# Install jscpd with Homebrew, apk

Copy/paste detector for programming source code. Version 5.0.14 via Homebrew; verified 2026-07-27. Also installable with apk: sudo apk add cpd.

## Install

```sh
sudo av install brew:jscpd
```

Additional install commands:

### macOS

- Homebrew (100%):

```sh
brew install jscpd
```

  Evidence: local Homebrew formula metadata

### Linux

- apk (92%):

```sh
sudo apk add cpd
```

  Evidence: Alpine Linux edge package indexes: cpd from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz

## Package facts

- **Package key:** brew:jscpd
- **Package manager:** Homebrew
- **Version:** 5.0.14
- **Source summary:** Copy/paste detector for programming source code
- **Homepage:** <https://jscpd.dev/>
- **Repository:** <https://github.com/kucherenko/jscpd>
- **Last updated:** 2026-07-27T12:42:02Z
- **Generated:** 2026-08-03T19:37:03+00:00

## Executables

- cpd (alias)
- jscpd (alias)

## Install behavior

- Bottle: not available

## Freshness

- Page generated: 2026-08-03
- Package-manager version: 5.0.14
## Project history and usage

jscpd is a copy/paste detector for source code. It scans files for duplicated token sequences, reports clones in multiple formats, and is used as a code-quality gate in local development and CI.

### Project history

The GitHub repository was created in May 2013, and the npm package history begins in June 2013. The name originally stood for JavaScript Copy/Paste Detector, but the project expanded well beyond JavaScript into a broad multi-language duplicate-code scanner.

The README describes the detection engine as Rabin-Karp based. By 2026 the project documentation described support for more than 220 formats, multiple reporters, GitHub Action integration, an MCP server, AI-oriented reporter output, and a Rust-powered v5 engine.

### Adoption history

jscpd gained adoption as a lightweight alternative to heavier static-analysis suites for teams that wanted to fail builds or generate reports when duplication crossed a threshold. The npm package had a long 0.x to 4.x TypeScript/Node.js history before the 5.x Rust-native release line appeared in June 2026.

Homebrew packages jscpd as a CLI, npm distributes it for JavaScript toolchains, and the project site promotes curl, npm, cargo, brew, and nix installation paths. That multi-channel distribution matches its role as a language-agnostic source-code utility.

### How it is used

Developers run jscpd against a repository or source directory, tune thresholds and ignore patterns through configuration such as .jscpd.json, and consume terminal, JSON, HTML, badge, CI, or AI-oriented reports.

### Why package nerds care

jscpd is notable because duplicate-code detection sits between linting, static analysis, and build policy. The 2026 Rust rewrite also makes it a packaging case study: a Node-era CLI kept its ecosystem-facing package names while shifting core performance-sensitive work into a native binary.

### Timeline

- 2013: GitHub repository and npm package history began.
- 2018: jscpd 1.0.0 was published after years of 0.x releases.
- 2020: jscpd 3.x releases continued the Node.js/TypeScript era.
- 2024: jscpd 4.0.0 was published on npm.
- 2026: jscpd 4.2.x and 5.0.x releases appeared, with project docs presenting v5 as a Rust-powered rewrite.

### Related projects

- Related projects include PMD CPD, Simian, SonarQube duplication detection, MegaLinter's jscpd integration, and jscpd's own GitHub Action and MCP server packages.

### Sources

- <https://formulae.brew.sh/formula/jscpd>
- <https://github.com/kucherenko/jscpd>
- <https://github.com/kucherenko/jscpd/releases>
- <https://jscpd.dev/>
- <https://registry.npmjs.org/jscpd>
- <https://www.npmjs.com/package/jscpd>


## Security Notes

No matching local secret-handling manifest was found for jscpd. Nucleus package metadata is still published here so future coverage has a stable package URL.



## Configuration and credential file locations

These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.


## Configuration files

- Unix: .jscpd.json
## Other Package-Manager Records

- apk - cpd - 0.5.5-r1: installed executable or alias match | Alpine Linux edge package indexes: cpd from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | C++ implementation of the Coherent Point Drift point set registration algorithm. | https://github.com/gadomski/cpd
- apk - cpd-dev - 0.5.5-r1: installed executable or alias match | Alpine Linux edge package indexes: cpd-dev from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | C++ implementation of the Coherent Point Drift point set registration algorithm. (development files) | https://github.com/gadomski/cpd


## Combined YAML source

View the package source record on GitHub. [combined/jscpd.yml](https://github.com/mxcl/pkgdb/blob/main/combined/jscpd.yml)


## Sources

- pkg.so package database
- Geiger risk classifier
- curated configuration and credential file locations
- curated package history
- pkgdb category and tag curation
- external package-manager database matches
- cross-ecosystem install command graph