Show HN: Jscpd start support type2/type3 clones

Copy/paste detector for programming source code. 220+ formats, language-aware tokenization, exact, renamed and near-miss clones, Rust engine, self-contained binary, AI-ready with MCP server and token-efficient reporter.

Documentation: https://jscpd.dev

jscpd reads code the way its language defines it, not as plain text. Each of the 224 formats is tokenized with its own comment and string syntax, so # in Python, -- in SQL or ' in Visual Basic opens a comment only where the language says so. JavaScript, TypeScript, JSX and TSX go through the oxc parser, which handles template literals, regular expressions, JSX and decorators, and can erase TypeScript-only syntax so a .ts file matches its .js twin. Vue, Svelte, Astro, Markdown and Razor files are split into their embedded languages first, and each block is tokenized as the language it contains. Identifiers, keywords and literals are classified, which is what lets the renamed-clone pass replace names while keeping keywords in place.

On that token stream jscpd runs the Rabin-Karp algorithm to find duplicated blocks across files. Opt-in passes extend it to blocks that differ only in names or values (Type-2) and to copies with a few edited lines or the same function structure (Type-3), each reported with its kind and a similarity score. See How detection works.

curl -fsSL https://jscpd.dev/install.sh | bash

irm https://jscpd.dev/install.ps1 | iex

npx jscpd .

Then scan a project:

jscpd /path/to/code

- uses: kucherenko/jscpd@v5
  with:
    threshold: 5

Uploads SARIF results to GitHub Code Scanning by default. See CI & Pre-Commit Hooks for all inputs and outputs.

jscpd v5 is a Rust engine that ships as a self-contained binary — no runtime required — under two npm names (jscpd installs the jscpd command, cpd installs cpd), on PyPI, crates.io, Homebrew, Nix, Docker, and as a GitHub Action.

• Language-aware tokenization — per-format comment and string syntax for all 224 formats, the oxc parser for JavaScript/TypeScript/JSX/TSX, embedded-language extraction for Vue, Svelte, Astro, Markdown and Razor, and keyword/identifier/literal classification, so a clone is a repeated sequence oflanguage tokens , never a repeated run of text (seeHow detection works )
• 224 language formats with cross-format detection (Vue SFC, Svelte, Astro, Markdown) and--cross-formats groups to match clones across JavaScript and TypeScript
• Prebuilt for 8 platforms — macOS arm64/x64, Linux arm64/x64 (glibc and musl), Windows arm64/x64
• Type-2 clones —--ignore-identifiers ,--ignore-literals and--ignore-annotations find blocks that differ only in names, literal values or annotations, reported asrenamed (seedocs )
• Type-3 near-miss clones —--max-gap-lines N merges a copy with a few inserted or changed lines into onesimilar clone with a similarity score;--similarity 0.85 compares whole JavaScript/TypeScript functions by syntax-tree structure, so renames and scattered edits are still caught (seedocs )
• Clone kinds in every reporter —exact ,renamed orsimilar in the console, JSON (kind ,similarity ,method ), XML, HTML, Xcode, SARIF (jscpd/duplicate-code ,jscpd/renamed-code ,jscpd/similar-code ) and Code Climate output; default runs report onlyexact clones and are unchanged
• 15 reporters :console ,console-full ,json ,xml ,csv ,html ,markdown ,badge ,sarif ,codeclimate ,openmetrics ,ai ,xcode ,threshold ,silent
• Clone baseline — gate CI onnew duplication only.--baseline .jscpd-baseline.json with--fail-on-new-clones[=N] tolerates legacy clones and fails the build on regressions;--baseline-from-ref origin/main does the same without a committed file (seedocs )
• Exit codes you can gate on — an unknown--format , a missing scan path and a reporter that cannot write its file exit 1 instead of passing with an empty report;--fail-on-empty fails a scan that analyzed no files (seeExit codes )
• GitLab-ready reporters —codeclimate (gl-code-quality-report.json ) andopenmetrics (jscpd-metrics.txt ) plug intoartifacts:reports
• Git blame with side-by-side author comparison (--blame --reporters console-full )
• --summary — codebase summary: top files and folders by tokens, lines, size, and a complexity estimate — refactoring hotspots straight from the scan (seedocs )
• --mcp — built-in MCP server over stdio with fully described tools: point your AI assistant at the binary and it can check snippets for duplication against your codebase, or find structurally similar functions with asimilarity argument (seedocs )
• AI reporter — token-efficient output for LLM pipelines (~79% fewer tokens than console)
• --skip-local — report only clones that cross the scan roots: with jscpd packages/api packages/web --skip-local , pairs inside one of the two trees are dropped and only api-to-web duplication remains
• --skip-isolated — ignore duplication between monorepo folders owned by different teams (--skip-isolated "packages/team-a|packages/team-b" )
• --workers — control parallelism for file tokenization and detection (default: all CPU cores)
• Config discovery —.jscpd.json ,.config/jscpd.json , or thejscpd key inpackage.json
• Quiet in pipelines — tips and sponsor lines print only on an interactive terminal;--no-tips ,CI orJSCPD_NO_TIPS switch them off everywhere

See the Rust docs for the full CLI reference and rust/CHANGELOG.md for release notes.

jscpd v4 (TypeScript engine, Node.js API, LevelDB/Redis stores) is maintained on the master-v4 branch and published as jscpd@4 / the latest-4 dist-tag. README-v4.md describes it in one page (install, CLI, API, packages, maintenance policy); the same content is at https://jscpd.dev/getting-started/v4.

The jscpd npm package is downloaded 10M+ times per month, and ~5,000 repositories declare it on GitHub's dependents graph.

Bundled by analysis platforms:

• GitHub Super Linter — official GitHub linter aggregator, bundles jscpd as its copy/paste detector and runs it by default; 15,500+ workflow files on GitHub reference Super Linter (as of Sep 2026)
• MegaLinter — open-source linter aggregator for CI, ships jscpd in every flavor includingci_light
• Codacy — automated code analysis platform, jscpd powers the duplication engine

Explicitly enabled in Super Linter (VALIDATE_JSCPD: true) by dozens of public repositories, including:

• A2A — Google's Agent2Agent protocol (25k+ stars)
• RimSort — mod manager for RimWorld (1.2k+ stars); also runs jscpd directly with its own.jscpd.json
• Contact Center AI samples — official Google Cloud samples, with a dedicated jscpd config
• Drifty — open-source download manager

Used in notable projects:

• OpenClaw — personal AI assistant, runs jscpd as a duplication gate in its check scripts
• DeepSeek Harness — DeepSeek's plugin harness, jscpd config in CI
• degit — Rich Harris's project scaffolder
• MEGA webclient — the MEGA.nz web client
• Microsoft TypeAgent
• Salesforce DX VS Code
• Alibaba AppWorks — embeds jscpd as a library
• OVHcloud manager — OVHcloud's customer control panel
• KiroCrew — self-improving persistent development workspace

Compared against other copy/paste detectors on the fixtures/ corpus (547 files, 150+ formats), default thresholds, wall-clock time on Apple Silicon:

Methodology, cross-format detection and AI-token-efficiency comparisons: benchmark/BENCHMARK.md. Re-run with benchmark/benchmark.sh.

jscpd integrates into AI-powered workflows through three mechanisms:

Token-efficient output for LLM pipelines (~79% fewer tokens than the default console reporter):

jscpd --reporters ai /path/to/source              # compact clone list
jscpd --reporters ai --summary /path/to/source    # + compact codebase summary

Two installable skills that teach AI coding assistants how to use jscpd and refactor detected duplications:

After installation, ask your agent to "find and fix code duplication" and it will invoke jscpd with the right options and act on the results.

jscpd --mcp /path/to/project scans once and serves the Model Context Protocol over stdio, so an assistant can check any snippet for duplication against the codebase on demand, list a file's clones, re-scan the working directory, and look for structurally similar functions by passing similarity.

See AI-Ready docs for full details.

See CONTRIBUTING.md for the development setup, test policy, and pull request requirements. In short:

cd rust
cargo nextest run --workspace
cargo clippy --workspace --all-targets -- -D warnings
cargo fmt --all --check

Security issues go through the security policy, not public issues.

Thank you to all our backers! 🙏 [Become a backer]

Support this project by becoming a sponsor. Your logo will show up here with a link to your website. [Become a sponsor]

MIT © Andrey Kucherenko