# Reported issues for io.github.PierreJanineh/tech-debt-mcp

Pod holds 19 of 21 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to [io.github.PierreJanineh/tech-debt-mcp](/mcp/io-github-pierrejanineh-tech-debt-mcp).

## Most discussed

### Dogfood follow-ups: TECH_DEBT_SCAN drift + .techdebtrc.json ignore gaps + prefer-nullish-coalescing noise

Filed from the TEC-37 dogfood cycle (PR #235). Running `AnalysisEngine.analyzeProject()` against this repo surfaced three findings worth fixing before the next release. Bundled here because they share a single end-state (a refreshed `TECH_DEBT_SCAN.md`).

## 1. `TECH_DEBT_SCAN.md` is significantly stale

- File claims: **13 issues / Health 95 / Debt 5 / Remediation 14h**
- Current programmatic scan: **165 issues / Health 54.2 / Debt 45.8** (3d 12h 55m remediation; SQALE rating still **A** becaus

[Read the thread](https://github.com/PierreJanineh/TechDebtMCP/issues/236) · 2026-05-23 · open · outside contributor · 0 comments

### Java analyzer matches patterns inside Javadoc {@code} / <pre> blocks (system-out, likely others)

## Repro

Showcase scan of google/gson @ \`abfef5e8455483b878a8dea14dd42fa55832a56c\` surfaced \`system-out\` findings inside Javadoc \`<pre>{@code ... }</pre>\` documentation blocks — not production code.

**Example — \`gson/src/main/java/com/google/gson/GsonBuilder.java:300\`:**

\`\`\`java
   *
   * Map<Point, String> original = new LinkedHashMap<>();
   * original.put(new Point(5, 6), "a");
   * original.put(new Point(8, 8), "b");
   * System.out.println(gson.toJson(original, type));   // <-

[Read the thread](https://github.com/PierreJanineh/TechDebtMCP/issues/228) · 2026-05-23 · open · outside contributor · 0 comments

### eval-usage regex over-matches: flags Ruby instance_eval/class_eval/module_eval as critical security

## Repro

Scanned Sinatra at SHA `HEAD` of develop branch. All 22 critical findings were `eval-usage`, every one matching Ruby's metaprogramming methods — not the standalone `eval()` builtin.

Example matches:
- `test/contest.rb:37` — `instance_eval(&block)` — Ruby DSL pattern, completely safe
- `test/contest.rb:44` — `instance_eval(&block)` — same
- `test/helpers_test.rb:16` — likely `class_eval`

## Why it's wrong

`instance_eval`, `class_eval`, `module_eval`, and `Module#define_method` are co

[Read the thread](https://github.com/PierreJanineh/TechDebtMCP/issues/225) · 2026-05-23 · closed · outside contributor · 1 comment

### bug: include glob in .techdebtrc.json is silently ignored by analyze_project

## Summary

The `include` glob array in `.techdebtrc.json` is **silently ignored** by `analyze_project`. Files matching extensions outside the `include` patterns are still discovered and analyzed.

## Severity

**High** — same shape as TEC-49 (`customPatterns`) and the severity-override bug: documented, user-facing config field is wholly non-functional. Stop-ship for TEC-39 / TEC-45.

## Reproduction

Surfaced during TEC-48 end-to-end QA against `tech-debt-mcp@2.0.2`.

1. Create `/tmp/test/.tech

[Read the thread](https://github.com/PierreJanineh/TechDebtMCP/issues/212) · 2026-05-23 · closed · outside contributor · 0 comments

### test: published-artifact integration test (npm pack + stdio client)

## Summary

Add a CI job that runs `npm pack`, installs the resulting tarball into a temp dir, spawns the server over stdio via `@modelcontextprotocol/sdk` client, and exercises real `tools/call` and `resources/read` requests against the **installed** artifact. Catches packaging issues, dist gaps, broken `bin` entries, and resource registration drift that don't show up in `npm test`.

## Why

`npm test` runs against TypeScript source via `ts-jest`. Users get `dist/`. Nothing today asserts that t

[Read the thread](https://github.com/PierreJanineh/TechDebtMCP/issues/209) · 2026-05-23 · open · outside contributor · 0 comments

### bug: customPatterns from .techdebtrc.json are silently ignored by analyze_file/analyze_project

## Summary

`customPatterns` defined in `.techdebtrc.json` are **silently ignored** by `analyze_file` and `analyze_project`. The config passes `validate_config` cleanly, the analysis runs without error, and no violations are reported. Users who configure custom patterns get zero detection and no feedback that their configuration is a no-op.

## Severity

**High** — a documented, user-facing config field is wholly non-functional in the primary analysis code paths. This is a stop-ship for the Anth

[Read the thread](https://github.com/PierreJanineh/TechDebtMCP/issues/204) · 2026-05-23 · closed · outside contributor · 0 comments

### chore: end-to-end finishing check for Claude Code plugin + MCPB bundle

## Summary

TEC-35 (#175) landed the `.claude-plugin/` manifest. TEC-42 (#182) landed the MCPB manifest + `npm run mcpb:pack` tooling. Both ship the scaffolding but **neither has been verified end-to-end on a clean machine** before submission to the official directories (TEC-39 — `claude-plugins-official`; TEC-45 — Anthropic MCP directory).

This issue tracks the pre-submission QA pass.

> **Update 2026-05-23:** Re-read TEC-39 and TEC-45 against this checklist. Neither submission ticket actually

[Read the thread](https://github.com/PierreJanineh/TechDebtMCP/issues/191) · 2026-05-22 · closed · outside contributor · 5 comments

### security: resolve 11 open Dependabot alerts (2 high, 8 moderate, 1 low)

## Summary

11 open Dependabot alerts on `develop` as of 2026-05-22. All appear to be transitive — mostly via `@modelcontextprotocol/sdk`'s HTTP transport (which TechDebtMCP doesn't use; the server runs over stdio).

The v2.0.2 CHANGELOG already documents this category: *"Remaining Dependabot alerts (handlebars via `ts-jest`, hono/express/path-to-regexp via `@modelcontextprotocol/sdk` HTTP transport) are dev-only or unreachable code paths."* This issue tracks the next sweep — either bump the SDK

[Read the thread](https://github.com/PierreJanineh/TechDebtMCP/issues/189) · 2026-05-22 · closed · outside contributor · 0 comments

## Most recent

### Verify GitHub MCP Registry + community propagation; submit the rest

## Verify GitHub MCP Registry + community propagation; submit the rest

Because the official MCP Registry feeds downstream consumers (Smithery, PulseMCP, Docker Hub, Anthropic, **GitHub**), most distribution should follow automatically once #PUBLISH lands. This ticket verifies that propagation and handles the registries that need separate/manual submission.

### Scope

- [ ] After #PUBLISH, confirm the listing renders in **GitHub's MCP Registry** (`@mcp` in VS Code's Extensions view). Note GitHu

[Read the thread](https://github.com/PierreJanineh/TechDebtMCP/issues/251) · 2026-06-20 · open · outside contributor · 0 comments

### Automate publishing to the official MCP Registry

## Automate publishing to the official MCP Registry

The server is **not live** on `registry.modelcontextprotocol.io` (a search for `tech-debt-mcp` returns 0 results). A `server.json` exists but nothing publishes it — `publish.yml` only does npm + GitHub Release + MCPB artifact. This ticket adds automated registry publishing and performs the initial publish.

### Approach

Use the official **Publish MCP Server** GitHub Action (or the `mcp-publisher` CLI directly), authenticating with **GitHub OI

[Read the thread](https://github.com/PierreJanineh/TechDebtMCP/issues/250) · 2026-06-20 · open · outside contributor · 0 comments

### Fix server.json version drift + wire into assertVersionsMatch()

## Fix `server.json` version drift + wire into `assertVersionsMatch()`

`server.json` (the official MCP Registry manifest at repo root) is stuck at **2.0.2** while `package.json` is **2.1.0**. It carries the version in **two** fields (`version` and `packages[0].version`) and is the **only** version-pinned file *not* machine-enforced — documented as a known bug in `.claude/rules/version-bump.md`.

### Scope

- [ ] Bump `server.json` `version` and `packages[0].version` to match `package.json` (2.1

[Read the thread](https://github.com/PierreJanineh/TechDebtMCP/issues/249) · 2026-06-20 · closed · outside contributor · 0 comments

### Tracker: MCP registry distribution & dependency-vulnerability hygiene

## Tracker: MCP registry distribution & dependency-vulnerability hygiene

Parent tracker for two related initiatives planned together:

1. **Dependency vulnerability hygiene** — establish a documented, reconciled triage policy for the dev-only CVE noise.
2. **MCP registry distribution** — get `tech-debt-mcp` actually live on the official MCP Registry (it currently is **not**), then propagate to GitHub's catalog and community registries.

### Context snapshot (as of planning)

- **Production deps

[Read the thread](https://github.com/PierreJanineh/TechDebtMCP/issues/247) · 2026-06-20 · open · outside contributor · 0 comments

### file-length issues emit `:undefined` line number in formatted output

## Repro

Both Rust (ripgrep) and Python (FastAPI) scans surface entries like:

\`\`\`
[file-length] File is too long
  tests/regression.rs:undefined
  File has 1720 lines (max recommended: 500)
\`\`\`

## Cause

The \`file-length\` rule applies to the whole file, not a specific line, so the issue's \`line\` field is left as \`undefined\`. When interpolated into the formatted output (\`\${file}:\${line}\`), it renders as the literal string \`undefined\`.

## Suggested fix

Either:
- Emit \`line:

[Read the thread](https://github.com/PierreJanineh/TechDebtMCP/issues/223) · 2026-05-23 · open · outside contributor · 0 comments

### Severity should be context-aware: downgrade test-only rules (unwrap, panic, nesting) in tests/

## Repro

Two scans of well-respected codebases, dominated by test-file noise:

**ripgrep** @ `4519153e5e461527f4bca45b042fff45c4ec6fb9` (Rust):
- 1,197 high-severity total
- **1,101 are \`unwrap()\` calls in \`tests/*.rs\`**
- 22 more are \`panic!()\` macros in \`tests/util.rs\`

**FastAPI** @ `3675137523dc167981aa3a3c44599b4f3079ccd8` (Python):
- 343 high-severity total
- **333 are \`nesting-depth\` violations in \`tests/\`** (pytest fixtures + \`@pytest.mark.parametrize\` legitimately nest de

[Read the thread](https://github.com/PierreJanineh/TechDebtMCP/issues/222) · 2026-05-23 · open · outside contributor · 0 comments

### exec-usage regex over-matches: flags ORM/method calls like session.exec() as critical security

## Repro

Scanned FastAPI at SHA `3675137523dc167981aa3a3c44599b4f3079ccd8`. All 4 critical-severity findings were `exec-usage`, every one a false positive on `session.exec(...)` (SQLModel ORM query method).

Example match — `docs_src/sql_databases/tutorial002_py310.py:68`:
```python
heroes = session.exec(select(Hero).offset(offset).limit(limit)).all()
```

The rule is intended to catch Python's builtin `exec()`, but the regex matches `exec(` anywhere, including method calls. SQLModel, SQLAlchem

[Read the thread](https://github.com/PierreJanineh/TechDebtMCP/issues/221) · 2026-05-23 · open · outside contributor · 0 comments

### bug: severity overrides in .techdebtrc.json are silently ignored

## Summary

`severity` overrides defined in `.techdebtrc.json` are **silently ignored** by `analyze_file` and `analyze_project`. Issues are always reported at the analyzer's default severity, regardless of what the user configures.

## Severity

**High** — same shape as TEC-49 (`customPatterns` ignored): a documented, user-facing config field is wholly non-functional. Stop-ship for TEC-39 / TEC-45 alongside TEC-49. Likely the same root cause (missing wire between `loadConfig` and the analysis pi

[Read the thread](https://github.com/PierreJanineh/TechDebtMCP/issues/211) · 2026-05-23 · closed · outside contributor · 0 comments

### test: dogfood self-scan CI job asserting each .techdebtrc.json block works

## Summary

Add a CI job that loads the repo's own `.techdebtrc.json`, runs `analyze_project` against `src/`, and asserts each configured block (`ignore`, `customPatterns`, `ruleExclusions`, `severity`, `rules`) produces an observable, expected effect on the output.

## Why

This repo dogfoods itself — it already has a `.techdebtrc.json` driving its own self-scan. Bug #1 from TEC-48 (`customPatterns` silently ignored) would have been caught on day one of dogfooding if there had been a CI asserti

[Read the thread](https://github.com/PierreJanineh/TechDebtMCP/issues/210) · 2026-05-23 · closed · outside contributor · 0 comments

### test: meta-test enforcing every user-facing surface has a contract test

## Summary

Add a Jest meta-test that iterates over each user-facing surface (tools, resources, config keys, languages) and asserts that each entry has at least one corresponding contract test registered. Block CI if a new feature lands without a contract test.

## Why

A meta-test makes the computer enforce what reviewers forget. `customPatterns` was added to types + configValidator without being wired to consumers; no reviewer caught the missing analysis-side change. A meta-test would have fai

[Read the thread](https://github.com/PierreJanineh/TechDebtMCP/issues/208) · 2026-05-23 · open · outside contributor · 0 comments

### test: adopt contract-test methodology (umbrella)

## Summary

Adopt a **contract-test methodology** as the dominant test type, replacing module-only unit tests as the primary safety net. Every user-facing feature must have at least one test that exercises it end-to-end from the user-entry point (tool call, config file, resource URI, inline directive) to observable output.

## Why

The three bugs surfaced during TEC-48 QA (#191) — `customPatterns` ignored, `execute_custom_rules` language inference, `list_custom_rules` incomplete — all share one 

[Read the thread](https://github.com/PierreJanineh/TechDebtMCP/issues/207) · 2026-05-23 · open · outside contributor · 0 comments

The remaining reports are on [the project's issue tracker](https://github.com/PierreJanineh/TechDebtMCP/issues).