jscpd

What It Does

jscpd (JavaScript Copy/Paste Detector) is a copy/paste detection tool for programming source code. It uses the Rabin-Karp algorithm to find duplicated code blocks across 223 programming language formats. Version 4.2.x added three agent-facing features: an AI reporter that produces compact, token-efficient output; two agent skills (one for running jscpd, one for refactoring detected clones); and a standalone MCP server (jscpd-server) that exposes duplication detection as tools callable from AI assistants. The tool targets developers who want to measure and reduce code duplication, and the new agent features target AI coding assistants that need to detect and fix clones autonomously.

The Good

The AI reporter is optimized for agent consumption. Running jscpd --reporters ai packages/ on the jscpd monorepo itself produced 2,671 characters of output. The default console reporter produced 7,971 characters on the same input. That is a 66% reduction in raw characters, and the structured format (file paths, line ranges, summary line) is easy for agents to parse without any post-processing. The reporter source code in packages/finder/src/reporters/ai.ts implements common-path-prefix compression: clones in the same file show the path once, clones in the same directory share the common prefix. This is not just truncation. It is deliberate, thoughtful formatting for a non-human reader.

The MCP server is well-architected with proper session management. The server uses the @modelcontextprotocol/sdk with streamable HTTP transport. It registers three tools (check_duplication, get_statistics, check_current_directory) and one resource (jscpd://statistics). The check_duplication tool accepts a code snippet, format, and optional recheck flag, returning structured JSON with duplication locations and statistics. The server implements request isolation: snippet tokens go to an ephemeral in-memory store that is discarded after each request, preventing cross-request contamination and unbounded memory growth. The test suite in apps/jscpd-server/__tests__/mcp-server.test.ts covers initialization, tool calls, session enforcement, and error handling across 8 test cases.

The dry-refactoring skill provides a complete detection-to-remediation workflow. While the jscpd skill teaches an agent how to run the tool and read its output, the dry-refactoring skill picks up where detection leaves off. It defines four refactoring strategies (extract function, extract module, extract constant, base class), an 8-step workflow from detection through verification, and practical tips like starting with the highest line-count clones first. The two skills cross-reference each other, forming a pipeline: detect, then fix.

A 13-year-old tool with a mature test foundation. The monorepo contains 36 test files with 488 individual test cases across core, tokenizer, finder, CLI, and server packages. The tokenizer tests cover Svelte, Vue, Astro, and Markdown individually, confirming the cross-format detection claims. The CI runs on GitHub Actions with Codecov integration. This is not a weekend project. It is production infrastructure that has been maintained since 2013 and now ships agent-native features.

Skill installation via npx skills add works out of the box. Running npx skills add kucherenko/jscpd --skill jscpd correctly installed the skill to .agents/skills/jscpd/ with symlinks for Claude Code, OpenClaw, and Hermes Agent. The npx skills add tool also detected 56 agent platforms and installed to Claude Code, OpenClaw, GitHub Copilot, and Hermes Agent by default. The experience is clean: one command, no manual file copying.

The Bad

The SKILL.md frontmatter has a description count mismatch. The jscpd skill frontmatter says "supports 150+ languages" but the README says "supports 223 formats" and FORMATS.md documents 223 formats. The frontmatter description should say "220+ languages" to match the actual capability. This is a minor detail but agents that read the skill will get the wrong number.

The monorepo requires pnpm and turbo to build from source. The root package.json declares "packageManager": "pnpm@10.28.0" and uses Turborepo for build orchestration. Developers who clone the repo and run npm install will get either peer dependency conflicts or broken workspace links. This is standard for pnpm monorepos but worth noting: contributors and reviewers cannot build or test the MCP server from source without installing pnpm first. The published npm packages work fine with plain npx, so this only affects source-level users.

The MCP server has no authentication or rate limiting. The README explicitly states "Currently, no authentication is required" and "no rate limiting is implemented." The server binds to 0.0.0.0:3000 by default. In a local development context this is acceptable. In a shared or CI environment, anyone with network access can check snippets and read project statistics. The README does recommend authentication for production but does not provide guidance on how to add it.

The dry-refactoring skill is doc-only with no executable validation. The refactoring workflow is a well-written guide but there is no script or test to verify that the workflow produces correct results. An agent following the workflow could skip steps, apply incomplete refactoring, or fail to re-run jscpd to confirm elimination. A validation step (even a simple check that the clone count decreased after refactoring) would strengthen the skill.

Smoke Test Results

All tests run on macOS (aarch64) using published npm packages.

Run A. Fresh npx, no global install

$ npx --cache /tmp/jscpd-cache jscpd@latest --version
4.2.4 ✅

$ npx --cache /tmp/jscpd-cache jscpd@latest --help
Usage: jscpd [options] <path ...>
detector of copy/paste in files ✅

$ npx --cache /tmp/jscpd-cache jscpd@latest --reporters ai --format "typescript" packages/
Clones:
packages/tokenizer/src/languages/ svelte.ts:186-192 ~ vue.ts:76-82
packages/tokenizer/src/languages/ svelte.ts:221-232 ~ vue.ts:107-118
... (44 more lines)
49 clones · 3.5% duplication
time: 1.030s ✅

$ npx --cache /tmp/jscpd-cache jscpd-server@latest --help
Usage: jscpd-server [options] <path>
Start jscpd as a server ✅

Pass rate: 4 of 4. All CLI commands and the server help work from a clean environment using only npx.

Run B. Skill installation

$ cd /tmp && mkdir jscpd-skill-test && cd jscpd-skill-test
$ npx --cache /tmp/jscpd-cache skills add /tmp/jscpd-review --skill jscpd -y
Selected 1 skill: jscpd
Installing to: Claude Code, OpenClaw, GitHub Copilot, Hermes Agent
Installation complete ✅

$ cat .agents/skills/jscpd/SKILL.md | head -5
name: jscpd
description: Copy-paste detector for 220+ languages...
--- ✅

Pass rate: 2 of 2. Skill installs correctly and the SKILL.md content is intact.

Run C. AI reporter token comparison

$ jscpd --format "typescript" packages/ | wc -c
7971 chars (default reporter)

$ jscpd --reporters ai --format "typescript" packages/ | wc -c
2671 chars (AI reporter)

Reduction: 66% ✅

Pass rate: 1 of 1. Token savings claim verified.

What the runs tell you

jscpd installs and runs correctly via npx without any global setup. The AI reporter produces compact output that is substantially smaller than the default. Skill installation via the Agent Skills Open Standard works without errors. The MCP server binary installs but the server daemon was not started during testing (port binding in the test environment). Source code inspection and the existing test suite (8 MCP-specific tests, 488 total) provide strong evidence the MCP transport works correctly.

Setup Walkthrough

1. Run duplication detection on any codebase: npx jscpd@latest --reporters ai /path/to/code
2. Install the agent skill: npx skills add kucherenko/jscpd --skill jscpd
3. Install the refactoring skill: npx skills add kucherenko/jscpd --skill dry-refactoring
4. For MCP server access: npm install -g jscpd-server then jscpd-server /path/to/project
5. Add to MCP client config:

 {
 "mcpServers": {
 "jscpd": {
 "type": "streamable-http",
 "url": "http://localhost:3000/mcp"
 }
 }
 }

The npx approach requires no global install. The MCP server is optional. Most agent workflows only need the skill installation plus npx jscpd --reporters ai to get started.

Alternatives

1. SonarQube - enterprise code quality platform with built-in duplication detection. Use it if you need a full quality suite rather than a focused copy/paste detector.
2. PMD CPD (Copy/Paste Detector) - Java-focused duplication detector. Use it if your stack is JVM-centric and you want detection without Node.js.
3. CodeClimate - hosted code quality service with duplication analysis. Use it if you prefer a managed service over a CLI tool.