PMD is an open-source SAST tool that scans source code for common programming flaws, including potential bugs, dead code, and security vulnerabilities. With over 5,300 GitHub stars and 312 contributors, it’s one of the most mature code analysis projects in the Java ecosystem.
Originally built for Java, PMD now supports 16 languages for rule-based analysis and ships with CPD (Copy/Paste Detector) for finding duplicated code across 33+ languages.
What is PMD?
PMD analyzes source code without executing it, applying configurable rules to identify problematic patterns. According to NIST’s Software Assurance guidelines, static analysis tools that detect coding standard violations contribute to reducing security vulnerabilities in production code. PMD earned its reputation in the Java community for catching issues that compilers miss but that lead to bugs, maintainability problems, or security vulnerabilities in production.
The name PMD does not officially stand for anything, though the community has proposed various backronyms including “Programming Mistake Detector.” The latest version is 7.21.0, released January 30, 2026.
PMD is used by Salesforce Code Analyzer as a core analysis engine for Apex development, making it the de facto standard for Salesforce security and code quality analysis. Salesforce also ships a custom variant called pmd-appexchange for AppExchange security review.
Language support
PMD supports 16 languages for rule-based analysis, with the bulk of rules targeting Java:
| Language | Rule Count | Notes |
|---|---|---|
| Java | ~294 | Across 8 categories (best practices, code style, design, documentation, error prone, multithreading, performance, security) |
| Salesforce Apex | 69 | 7 categories |
| PL/SQL | 22 | 5 categories |
| JavaScript | 18 | 4 categories (ECMAScript) |
| Swift | 4 | 2 categories |
| Kotlin | 2 | 2 categories |
| XML | 2 | 2 categories |
| Scala | 0 | Language supported but no built-in rules yet |
Additional languages with rules: Visualforce, HTML, JSP, XSL, Modelica, Maven POM, Velocity Template Language (VTL), and WSDL.
CPD supports 33+ languages for duplicate detection, including C/C++, C#, Go, Python, Ruby, Rust, PHP, Dart, Fortran, Lua, and more.
Key features
Incremental analysis
For large codebases, PMD supports incremental analysis that caches results from previous runs (available since v5.6.0). On subsequent runs, it uses file checksums to detect changes and only re-processes modified files. Activate it with the --cache CLI argument.
Output formats
PMD supports 15 output formats including SARIF (since v6.31.0), JSON, HTML, XML, CSV, and CodeClimate. SARIF output integrates with GitHub Code Scanning and other SARIF-compatible dashboards.
Getting started
pmd-dist-7.21.0-bin.zip) or install via Homebrew (brew install pmd).pmd check -d /path/to/source -R rulesets/java/quickstart.xml to analyze your codebase with the quickstart ruleset.maven-pmd-plugin), Gradle (built-in pmd plugin), and Ant. Run mvn pmd:check or ./gradlew pmdMain as part of your build.When to use PMD
PMD fits Java projects that want comprehensive code quality and security analysis without licensing costs. For Salesforce teams, it’s effectively mandatory through the Code Analyzer.
For deeper security analysis, consider pairing PMD with Semgrep, CodeQL, or a commercial SAST tool. PMD excels at code quality and style enforcement; dedicated security scanners go deeper on vulnerability detection.
