PMD

PMD is a free, extensible static code analyzer that checks source code for programming flaws, including unused variables, empty catch blocks, and unnecessary object creation. It includes more than 400 built-in rules, and teams can write custom rules in Java or XPath. Its bundled CPD tool detects copied code across many programming languages. PMD can check source directories from the command line or run as a Maven, Ant, Gradle, or bld build operation. It supports Java, JavaScript, Salesforce Apex and Visualforce, Kotlin, Swift, Modelica, PL/SQL, Apache Velocity, JSP, WSDL, Maven POM, HTML, XML, and XSL; Scala is supported without Scala rules. PMD requires Java 8 or later and runs on Linux/Unix and Windows, with execution instructions also provided for macOS. Its GitHub Action can create SARIF reports and fail builds based on violation counts. Documentation covers CI integrations including GitLab, Jenkins, and Bamboo, as well as IDE integrations such as Eclipse, IntelliJ IDEA, and Visual Studio Code. Only the latest major version remains in active development.

PMD offers broad language coverage, customizable checks, and build and CI options at no cost. Check Scala rule availability and the support status of any IDE integration you plan to use.

PMD may suit developers and teams seeking a free code analyzer with customizable rules, command-line use, or build and CI integration. It can also help teams looking for duplicate-code detection through CPD.

Overview

PMD is a static code analyzer for developers and teams who want configurable checks across a wide range of languages without a software fee. It is a strong fit when a project can manage its own ruleset and wants duplicate-code detection alongside flaw checks; the Java 8-or-above requirement is a practical barrier for teams that cannot provide that runtime.

Key features

More than 400 built-in rules flag issues such as unused variables, empty catch blocks and unnecessary object creation. Teams can add rules in Java or XPath, which lets them align checks with local conventions. That flexibility is valuable for codebases with specific standards, but it also makes PMD less suitable for teams seeking a fixed, hands-off ruleset.

PMD supports Java, JavaScript, Salesforce Apex and Visualforce, Kotlin, Swift, Modelica, PL/SQL, Apache Velocity, JSP, WSDL, Maven POM, HTML, XML and XSL. Scala is supported without Scala rules, so Scala teams should not expect the same rule coverage as users of the other supported languages. The bundled CPD tool detects duplicated code across many programming languages, giving teams a second kind of analysis in the same distribution.

Use PMD from the command line or as a Maven, Ant, Gradle or bld build operation. Its GitHub Action accepts a custom ruleset, generates SARIF reports and can fail builds according to violation counts. PMD also documents integrations for GitLab, Jenkins and Atlassian Bamboo; its GitLab component converts PMD reports to GitLab's Code Quality format. These options suit teams that want checks in automated workflows, while the command-line and build-tool paths also work for local analysis.

Installation requires Java 8 or above and uses a ZIP archive containing PMD and CPD. The project lists integrations for Eclipse, IntelliJ IDEA and Visual Studio Code, among other IDEs, but some plugins—including its listed Apache NetBeans and Emacs integrations—are not actively maintained. Check the maintenance status of the specific integration before making it part of a team's workflow. Only the latest major version is actively developed and regularly receives features and fixes; older major versions become unsupported.

Pricing

PMD is free: the PMD plan costs nothing and includes the downloadable static code analyzer under a BSD-style license. There is no paid tier or trial to weigh against the free plan. The price does not remove the operational requirements: users still need Java 8 or above, and teams relying on custom rules must be prepared to maintain them.

Platforms

PMD is available for Linux, macOS, Windows and self-hosted use. Its documentation gives execution instructions for Linux/Unix and Windows, using pmd or pmd.bat. A GitHub Action and documented CI integrations provide routes into automated checks, with SARIF output and build-failure thresholds supported by the GitHub Action.

Who it's for

PMD suits developers and teams working across its rule-supported languages who want a free analyzer that can be customized and added to build or CI workflows. It is especially useful when duplicate-code detection is also needed. It is a weaker fit for Scala projects needing Scala-specific rules, teams unable to meet the Java runtime requirement, or users depending on an IDE plugin that is no longer actively maintained.

Pros and cons

Pros

• Broad, extensible rule coverage: More than 400 built-in rules and Java- or XPath-based custom rules let teams adapt checks to their coding standards.
• Analysis plus clone detection: CPD is distributed with PMD and finds duplicated code across many programming languages.
• Flexible automation: Command-line and build-tool execution, a GitHub Action with SARIF output and violation thresholds, and documented CI integrations support different workflows.
• No software fee: The downloadable analyzer is free under a BSD-style license.

Cons

• Runtime prerequisite: PMD requires Java 8 or above, which may complicate adoption where that runtime is unavailable.
• Uneven Scala support: Scala has no Scala-specific rules, limiting the value of its language support for Scala-focused analysis.
• Integration upkeep varies: Some IDE plugins are not actively maintained, and older major versions are unsupported.

Alternatives

For a JavaScript-focused linting utility, consider ESLint. If Python is the target, Flake8 is a free command-line option. Kotlin teams may prefer detekt, a free Kotlin static analysis tool. Cppcheck is another free-to-download static analysis choice, with a freemium model and a free trial.

For web projects, Biome offers a free, open-source toolchain. Python teams looking at a free and open-source project built by volunteers can consider golangci-lint. Astral provides free, permissively licensed open-source tools including Ruff, uv and ty. Haskell developers can consider HLint, a free source-analysis and suggestion tool installable with Cabal or as a binary release. Browse more options in Linters, Code Clone Detection Tools or Static Analysis Tools.

Verdict

Choose PMD if you want a free, configurable analyzer with broad language coverage, custom rules and bundled duplicate-code detection that can run in builds and CI. Look elsewhere if Scala-specific rules, a Java-free setup or assured maintenance for a particular IDE plugin is essential.