Breathing out
Find the copies and dead code an agent leaves behind.
Rule 12 has two halves. While a feature takes shape the code is allowed to sprawl. Then it has to breathe out: copies merged, dead ends deleted, unused packages dropped. Agents rarely clean up unasked, so these tools put the cleanup in the pull request checks.
Show tools for
58 tools
Copies
Ours
exhale
No pull request merges while it leaves duplication or complexity behind.
Start here
dupl
Finds duplicated Go code by comparing syntax trees, so renamed copies still match.
golangci-lint runs it, which makes it an easy gate for agent-written Go.
Start here
jscpd
Copy and paste detector covering over 220 languages, with a failure threshold and an MCP server.
One binary gives every stack the same duplication gate, and agents can check their own copies through MCP.
-
CloneDR
Commercial clone detector that parses code and finds exact and near-miss clones with parameterized matching.
Parse-based matching finds clones that token tools miss, which helps in large legacy codebases.
-
DeepSource
Hosted static analysis that flags complexity and unused code in pull requests.
Each pull request gets comments, so sprawl is flagged before merge.
-
Duplo
Small line-based duplicate finder for C, C++, C# and Java.
A light CI check for C-family code, where PMD is heavy.
-
flay
Analyzes Ruby code structure to find similar and identical code, scored by mass.
It catches near copies with renamed variables, which paste-and-tweak edits produce constantly.
-
phpcpd-next
A community fork that keeps the PHP copy and paste detector working on current PHP versions.
PHP teams whose phpcpd stopped installing can switch to it as a drop-in.
Version 2.0 needs PHP 8.4 or newer.
-
PMD CPD
Token-based copy and paste detector that ships with PMD and handles two dozen languages.
A minimum token count in Maven, Gradle or CI makes duplicate blocks fail the build.
-
pylint duplicate-code
The R0801 check in Pylint that reports similar line blocks across Python files.
It adds duplication checks to a Pylint run many Python teams already have in CI.
-
Qodana
JetBrains inspections run in CI, including duplicate and dead-code checks, with quality gates.
IDE inspections run in the pipeline, so agents face the same checks a developer sees.
Has a free Community tier.
-
similarity
Rust CLI that finds semantically similar functions and types using tree-sitter, aimed at AI-generated code.
It finds near duplicates after an agent writes the same helper twice under different names.
-
SonarQube
Code quality server that tracks duplicated lines and blocks, with quality gates on new code.
Its new-code gate fails a pull request when duplication passes a set percentage.
Community Edition is free. Paid tiers add branch analysis and more languages.
-
Teamscale
Commercial code analysis platform with clone detection and test gap analysis.
It tracks clones across commits, which shows when copies start piling up.
Dead code and unused dependencies
Start here
cargo-machete
Quickly finds unused Rust dependencies by scanning source for crate names, on stable Rust.
It runs in seconds, so it fits on every pull request.
Fast, but it can miss usages or flag crates used only through macros.
Start here
Dead Code Detector (ShipMonk)
PHPStan extension that finds unused PHP classes, methods, constants and properties.
It runs inside the PHPStan pass most PHP projects already have.
Start here
Gradle Dependency Analysis plugin
Gradle plugin that finds unused and misdeclared dependencies and can fail the build.
It keeps the dependency list honest in multi-module builds that agents edit.
Start here
knip
Finds unused files, exports and dependencies in JavaScript and TypeScript projects.
Files and packages that agents add and never use get flagged before they pile up.
Has an MCP server and plugins for most frameworks.
Start here
mix_unused
Mix compiler that reports public Elixir functions that nothing calls.
Unused public functions become compile warnings that a CI step can fail on.
Start here
Scalac -Wunused and Scalafix
Compiler warnings for unused imports and values, with Scalafix rules that remove them.
The compiler flag makes unused code a build failure with no extra tool.
Start here
vulture
Finds unused functions, classes, variables, imports and unreachable code in Python, with confidence scores.
The confidence score lets a CI gate fail only on findings the tool is sure about.
Dynamic code such as getattr and frameworks causes false positives. Use a whitelist.
-
cargo-shear
Detects and removes unused or misplaced Rust dependencies and unlinked source files.
It also finds source files no module includes, a common leftover after agent refactors.
-
cargo-udeps
Finds unused dependencies in Cargo.toml by compiling the project. Needs nightly Rust.
Fewer false positives than the fast tools make it a good scheduled deep check.
-
composer-unused
Lists Composer packages that your PHP code never uses.
Packages added during an experiment stop lingering in composer.json.
-
coverband
Records which Ruby code runs in production so you can see which code never does.
Runtime evidence settles what static tools can only guess, so deleting agent-written code gets safer.
Needs a Redis store and production traffic.
-
deadcode (Python)
Finds unused Python code and can remove it automatically with a --fix flag.
The --fix flag lets an agent delete what it finds in one pass.
Licensed under AGPL-3.0, which may matter to some teams.
-
debride
Static analysis that lists Ruby methods that nothing appears to call.
It gives a first list of removal candidates in a Rails app that agents have grown.
Rails dynamic calls cause false positives. Pair it with coverband.
-
dependency_validator
Dart tool that checks pubspec.yaml for unused and missing dependencies.
It keeps pubspec files clean after agents try out packages.
-
deptry
Checks Python projects for unused and missing dependencies, including transitive ones.
Packages an agent adds and forgets fail the build here when they are declared but never used.
-
i18n-tasks
Finds missing and unused translation keys in Rails and Ruby projects.
A spec that runs it keeps locale files in step with edited views.
-
include-what-you-use
Clang-based tool that finds unnecessary C and C++ includes and suggests the right ones.
Include sprawl slows builds, and agents add headers freely.
-
JetBrains Rider and ReSharper inspections
IDE inspections that mark unused types and members in C# code.
Teams already on Rider or ReSharper get unused-code checks they know.
-
Maven dependency:analyze
Maven goal that reports declared-but-unused and used-but-undeclared dependencies.
It ships with Maven and can fail the build through failOnWarning.
-
traceroute
Rake task that lists Rails routes with no matching controller action and the reverse.
Routes and actions get added separately, so one side often ends up orphaned.
-
ts-prune
Lists unused exports in TypeScript projects.
It lingers in many CI configs, and knip has replaced it.
Superseded by knip.
-
ts-unused-exports
Finds exported TypeScript symbols that no other module imports.
A smaller option for teams that want only an unused-export check.
-
unimport
Detects and removes unused Python imports.
It clears the import litter left after refactors, though Ruff's F401 rule does the same job for most teams.
Complexity limits
Start here
DCM (DCM for Dart)
Dart and Flutter analyzer with metrics, unused code and unused files checks.
Metrics and unused-code limits for Dart and Flutter come from one analyzer.
Start here
Lizard
Measures cyclomatic complexity and function size in over 25 languages, with threshold exit codes.
One tool and one set of limits cover every language in a polyglot repo.
Start here
NDepend
Commercial .NET analyzer with code metrics and a query language for dependency rules that can fail builds.
A team can write its complexity and layering gates for C# in one place.
-
Clippy cognitive_complexity
Clippy lint that warns when a Rust function's cognitive complexity passes a set threshold.
It rides along with the cargo clippy step teams already run.
The lint sits in the nursery group, so it must be enabled by name.
-
Codacy
Hosted code quality platform with pull request gates for complexity, duplication, coverage and security.
Many languages get one merge gate without anyone running a server.
-
CodeScene
Behavioral code analysis that scores code health and finds hotspots from git history, with PR quality gates.
It points at files where heavy change and high complexity overlap, and offers guidance for AI-written code.
Free for open source projects.
-
complexipy
Rust-based cognitive complexity checker for Python with a configurable failure threshold.
Cognitive complexity tracks how hard code is to read, which suits checking agent output.
-
ESLint complexity rules
Built-in ESLint rules that cap cyclomatic complexity, nesting depth, function length and parameter count.
They run on every save with no extra install, so agents hit the limits while they write.
-
eslint-plugin-sonarjs
ESLint plugin that adds cognitive-complexity and identical-function rules.
The identical-function rule catches same-file copies, which agents like to make.
-
flog
Scores Ruby methods by how painful they are to test and read, using an ABC-style metric.
A flog score per method makes bloated agent-written methods easy to spot.
-
gocognit
Computes cognitive complexity of Go functions and can fail above a limit.
Cognitive complexity penalizes nesting, which is where agent-written Go tends to sprawl.
-
gocyclo
Computes cyclomatic complexity of Go functions and can fail above a limit.
A tiny, quick gate that is also available inside golangci-lint.
-
PHPMD
PHP Mess Detector with rules for complexity, long methods, unused code and too many parameters.
One ruleset covers complexity and unused private code in PHP.
-
PhpMetrics
Reports complexity and maintainability metrics for PHP projects, including coupling, as HTML reports.
Maintainability and coupling numbers make useful trend lines for PHP code that agents are growing.
-
Qlty
CLI that wraps over 70 linters and reports duplication, complexity and maintainability grades.
Its git-aware mode reports only new issues, which suits a gate on agent pull requests.
Successor to Code Climate Quality, whose API was disabled on 2025-07-18.
-
radon
Computes cyclomatic complexity and Halstead metrics for Python, plus a maintainability index.
The maintainability grade gives one number to track as agents add code.
Release cadence is slow.
-
RuboCop Metrics cops
RuboCop cops that limit method length, class length, ABC size and cyclomatic and perceived complexity.
Most Ruby teams already run RuboCop in CI, so limits take one config change.
-
rust-code-analysis
Mozilla's library and CLI for computing code metrics such as cyclomatic and cognitive complexity across several languages.
A scriptable metrics engine for teams that build their own gates.
-
scc
Very fast code counter that also estimates complexity per file for over 300 languages.
It gives a quick size and complexity snapshot of a repo that agents are growing.
Gives estimates only and has no failure threshold.
-
wily
Tracks Python complexity metrics across git history and graphs the trend.
The trend shows whether a month of agent work left the code heavier.
-
xenon
Fails a Python build when radon complexity exceeds set grades per function, module or whole project.
It adds the failing threshold to radon, which suits a merge check.
Release cadence is slow.
Nothing in this section is built for the stacks you picked, and nothing here works with any language. Pick another stack, or .
Gone quiet 6
These tools are archived or shut down, or nobody has released or committed to them in two years. Some still work fine. Read the note before you adopt one.
-
depcheck
Reports npm dependencies that no file imports and imports missing from package.json.
It was the usual unused-dependency check, so existing pipelines may still call it.
Archived in 2025. Use knip.
-
Periphery
Finds unused Swift declarations by analyzing the compiler's index store.
Unused declarations pile up fast in agent-written Swift, and this was the tool Swift teams reached for.
The open source repo was archived on 2026-08-12 and the tool is now a commercial product.
-
phpcpd
The original PHP copy and paste detector from the PHPUnit author.
Many PHP projects still run it, so it helps to know it is archived and where to move.
Archived. phpcpd-next continues it and PMD CPD also supports PHP.
-
sbt-explicit-dependencies
sbt plugin that checks for undeclared and unused library dependencies.
It catches dependency drift in sbt builds.
Dormant since 2024.
-
Simian
Long-standing similarity analyser that works on most text-based languages.
It still appears in older build setups.
Dormant. Quandary Peak released it as open source under Apache 2.0.
-
unimported
Finds files and dependencies that nothing imports from your entry points.
Teams moving off it should go to knip.
Archived. Use knip.
Missing a tool that belongs here? Suggest it.
Every tool here was checked against its GitHub repository or its own site on 6 October 2026. Stars and dates come from GitHub on that day.