PMD

Visit Website

Introduction

PMD is an extensible multi-language static code analyser. It is best known for Java and Salesforce Apex, and also supports languages such as Kotlin, Swift, JavaScript, PL/SQL, Visualforce, XML and others.

Rules find common flaws such as unused variables, empty catch blocks, unnecessary object creation and overly complex methods. Custom rules can be written in Java or as XPath queries over the syntax tree. PMD includes CPD, a copy-paste detector that finds duplicated code across many more languages. Maven, Gradle and Ant plugins and IDE integrations run it in builds.

In the quality loop PMD is a JVM and Apex static gate, often alongside SpotBugs and Checkstyle.

The source code is at pmd/pmd on GitHub under the BSD-style licence, with about 5,500 stars; the most recent commit was on 11 November 2026.

Features

1. Multi-language: Java, Apex, Kotlin, JavaScript, PL/SQL and more.
2. Rule sets: Best practices, design, error-prone, performance.
3. XPath rules: Write custom rules without Java.
4. CPD: Duplicate code detection.
5. Build plugins: Maven, Gradle and Ant.
6. Report formats: XML, HTML, SARIF and others.

Pros

1. Apex support: One of few strong open tools for Salesforce code.
2. Free to use: Open source under the BSD-style licence, so the core tool costs nothing to use.
3. Actively maintained: The repository had commits as recent as 11 November 2026.
4. Community: About 5,500 GitHub stars.

Cons

1. Rule tuning: Default sets can be noisy.
2. Source-level only: Bytecode issues need SpotBugs.
3. Major version migration: PMD 7 changed rule APIs.

Usage and Links (Example)

pmd check -d src/main/java -R rulesets/java/quickstart.xml -f text
pmd cpd --minimum-tokens 100 -d src

Resources:

• PMD website
• GitHub repository

Pricing

PMD is free and open source under the BSD-style licence.

Recommended for?

1. Java and Salesforce Apex teams.
2. Projects tracking duplicated code.

Conclusion

PMD is a long-standing, flexible analyser with notable Apex support and a useful duplicate detector.

Start with the quickstart rule set and expand deliberately.

On CheckOps, PMD is filed under the Release & CI gates stage. Related tools listed here include SpotBugs, Checkstyle, Error Prone, Find Security Bugs, SonarQube and Infer. A short trial on a real project, with your own code, data and pipeline, is usually the fastest way to choose between them, because fit matters more than feature lists. Facts here come from the official site, documentation and repository, checked on 11 November 2026.