Reported issues for tech-debt-mcp

Pod holds 20 of 109 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to tech-debt-mcp.

Most discussed

chore: end-to-end finishing check for Claude Code plugin + MCPB bundle

Summary

TEC-35 (#175) landed the .claude-plugin/ manifest. TEC-42 (#182) landed the MCPB manifest + npm run mcpb:pack tooling. Both ship the scaffolding but neither has been verified end-to-end on a clean machine before submission to the official directories (TEC-39 — claude-plugins-official; TEC-45 — Anthropic MCP directory).

This issue tracks the pre-submission QA pass.

Update 2026-05-23: Re-read TEC-39 and TEC-45 against this checklist. Neither submission ticket actually

Read the thread · 2026-05-22 · closed · outside contributor · 5 comments

Release: v2.1.0

Release tracker for v2.1.0 — the Distribution release (Claude Code plugin + MCPB bundle).

Branch: release/v2.1.0 Cut from: develop @ 9051f24 Date cut: 2026-05-24

Gates before tagging

Sanity run issue checked off
Regression run issue checked off
CHANGELOG entry finalized
Privacy policy URL verified live (https://pierrejanineh.github.io/TechDebtMCP/privacy)
.mcpb artifact previewable (CI builds + attaches on tag push per #182)

After tag + publish

Read the thread · 2026-05-23 · closed · 3 comments

feat: add SwiftUI-specific tech debt analysis checks

Description

Extend TechDebt MCP to include SwiftUI-specific technical debt checks. Current analysis misses critical SwiftUI patterns, state management issues, and performance problems.

SwiftUI Analysis Gaps

High Priority

State Management Anti-Patterns
- Excessive @State variables (should use ViewModel)
- @ObservedObject vs @StateObject misuse
- Unnecessary binding unwrapping
- Missing environment value validation
Memory Management & Lifecycle
- Memory l

Read the thread · 2026-02-07 · closed · 3 comments

Sanity run: v2.1.0

Smoke pass for v2.1.0 distribution artifacts. Pre-publish — testing local build of release/v2.1.0 @ a1ba57f (with TEC-73/#240 and TEC-242 fixes).

Environment: macOS 14.4 (Darwin 25.3.0), Node 20.17.0, MCP Inspector v0.15.0 driven via Playwright MCP, Claude Desktop with MCPB bundle, Claude Code with plugin install (mcpServer temporarily pointing at local dist for pre-publish verification, will revert before tag), local artifacts (not yet tagged/published)

Distribution artifacts

Read the thread · 2026-05-23 · closed · 2 comments

Create `.github/copilot-instructions.md` for AI agents

Description

Create AI agent guidelines for contributing to this project in the GitHub Copilot native location.

Details

Phase: Pre-Phase
File: .github/copilot-instructions.md (new)

Content to Include

Project overview
Architecture rules (types location, factory patterns, base classes)
Coding standards (strict TypeScript, async/await, JSDoc)
How to add a new language analyzer
How to add a new MCP tool
Testing requirements

Acceptance Criteria

File creat

Read the thread · 2026-02-07 · closed · 2 comments

Plugin: nested layout + whole-repo install surface — restructure into ./plugin subdirectory

Repro (original — #242)

Found during v2.1.0 manual sanity pass via Claude Code slash command verification (/techdebt-scan returned "Unknown command").

/plugin marketplace add /Users/.../TechDebtMCP
/plugin install tech-debt-mcp@techdebtmcp
# Restart CC session
/techdebt-scan   # -> Unknown command: /techdebt-scan

The MCP server registers and tools are callable. Only the slash commands are missing.

Root cause A — nested components (original #242)

Claude Code's plugin load

Read the thread · 2026-05-24 · closed · 1 comment

eval-usage regex over-matches: flags Ruby instance_eval/class_eval/module_eval as critical security

Repro

Scanned Sinatra at SHA HEAD of develop branch. All 22 critical findings were eval-usage, every one matching Ruby's metaprogramming methods — not the standalone eval() builtin.

Example matches:

test/contest.rb:37 — instance_eval(&block) — Ruby DSL pattern, completely safe
test/contest.rb:44 — instance_eval(&block) — same
test/helpers_test.rb:16 — likely class_eval

Why it's wrong

instance_eval, class_eval, module_eval, and Module#define_method are co

Read the thread · 2026-05-23 · closed · outside contributor · 1 comment

Review console statements in index.ts and setup.ts

Context

Sub-issue of #82.

Problem

3 console statements flagged:

src/index.ts:15 — startup log
src/server/setup.ts:30 — server setup log
src/server/setup.ts:60 — error log

Considerations

MCP servers communicate over stdio, so console.log (stdout) can interfere with the protocol. console.error (stderr) is the MCP convention for logging.

Fix

Check if each statement uses console.log or console.error
Replace console.log with console.error for MCP compatibili

Read the thread · 2026-03-20 · closed · 1 comment

Most recent

Verify GitHub MCP Registry + community propagation; submit the rest

Because the official MCP Registry feeds downstream consumers (Smithery, PulseMCP, Docker Hub, Anthropic, GitHub), most distribution should follow automatically once #PUBLISH lands. This ticket verifies that propagation and handles the registries that need separate/manual submission.

Scope

After #PUBLISH, confirm the listing renders in GitHub's MCP Registry (@mcp in VS Code's Extensions view). Note GitHu

Read the thread · 2026-06-20 · open · outside contributor · 0 comments

Automate publishing to the official MCP Registry

The server is not live on registry.modelcontextprotocol.io (a search for tech-debt-mcp returns 0 results). A server.json exists but nothing publishes it — publish.yml only does npm + GitHub Release + MCPB artifact. This ticket adds automated registry publishing and performs the initial publish.

Approach

Use the official Publish MCP Server GitHub Action (or the mcp-publisher CLI directly), authenticating with **GitHub OI

Read the thread · 2026-06-20 · open · outside contributor · 0 comments

Fix server.json version drift + wire into assertVersionsMatch()

Fix `server.json` version drift + wire into `assertVersionsMatch()`

server.json (the official MCP Registry manifest at repo root) is stuck at 2.0.2 while package.json is 2.1.0. It carries the version in two fields (version and packages[0].version) and is the only version-pinned file not machine-enforced — documented as a known bug in .claude/rules/version-bump.md.

Scope

Bump server.json version and packages[0].version to match package.json (2.1

Read the thread · 2026-06-20 · closed · outside contributor · 0 comments

Tracker: MCP registry distribution & dependency-vulnerability hygiene

Parent tracker for two related initiatives planned together:

Dependency vulnerability hygiene — establish a documented, reconciled triage policy for the dev-only CVE noise.
MCP registry distribution — get tech-debt-mcp actually live on the official MCP Registry (it currently is not), then propagate to GitHub's catalog and community registries.

Context snapshot (as of planning)

**Production deps

Read the thread · 2026-06-20 · open · outside contributor · 0 comments

MCP analyze_project returns 0 issues when languages/categories are empty arrays

Repro

Found during v2.1.0 manual sanity pass via MCP Inspector against release/v2.1.0 @ 9051f24.

```js import { AnalysisEngine } from './dist/core/analysisEngine.js'; const e = new AnalysisEngine(); const repo = process.cwd();

await e.analyzeProject({ path: repo }); // → totalIssues: 166, filesAnalyzed: 62

await e.analyzeProject({ path: repo, languages: undefined, categories: undefined }); // → totalIssues: 166, filesAnalyzed: 62

await e.analyzeProject({ path: repo, languages: [], c

Read the thread · 2026-05-24 · closed · 0 comments

Regression run: v2.1.0

Manual regression pass for v2.1.0 (minor release).

Fixture project: self-scan of TechDebtMCP repo + ad-hoc temp projects for config behaviors + MCP Inspector lifecycle for custom-rules state + Claude Desktop prompt-driven session + Claude Code plugin slash-command session. Release milestone: release/v2.1.0 @ a1ba57f (with TEC-73 / #240 and TEC-242 / #243 fixes)

Analyzer coverage (14 languages — each must produce expected issues on the fixture)

All 14 covered by automated test

Read the thread · 2026-05-23 · closed · 0 comments

Dogfood follow-ups: TECH_DEBT_SCAN drift + .techdebtrc.json ignore gaps + prefer-nullish-coalescing noise

Filed from the TEC-37 dogfood cycle (PR #235). Running AnalysisEngine.analyzeProject() against this repo surfaced three findings worth fixing before the next release. Bundled here because they share a single end-state (a refreshed TECH_DEBT_SCAN.md).

1. `TECH_DEBT_SCAN.md` is significantly stale

File claims: 13 issues / Health 95 / Debt 5 / Remediation 14h
Current programmatic scan: 165 issues / Health 54.2 / Debt 45.8 (3d 12h 55m remediation; SQALE rating still A becaus

Read the thread · 2026-05-23 · open · outside contributor · 0 comments

Java analyzer matches patterns inside Javadoc {@code} /

 blocks (system-out, likely others)

Repro

Showcase scan of google/gson @ `abfef5e8455483b878a8dea14dd42fa55832a56c` surfaced `system-out` findings inside Javadoc `

{@code ... }

` documentation blocks — not production code.

Example — `gson/src/main/java/com/google/gson/GsonBuilder.java:300`:

```java *

Map<Point, String> original = new LinkedHashMap<>();
original.put(new Point(5, 6), "a");
original.put(new Point(8, 8), "b");
System.out.println(gson.toJson(original, type)); // <-

Read the thread · 2026-05-23 · open · outside contributor · 0 comments

file-length issues emit `:undefined` line number in formatted output

Repro

Both Rust (ripgrep) and Python (FastAPI) scans surface entries like:

``` [file-length] File is too long tests/regression.rs:undefined File has 1720 lines (max recommended: 500) ```

Cause

The `file-length` rule applies to the whole file, not a specific line, so the issue's `line` field is left as `undefined`. When interpolated into the formatted output (`${file}:${line}`), it renders as the literal string `undefined`.

Suggested fix

Either:

Emit `line:

Read the thread · 2026-05-23 · open · outside contributor · 0 comments

Severity should be context-aware: downgrade test-only rules (unwrap, panic, nesting) in tests/

Repro

Two scans of well-respected codebases, dominated by test-file noise:

ripgrep @ 4519153e5e461527f4bca45b042fff45c4ec6fb9 (Rust):

1,197 high-severity total
1,101 are `unwrap()` calls in `tests/*.rs`
22 more are `panic!()` macros in `tests/util.rs`

FastAPI @ 3675137523dc167981aa3a3c44599b4f3079ccd8 (Python):

343 high-severity total
333 are `nesting-depth` violations in `tests/` (pytest fixtures + `@pytest.mark.parametrize` legitimately nest de

Read the thread · 2026-05-23 · open · outside contributor · 0 comments

exec-usage regex over-matches: flags ORM/method calls like session.exec() as critical security

Repro

Scanned FastAPI at SHA 3675137523dc167981aa3a3c44599b4f3079ccd8. All 4 critical-severity findings were exec-usage, every one a false positive on session.exec(...) (SQLModel ORM query method).

Example match — docs_src/sql_databases/tutorial002_py310.py:68:

heroes = session.exec(select(Hero).offset(offset).limit(limit)).all()

The rule is intended to catch Python's builtin exec(), but the regex matches exec( anywhere, including method calls. SQLModel, SQLAlchem

Read the thread · 2026-05-23 · open · outside contributor · 0 comments

bug: include glob in .techdebtrc.json is silently ignored by analyze_project

Summary

The include glob array in .techdebtrc.json is silently ignored by analyze_project. Files matching extensions outside the include patterns are still discovered and analyzed.

Severity

High — same shape as TEC-49 (customPatterns) and the severity-override bug: documented, user-facing config field is wholly non-functional. Stop-ship for TEC-39 / TEC-45.

Reproduction

Surfaced during TEC-48 end-to-end QA against tech-debt-mcp@2.0.2.

Create `/tmp/test/.tech

Read the thread · 2026-05-23 · closed · outside contributor · 0 comments

The remaining reports are on the project's issue tracker.

Reported issues for tech-debt-mcp

Most discussed

chore: end-to-end finishing check for Claude Code plugin + MCPB bundle

Summary

Release: v2.1.0

Gates before tagging

After tag + publish

feat: add SwiftUI-specific tech debt analysis checks

Description

SwiftUI Analysis Gaps

High Priority

Sanity run: v2.1.0

Distribution artifacts

Create .github/copilot-instructions.md for AI agents

Description

Details

Content to Include

Acceptance Criteria

Plugin: nested layout + whole-repo install surface — restructure into ./plugin subdirectory

Repro (original — #242)

Root cause A — nested components (original #242)

eval-usage regex over-matches: flags Ruby instance_eval/class_eval/module_eval as critical security

Repro

Why it's wrong

Review console statements in index.ts and setup.ts

Context

Problem

Considerations

Fix

Most recent

Verify GitHub MCP Registry + community propagation; submit the rest

Verify GitHub MCP Registry + community propagation; submit the rest

Scope

Automate publishing to the official MCP Registry

Automate publishing to the official MCP Registry

Approach

Fix server.json version drift + wire into assertVersionsMatch()

Fix server.json version drift + wire into assertVersionsMatch()

Scope

Tracker: MCP registry distribution & dependency-vulnerability hygiene

Tracker: MCP registry distribution & dependency-vulnerability hygiene

Context snapshot (as of planning)

MCP analyze_project returns 0 issues when languages/categories are empty arrays

Repro

Regression run: v2.1.0

Analyzer coverage (14 languages — each must produce expected issues on the fixture)

Dogfood follow-ups: TECH_DEBT_SCAN drift + .techdebtrc.json ignore gaps + prefer-nullish-coalescing noise

1. TECH_DEBT_SCAN.md is significantly stale

Java analyzer matches patterns inside Javadoc {@code} / blocks (system-out, likely others)

Repro

file-length issues emit :undefined line number in formatted output

Repro

Cause

Suggested fix

Severity should be context-aware: downgrade test-only rules (unwrap, panic, nesting) in tests/

Repro

exec-usage regex over-matches: flags ORM/method calls like session.exec() as critical security

Repro

bug: include glob in .techdebtrc.json is silently ignored by analyze_project

Summary

Severity

Reproduction

Create `.github/copilot-instructions.md` for AI agents

Fix `server.json` version drift + wire into `assertVersionsMatch()`

1. `TECH_DEBT_SCAN.md` is significantly stale

Java analyzer matches patterns inside Javadoc {@code} /
blocks (system-out, likely others)

file-length issues emit `:undefined` line number in formatted output