jscpd

jscpd is an open-source copy/paste detector that finds duplicated code blocks across source files in 223+ languages. It implements the Rabin-Karp algorithm to compare tokenized code segments, reporting the exact file locations, line ranges, and token counts for every clone it finds. The tool exists because duplicated code means the same bug can appear in multiple places, and jscpd gives teams a measurable, automatable way to track and reduce that risk.

The fastest install is `npm install -g jscpd` (installs both `jscpd` and `cpd` commands) or `cargo install jscpd` for the Rust-native install. You can also use the universal installer: `curl -fsSL https://jscpd.dev/install.sh | bash`. Once installed, run `jscpd ./src` to scan a directory; add `--reporters html,json` for report files, or `--threshold 10` to fail CI when duplication exceeds 10%. The v5 binary is self-contained and requires no Node.js runtime.

Yes, jscpd is released under the MIT license and is fully free to use. The source is on GitHub at kucherenko/jscpd. The project accepts optional sponsorship via OpenCollective, but there are no paid tiers or commercial licenses.

jscpd is best for teams that want a fast, CI-integrated gate on copy/paste debt across large or polyglot codebases. Its cross-format detection catches duplication between Vue SFC script blocks and plain TypeScript files, which most linters miss. The AI reporter and MCP server make it equally useful inside agentic coding workflows where an LLM needs structured clone data to drive refactoring.

v5 is a Rust rewrite that is 24-37x faster than v4 across all codebase sizes, ships as a self-contained binary, and adds git blame and an AI-optimized reporter. The trade-off is that v5 drops the Node.js programmatic API (`jscpd()`, `detectClones()`) and LevelDB/Redis persistent stores. If your workflow depends on programmatic Node.js usage or distributed caching, stay on v4; for everything else, v5 is the drop-in upgrade with the same CLI flags and config file.

jscpd detects duplication at the token level, not the AST or semantic level, so structurally different but logically equivalent code may not be flagged. The v5 Rust engine does not yet support LevelDB or Redis stores, which affects parallel CI runs that rely on a shared cache. Benchmarks in the README were run on Apple Silicon, so performance on other platforms may vary. Finally, cross-format detection (Vue, Svelte, Astro, Markdown) requires that the file types are in the supported formats list, which you can verify with `jscpd --list`.