jscpd 🔌 MCP server Open source

What it does

jscpd is a mature, Rust-based duplicate-code detector that tokenizes source files across 224+ languages/formats and uses a Rabin-Karp rolling hash to find copy-pasted (Type-2/Type-3) code blocks. It also flags dead code, ranks files by complexity, tracks duplication trends through git history, and rolls results into a composite codebase health score.

Tools it gives your agent

• An MCP server (stdio) so an AI assistant can check a snippet against the rest of the codebase before adding it
• An installable agent skill aimed at DRY refactoring and codebase-health passes
• A compact "AI reporter" output claimed to use ~79% fewer tokens than console output, for LLM pipelines
• 15 report formats (console, JSON, HTML, SARIF, markdown, badge, xcode, etc.) and a GitHub Action with SARIF upload to Code Scanning

Works with

Bundled by default in GitHub Super Linter and MegaLinter; powers Codacy's duplication engine; works in pre-commit hooks and general CI pipelines. Used as a dependency by roughly 5,000 repositories, including ones from Google, Microsoft, and Salesforce.

How to install or connect

curl -fsSL https://jscpd.dev/install.sh | bash
npx jscpd .
npm install -g jscpd

Also distributable via PyPI, Cargo, Homebrew, Docker, and Nix.

Maintenance and safety

Very actively maintained (2,000+ commits, 6.2k stars, 265 forks, 10M+ monthly npm downloads), with a published SECURITY.md and an OpenSSF Best Practices badge. MIT licensed.

Who should use it

Teams that want an established, widely-adopted duplication/complexity scanner in CI, who also want their coding agent to query it (via MCP or the agent skill) before introducing more copy-pasted code. It's best evaluated as a code-quality tool with AI hooks rather than an agent-native product.