pod
Other formats agents might prefer:
markdownjsonllms.txt

Agent? You probably want markdown or json, or Pod over MCP.

Reported issues for io.github.PierreJanineh/tech-debt-mcp

Pod holds 19 of 21 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to io.github.PierreJanineh/tech-debt-mcp.

Most discussed

Dogfood follow-ups: TECH_DEBT_SCAN drift + .techdebtrc.json ignore gaps + prefer-nullish-coalescing noise

Filed from the TEC-37 dogfood cycle (PR #235). Running AnalysisEngine.analyzeProject() against this repo surfaced three findings worth fixing before the next release. Bundled here because they share a single end-state (a refreshed TECH_DEBT_SCAN.md).

1. TECH_DEBT_SCAN.md is significantly stale

  • File claims: 13 issues / Health 95 / Debt 5 / Remediation 14h
  • Current programmatic scan: 165 issues / Health 54.2 / Debt 45.8 (3d 12h 55m remediation; SQALE rating still A becaus

Read the thread · 2026-05-23 · open · outside contributor · 0 comments

Java analyzer matches patterns inside Javadoc {@code} / 
 blocks (system-out, likely others)

Repro

Showcase scan of google/gson @ `abfef5e8455483b878a8dea14dd42fa55832a56c` surfaced `system-out` findings inside Javadoc `

{@code ... }
` documentation blocks — not production code.

Example — `gson/src/main/java/com/google/gson/GsonBuilder.java:300`:

```java *

  • Map<Point, String> original = new LinkedHashMap<>();
  • original.put(new Point(5, 6), "a");
  • original.put(new Point(8, 8), "b");
  • System.out.println(gson.toJson(original, type)); // <-

Read the thread · 2026-05-23 · open · outside contributor · 0 comments

eval-usage regex over-matches: flags Ruby instance_eval/class_eval/module_eval as critical security

Repro

Scanned Sinatra at SHA HEAD of develop branch. All 22 critical findings were eval-usage, every one matching Ruby's metaprogramming methods — not the standalone eval() builtin.

Example matches:

  • test/contest.rb:37 — instance_eval(&block) — Ruby DSL pattern, completely safe
  • test/contest.rb:44 — instance_eval(&block) — same
  • test/helpers_test.rb:16 — likely class_eval

Why it's wrong

instance_eval, class_eval, module_eval, and Module#define_method are co

Read the thread · 2026-05-23 · closed · outside contributor · 1 comment

bug: include glob in .techdebtrc.json is silently ignored by analyze_project

Summary

The include glob array in .techdebtrc.json is silently ignored by analyze_project. Files matching extensions outside the include patterns are still discovered and analyzed.

Severity

High — same shape as TEC-49 (customPatterns) and the severity-override bug: documented, user-facing config field is wholly non-functional. Stop-ship for TEC-39 / TEC-45.

Reproduction

Surfaced during TEC-48 end-to-end QA against tech-debt-mcp@2.0.2.

  1. Create `/tmp/test/.tech

Read the thread · 2026-05-23 · closed · outside contributor · 0 comments

test: published-artifact integration test (npm pack + stdio client)

Summary

Add a CI job that runs npm pack, installs the resulting tarball into a temp dir, spawns the server over stdio via @modelcontextprotocol/sdk client, and exercises real tools/call and resources/read requests against the installed artifact. Catches packaging issues, dist gaps, broken bin entries, and resource registration drift that don't show up in npm test.

Why

npm test runs against TypeScript source via ts-jest. Users get dist/. Nothing today asserts that t

Read the thread · 2026-05-23 · open · outside contributor · 0 comments

bug: customPatterns from .techdebtrc.json are silently ignored by analyze_file/analyze_project

Summary

customPatterns defined in .techdebtrc.json are silently ignored by analyze_file and analyze_project. The config passes validate_config cleanly, the analysis runs without error, and no violations are reported. Users who configure custom patterns get zero detection and no feedback that their configuration is a no-op.

Severity

High — a documented, user-facing config field is wholly non-functional in the primary analysis code paths. This is a stop-ship for the Anth

Read the thread · 2026-05-23 · closed · outside contributor · 0 comments

chore: end-to-end finishing check for Claude Code plugin + MCPB bundle

Summary

TEC-35 (#175) landed the .claude-plugin/ manifest. TEC-42 (#182) landed the MCPB manifest + npm run mcpb:pack tooling. Both ship the scaffolding but neither has been verified end-to-end on a clean machine before submission to the official directories (TEC-39 — claude-plugins-official; TEC-45 — Anthropic MCP directory).

This issue tracks the pre-submission QA pass.

Update 2026-05-23: Re-read TEC-39 and TEC-45 against this checklist. Neither submission ticket actually

Read the thread · 2026-05-22 · closed · outside contributor · 5 comments

security: resolve 11 open Dependabot alerts (2 high, 8 moderate, 1 low)

Summary

11 open Dependabot alerts on develop as of 2026-05-22. All appear to be transitive — mostly via @modelcontextprotocol/sdk's HTTP transport (which TechDebtMCP doesn't use; the server runs over stdio).

The v2.0.2 CHANGELOG already documents this category: "Remaining Dependabot alerts (handlebars via ts-jest, hono/express/path-to-regexp via @modelcontextprotocol/sdk HTTP transport) are dev-only or unreachable code paths." This issue tracks the next sweep — either bump the SDK

Read the thread · 2026-05-22 · closed · outside contributor · 0 comments

Most recent

Verify GitHub MCP Registry + community propagation; submit the rest

Verify GitHub MCP Registry + community propagation; submit the rest

Because the official MCP Registry feeds downstream consumers (Smithery, PulseMCP, Docker Hub, Anthropic, GitHub), most distribution should follow automatically once #PUBLISH lands. This ticket verifies that propagation and handles the registries that need separate/manual submission.

Scope

  • After #PUBLISH, confirm the listing renders in GitHub's MCP Registry (@mcp in VS Code's Extensions view). Note GitHu

Read the thread · 2026-06-20 · open · outside contributor · 0 comments

Automate publishing to the official MCP Registry

Automate publishing to the official MCP Registry

The server is not live on registry.modelcontextprotocol.io (a search for tech-debt-mcp returns 0 results). A server.json exists but nothing publishes it — publish.yml only does npm + GitHub Release + MCPB artifact. This ticket adds automated registry publishing and performs the initial publish.

Approach

Use the official Publish MCP Server GitHub Action (or the mcp-publisher CLI directly), authenticating with **GitHub OI

Read the thread · 2026-06-20 · open · outside contributor · 0 comments

Fix server.json version drift + wire into assertVersionsMatch()

Fix server.json version drift + wire into assertVersionsMatch()

server.json (the official MCP Registry manifest at repo root) is stuck at 2.0.2 while package.json is 2.1.0. It carries the version in two fields (version and packages[0].version) and is the only version-pinned file not machine-enforced — documented as a known bug in .claude/rules/version-bump.md.

Scope

  • Bump server.json version and packages[0].version to match package.json (2.1

Read the thread · 2026-06-20 · closed · outside contributor · 0 comments

Tracker: MCP registry distribution & dependency-vulnerability hygiene

Tracker: MCP registry distribution & dependency-vulnerability hygiene

Parent tracker for two related initiatives planned together:

  1. Dependency vulnerability hygiene — establish a documented, reconciled triage policy for the dev-only CVE noise.
  2. MCP registry distribution — get tech-debt-mcp actually live on the official MCP Registry (it currently is not), then propagate to GitHub's catalog and community registries.

Context snapshot (as of planning)

  • **Production deps

Read the thread · 2026-06-20 · open · outside contributor · 0 comments

file-length issues emit :undefined line number in formatted output

Repro

Both Rust (ripgrep) and Python (FastAPI) scans surface entries like:

``` [file-length] File is too long tests/regression.rs:undefined File has 1720 lines (max recommended: 500) ```

Cause

The `file-length` rule applies to the whole file, not a specific line, so the issue's `line` field is left as `undefined`. When interpolated into the formatted output (`${file}:${line}`), it renders as the literal string `undefined`.

Suggested fix

Either:

  • Emit `line:

Read the thread · 2026-05-23 · open · outside contributor · 0 comments

Severity should be context-aware: downgrade test-only rules (unwrap, panic, nesting) in tests/

Repro

Two scans of well-respected codebases, dominated by test-file noise:

ripgrep @ 4519153e5e461527f4bca45b042fff45c4ec6fb9 (Rust):

  • 1,197 high-severity total
  • 1,101 are `unwrap()` calls in `tests/*.rs`
  • 22 more are `panic!()` macros in `tests/util.rs`

FastAPI @ 3675137523dc167981aa3a3c44599b4f3079ccd8 (Python):

  • 343 high-severity total
  • 333 are `nesting-depth` violations in `tests/` (pytest fixtures + `@pytest.mark.parametrize` legitimately nest de

Read the thread · 2026-05-23 · open · outside contributor · 0 comments

exec-usage regex over-matches: flags ORM/method calls like session.exec() as critical security

Repro

Scanned FastAPI at SHA 3675137523dc167981aa3a3c44599b4f3079ccd8. All 4 critical-severity findings were exec-usage, every one a false positive on session.exec(...) (SQLModel ORM query method).

Example match — docs_src/sql_databases/tutorial002_py310.py:68:

heroes = session.exec(select(Hero).offset(offset).limit(limit)).all()

The rule is intended to catch Python's builtin exec(), but the regex matches exec( anywhere, including method calls. SQLModel, SQLAlchem

Read the thread · 2026-05-23 · open · outside contributor · 0 comments

bug: severity overrides in .techdebtrc.json are silently ignored

Summary

severity overrides defined in .techdebtrc.json are silently ignored by analyze_file and analyze_project. Issues are always reported at the analyzer's default severity, regardless of what the user configures.

Severity

High — same shape as TEC-49 (customPatterns ignored): a documented, user-facing config field is wholly non-functional. Stop-ship for TEC-39 / TEC-45 alongside TEC-49. Likely the same root cause (missing wire between loadConfig and the analysis pi

Read the thread · 2026-05-23 · closed · outside contributor · 0 comments

test: dogfood self-scan CI job asserting each .techdebtrc.json block works

Summary

Add a CI job that loads the repo's own .techdebtrc.json, runs analyze_project against src/, and asserts each configured block (ignore, customPatterns, ruleExclusions, severity, rules) produces an observable, expected effect on the output.

Why

This repo dogfoods itself — it already has a .techdebtrc.json driving its own self-scan. Bug #1 from TEC-48 (customPatterns silently ignored) would have been caught on day one of dogfooding if there had been a CI asserti

Read the thread · 2026-05-23 · closed · outside contributor · 0 comments

test: meta-test enforcing every user-facing surface has a contract test

Summary

Add a Jest meta-test that iterates over each user-facing surface (tools, resources, config keys, languages) and asserts that each entry has at least one corresponding contract test registered. Block CI if a new feature lands without a contract test.

Why

A meta-test makes the computer enforce what reviewers forget. customPatterns was added to types + configValidator without being wired to consumers; no reviewer caught the missing analysis-side change. A meta-test would have fai

Read the thread · 2026-05-23 · open · outside contributor · 0 comments

test: adopt contract-test methodology (umbrella)

Summary

Adopt a contract-test methodology as the dominant test type, replacing module-only unit tests as the primary safety net. Every user-facing feature must have at least one test that exercises it end-to-end from the user-entry point (tool call, config file, resource URI, inline directive) to observable output.

Why

The three bugs surfaced during TEC-48 QA (#191) — customPatterns ignored, execute_custom_rules language inference, list_custom_rules incomplete — all share one

Read the thread · 2026-05-23 · open · outside contributor · 0 comments

The remaining reports are on the project's issue tracker.