development.
Pro: A self-contained native binary and platform binaries reduce runtime setup, including in environments without Node.js.
Con: Semantic clone detection is experimental, so teams should not treat it as a mature replacement for exact matching.
Con: Dead-code analysis has a narrower scope than clone detection, with Rust requiring compiler diagnostics.

Alternatives

For teams comparing other free clone-detection tools, copydetect and Hound are also free and list Linux, macOS, self-hosted, and API support; Hound additionally lists web support. Duplo is free under GNU GPL v2 or later and provides prebuilt binaries for Alpine Linux, macOS, and Windows. PMD is a free BSD-style static code analyzer for Linux, macOS, self-hosted, and Windows environments.

dcd is a free AGPL-3.0 option for Linux and macOS, with a separate priority-support plan. NiCad is free, MIT-licensed, and requires OpenTxl 11 or later. Simian Similarity Analyzer is free and open source under Apache License 2.0, and CloneWorks is free to use under terms requiring acknowledgement and free redistribution and derivatives.

Verdict

Choose jscpd if you need a free, repository-level clone detector that can enforce thresholds in CI and fit local hooks without requiring a Node.js runtime. Its combination of language reach, workflow integrations, and report formats is the case for choosing it. Look elsewhere if experimental semantic matching is central to your decision or if you need dead-code analysis across a broader language set.

	jscpd	semdup
Free plan	Yes	No
Free trial	No	No
Paid from	Free	—
Open source	No	No
Platforms	api, Linux, macOS, self-hosted, Windows	Linux, macOS, self-hosted, Windows
Clone detection method	token	semantic
Scan scope	repository	repository
CI integration	Yes	Yes
Self-hosted option	Yes	Yes

jscpd vs semdup

jscpd

semdup