# Reported issues for tech-debt-mcp

Pod holds 20 of 109 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to [tech-debt-mcp](/mcp/tech-debt-mcp).

## Most discussed

### chore: end-to-end finishing check for Claude Code plugin + MCPB bundle

## Summary

TEC-35 (#175) landed the `.claude-plugin/` manifest. TEC-42 (#182) landed the MCPB manifest + `npm run mcpb:pack` tooling. Both ship the scaffolding but **neither has been verified end-to-end on a clean machine** before submission to the official directories (TEC-39 — `claude-plugins-official`; TEC-45 — Anthropic MCP directory).

This issue tracks the pre-submission QA pass.

> **Update 2026-05-23:** Re-read TEC-39 and TEC-45 against this checklist. Neither submission ticket actually

[Read the thread](https://github.com/PierreJanineh/TechDebtMCP/issues/191) · 2026-05-22 · closed · outside contributor · 5 comments

### Release: v2.1.0

Release tracker for **v2.1.0** — the Distribution release (Claude Code plugin + MCPB bundle).

Branch: `release/v2.1.0`
Cut from: `develop` @ 9051f24
Date cut: 2026-05-24

## Gates before tagging

- [ ] Sanity run issue checked off
- [ ] Regression run issue checked off
- [ ] CHANGELOG entry finalized
- [ ] Privacy policy URL verified live (`https://pierrejanineh.github.io/TechDebtMCP/privacy`)
- [ ] `.mcpb` artifact previewable (CI builds + attaches on tag push per #182)

## After tag + publish

[Read the thread](https://github.com/PierreJanineh/TechDebtMCP/issues/237) · 2026-05-23 · closed · 3 comments

### feat: add SwiftUI-specific tech debt analysis checks

## Description

Extend TechDebt MCP to include SwiftUI-specific technical debt checks. Current analysis misses critical SwiftUI patterns, state management issues, and performance problems.

## SwiftUI Analysis Gaps

### High Priority
1. **State Management Anti-Patterns**
   - Excessive @State variables (should use ViewModel)
   - @ObservedObject vs @StateObject misuse
   - Unnecessary binding unwrapping
   - Missing environment value validation

2. **Memory Management & Lifecycle**
   - Memory l

[Read the thread](https://github.com/PierreJanineh/TechDebtMCP/issues/58) · 2026-02-07 · closed · 3 comments

### Sanity run: v2.1.0

Smoke pass for **v2.1.0** distribution artifacts. Pre-publish — testing local build of `release/v2.1.0` @ a1ba57f (with TEC-73/#240 and TEC-242 fixes).

**Environment:** macOS 14.4 (Darwin 25.3.0), Node 20.17.0, MCP Inspector v0.15.0 driven via Playwright MCP, Claude Desktop with MCPB bundle, Claude Code with plugin install (mcpServer temporarily pointing at local dist for pre-publish verification, will revert before tag), local artifacts (not yet tagged/published)

## Distribution artifacts

- 

[Read the thread](https://github.com/PierreJanineh/TechDebtMCP/issues/238) · 2026-05-23 · closed · 2 comments

### Create `.github/copilot-instructions.md` for AI agents

## Description
Create AI agent guidelines for contributing to this project in the GitHub Copilot native location.

## Details
- **Phase:** Pre-Phase
- **File:** `.github/copilot-instructions.md` (new)

## Content to Include
- Project overview
- Architecture rules (types location, factory patterns, base classes)
- Coding standards (strict TypeScript, async/await, JSDoc)
- How to add a new language analyzer
- How to add a new MCP tool
- Testing requirements

## Acceptance Criteria
- [ ] File creat

[Read the thread](https://github.com/PierreJanineh/TechDebtMCP/issues/1) · 2026-02-07 · closed · 2 comments

### Plugin: nested layout + whole-repo install surface — restructure into ./plugin subdirectory

## Repro (original — #242)

Found during v2.1.0 manual sanity pass via Claude Code slash command verification (`/techdebt-scan` returned "Unknown command").

```bash
/plugin marketplace add /Users/.../TechDebtMCP
/plugin install tech-debt-mcp@techdebtmcp
# Restart CC session
/techdebt-scan   # -> Unknown command: /techdebt-scan
```

The MCP server registers and tools are callable. Only the slash commands are missing.

## Root cause A — nested components (original #242)

Claude Code's plugin load

[Read the thread](https://github.com/PierreJanineh/TechDebtMCP/issues/242) · 2026-05-24 · closed · 1 comment

### eval-usage regex over-matches: flags Ruby instance_eval/class_eval/module_eval as critical security

## Repro

Scanned Sinatra at SHA `HEAD` of develop branch. All 22 critical findings were `eval-usage`, every one matching Ruby's metaprogramming methods — not the standalone `eval()` builtin.

Example matches:
- `test/contest.rb:37` — `instance_eval(&block)` — Ruby DSL pattern, completely safe
- `test/contest.rb:44` — `instance_eval(&block)` — same
- `test/helpers_test.rb:16` — likely `class_eval`

## Why it's wrong

`instance_eval`, `class_eval`, `module_eval`, and `Module#define_method` are co

[Read the thread](https://github.com/PierreJanineh/TechDebtMCP/issues/225) · 2026-05-23 · closed · outside contributor · 1 comment

### Review console statements in index.ts and setup.ts

## Context
Sub-issue of #82.

## Problem
3 console statements flagged:
- `src/index.ts:15` — startup log
- `src/server/setup.ts:30` — server setup log
- `src/server/setup.ts:60` — error log

## Considerations
MCP servers communicate over stdio, so `console.log` (stdout) can interfere with the protocol. `console.error` (stderr) is the MCP convention for logging.

## Fix
- Check if each statement uses `console.log` or `console.error`
- Replace `console.log` with `console.error` for MCP compatibili

[Read the thread](https://github.com/PierreJanineh/TechDebtMCP/issues/95) · 2026-03-20 · closed · 1 comment

## Most recent

### Verify GitHub MCP Registry + community propagation; submit the rest

## Verify GitHub MCP Registry + community propagation; submit the rest

Because the official MCP Registry feeds downstream consumers (Smithery, PulseMCP, Docker Hub, Anthropic, **GitHub**), most distribution should follow automatically once #PUBLISH lands. This ticket verifies that propagation and handles the registries that need separate/manual submission.

### Scope

- [ ] After #PUBLISH, confirm the listing renders in **GitHub's MCP Registry** (`@mcp` in VS Code's Extensions view). Note GitHu

[Read the thread](https://github.com/PierreJanineh/TechDebtMCP/issues/251) · 2026-06-20 · open · outside contributor · 0 comments

### Automate publishing to the official MCP Registry

## Automate publishing to the official MCP Registry

The server is **not live** on `registry.modelcontextprotocol.io` (a search for `tech-debt-mcp` returns 0 results). A `server.json` exists but nothing publishes it — `publish.yml` only does npm + GitHub Release + MCPB artifact. This ticket adds automated registry publishing and performs the initial publish.

### Approach

Use the official **Publish MCP Server** GitHub Action (or the `mcp-publisher` CLI directly), authenticating with **GitHub OI

[Read the thread](https://github.com/PierreJanineh/TechDebtMCP/issues/250) · 2026-06-20 · open · outside contributor · 0 comments

### Fix server.json version drift + wire into assertVersionsMatch()

## Fix `server.json` version drift + wire into `assertVersionsMatch()`

`server.json` (the official MCP Registry manifest at repo root) is stuck at **2.0.2** while `package.json` is **2.1.0**. It carries the version in **two** fields (`version` and `packages[0].version`) and is the **only** version-pinned file *not* machine-enforced — documented as a known bug in `.claude/rules/version-bump.md`.

### Scope

- [ ] Bump `server.json` `version` and `packages[0].version` to match `package.json` (2.1

[Read the thread](https://github.com/PierreJanineh/TechDebtMCP/issues/249) · 2026-06-20 · closed · outside contributor · 0 comments

### Tracker: MCP registry distribution & dependency-vulnerability hygiene

## Tracker: MCP registry distribution & dependency-vulnerability hygiene

Parent tracker for two related initiatives planned together:

1. **Dependency vulnerability hygiene** — establish a documented, reconciled triage policy for the dev-only CVE noise.
2. **MCP registry distribution** — get `tech-debt-mcp` actually live on the official MCP Registry (it currently is **not**), then propagate to GitHub's catalog and community registries.

### Context snapshot (as of planning)

- **Production deps

[Read the thread](https://github.com/PierreJanineh/TechDebtMCP/issues/247) · 2026-06-20 · open · outside contributor · 0 comments

### MCP analyze_project returns 0 issues when languages/categories are empty arrays

## Repro

Found during v2.1.0 manual sanity pass via MCP Inspector against `release/v2.1.0` @ 9051f24.

\`\`\`js
import { AnalysisEngine } from './dist/core/analysisEngine.js';
const e = new AnalysisEngine();
const repo = process.cwd();

await e.analyzeProject({ path: repo });
// → totalIssues: 166, filesAnalyzed: 62

await e.analyzeProject({ path: repo, languages: undefined, categories: undefined });
// → totalIssues: 166, filesAnalyzed: 62

await e.analyzeProject({ path: repo, languages: [], c

[Read the thread](https://github.com/PierreJanineh/TechDebtMCP/issues/240) · 2026-05-24 · closed · 0 comments

### Regression run: v2.1.0

Manual regression pass for **v2.1.0** (minor release).

**Fixture project:** self-scan of TechDebtMCP repo + ad-hoc temp projects for config behaviors + MCP Inspector lifecycle for custom-rules state + Claude Desktop prompt-driven session + Claude Code plugin slash-command session.
**Release milestone:** `release/v2.1.0` @ a1ba57f (with TEC-73 / #240 and TEC-242 / #243 fixes)

## Analyzer coverage (14 languages — each must produce expected issues on the fixture)

All 14 covered by automated test

[Read the thread](https://github.com/PierreJanineh/TechDebtMCP/issues/239) · 2026-05-23 · closed · 0 comments

### Dogfood follow-ups: TECH_DEBT_SCAN drift + .techdebtrc.json ignore gaps + prefer-nullish-coalescing noise

Filed from the TEC-37 dogfood cycle (PR #235). Running `AnalysisEngine.analyzeProject()` against this repo surfaced three findings worth fixing before the next release. Bundled here because they share a single end-state (a refreshed `TECH_DEBT_SCAN.md`).

## 1. `TECH_DEBT_SCAN.md` is significantly stale

- File claims: **13 issues / Health 95 / Debt 5 / Remediation 14h**
- Current programmatic scan: **165 issues / Health 54.2 / Debt 45.8** (3d 12h 55m remediation; SQALE rating still **A** becaus

[Read the thread](https://github.com/PierreJanineh/TechDebtMCP/issues/236) · 2026-05-23 · open · outside contributor · 0 comments

### Java analyzer matches patterns inside Javadoc {@code} / <pre> blocks (system-out, likely others)

## Repro

Showcase scan of google/gson @ \`abfef5e8455483b878a8dea14dd42fa55832a56c\` surfaced \`system-out\` findings inside Javadoc \`<pre>{@code ... }</pre>\` documentation blocks — not production code.

**Example — \`gson/src/main/java/com/google/gson/GsonBuilder.java:300\`:**

\`\`\`java
   *
   * Map<Point, String> original = new LinkedHashMap<>();
   * original.put(new Point(5, 6), "a");
   * original.put(new Point(8, 8), "b");
   * System.out.println(gson.toJson(original, type));   // <-

[Read the thread](https://github.com/PierreJanineh/TechDebtMCP/issues/228) · 2026-05-23 · open · outside contributor · 0 comments

### file-length issues emit `:undefined` line number in formatted output

## Repro

Both Rust (ripgrep) and Python (FastAPI) scans surface entries like:

\`\`\`
[file-length] File is too long
  tests/regression.rs:undefined
  File has 1720 lines (max recommended: 500)
\`\`\`

## Cause

The \`file-length\` rule applies to the whole file, not a specific line, so the issue's \`line\` field is left as \`undefined\`. When interpolated into the formatted output (\`\${file}:\${line}\`), it renders as the literal string \`undefined\`.

## Suggested fix

Either:
- Emit \`line:

[Read the thread](https://github.com/PierreJanineh/TechDebtMCP/issues/223) · 2026-05-23 · open · outside contributor · 0 comments

### Severity should be context-aware: downgrade test-only rules (unwrap, panic, nesting) in tests/

## Repro

Two scans of well-respected codebases, dominated by test-file noise:

**ripgrep** @ `4519153e5e461527f4bca45b042fff45c4ec6fb9` (Rust):
- 1,197 high-severity total
- **1,101 are \`unwrap()\` calls in \`tests/*.rs\`**
- 22 more are \`panic!()\` macros in \`tests/util.rs\`

**FastAPI** @ `3675137523dc167981aa3a3c44599b4f3079ccd8` (Python):
- 343 high-severity total
- **333 are \`nesting-depth\` violations in \`tests/\`** (pytest fixtures + \`@pytest.mark.parametrize\` legitimately nest de

[Read the thread](https://github.com/PierreJanineh/TechDebtMCP/issues/222) · 2026-05-23 · open · outside contributor · 0 comments

### exec-usage regex over-matches: flags ORM/method calls like session.exec() as critical security

## Repro

Scanned FastAPI at SHA `3675137523dc167981aa3a3c44599b4f3079ccd8`. All 4 critical-severity findings were `exec-usage`, every one a false positive on `session.exec(...)` (SQLModel ORM query method).

Example match — `docs_src/sql_databases/tutorial002_py310.py:68`:
```python
heroes = session.exec(select(Hero).offset(offset).limit(limit)).all()
```

The rule is intended to catch Python's builtin `exec()`, but the regex matches `exec(` anywhere, including method calls. SQLModel, SQLAlchem

[Read the thread](https://github.com/PierreJanineh/TechDebtMCP/issues/221) · 2026-05-23 · open · outside contributor · 0 comments

### bug: include glob in .techdebtrc.json is silently ignored by analyze_project

## Summary

The `include` glob array in `.techdebtrc.json` is **silently ignored** by `analyze_project`. Files matching extensions outside the `include` patterns are still discovered and analyzed.

## Severity

**High** — same shape as TEC-49 (`customPatterns`) and the severity-override bug: documented, user-facing config field is wholly non-functional. Stop-ship for TEC-39 / TEC-45.

## Reproduction

Surfaced during TEC-48 end-to-end QA against `tech-debt-mcp@2.0.2`.

1. Create `/tmp/test/.tech

[Read the thread](https://github.com/PierreJanineh/TechDebtMCP/issues/212) · 2026-05-23 · closed · outside contributor · 0 comments

The remaining reports are on [the project's issue tracker](https://github.com/PierreJanineh/TechDebtMCP/issues).