# tech-debt-mcp [Health: Active]

**Category:** 💻 Developer Tools  
**Repository:** https://github.com/PierreJanineh/TechDebtMCP  
**GitHub Stars:** 7  
**Views:** 1  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/tech-debt-mcp

## Description
MCP Server for analyzing technical debt across multiple programming languages

## Tools
Capabilities this server exposes over MCP:

- **analyze_project** — Analyze an entire project for technical debt. Scans all supported files and returns a comprehensive report with issues, metrics, and recommendations.
- **analyze_file** — Analyze a single file for technical debt issues.
- **get_debt_summary** — Get a quick summary of technical debt in a project.
- **get_sqale_metrics** — Get SQALE technical debt metrics including remediation time, debt ratio, and rating.
- **list_supported_languages** — List all programming languages supported by the analyzer.
- **get_recommendations** — Get prioritized recommendations for addressing technical debt.
- **get_issues_by_severity** — Get all issues of a specific severity level.
- **get_issues_by_category** — Get all issues of a specific category.
- **add_custom_rule** — Add a custom pattern-based tech debt rule.
- **remove_custom_rule** — Remove a custom rule by ID.
- **list_session_custom_rules** — List custom rules registered in this server session via add_custom_rule. Does NOT include customPatterns declared in .techdebtrc.json (those run inside analyze_project via AnalysisEngine but are not surfaced here). Renamed from list_custom_rules (TEC-51) for clarity; the old name is no longer registered.
- **execute_custom_rules** — Execute all custom rules against code or a file.
- **validate_custom_pattern** — Validate a custom pattern before adding it as a rule.
- **check_dependencies** — Analyze project dependencies across multiple package managers.
- **validate_config** — Validate a .techdebtrc.json configuration file for syntax and schema correctness.
- **get_vulnerability_report** — Generate an offline dependency report listing all project dependencies for vulnerability review. Note: actual CVE lookups require Phase 2b online integration.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "tech-debt-mcp": {
    "command": "npx",
    "args": ["-y","tech-debt-mcp@latest"]
  }
}
```

## Documentation

## What tech-debt-mcp MCP server does

tech-debt-mcp MCP server examines source files and project directories to identify technical debt across 14 languages: JavaScript, TypeScript, Python, Java, Swift, Kotlin, Objective-C, C++, C, C#, Go, Rust, Ruby, and PHP. Its checks cover code-quality patterns, maintainability concerns, security-related issues, and language-specific anti-patterns.

The server can calculate SQALE metrics and assign ratings on an A–E scale. It also produces prioritized recommendations and lets callers narrow results by severity or category. Swift projects receive additional checks for SwiftUI patterns, state management, memory leaks, view nesting, and concurrency issues.

Dependency inspection covers manifests from npm, pip, Maven and Gradle, Cargo, Go Modules, Composer, Bundler, NuGet, C and C++, and Swift ecosystems. A vulnerability report can be requested for a project, while configuration validation checks a project or a direct `.techdebtrc.json` path.

## How it works

The MCP tools accept either a project root or an individual file, depending on the operation. Project-level analysis supports summaries, SQALE measurements, recommendations, dependency checks, vulnerability reporting, and filtered issue queries. File-level operations analyze one source file or execute registered custom checks against it.

Custom rules use pattern-based checks with regular expressions. Rules can be added or removed for the current session, listed with `list_session_custom_rules`, and executed against a file. A pattern-validation tool helps check a custom rule before use. The implementation also validates custom regexes for ReDoS risks and escapes input used by SwiftUI checks.

Inline suppressions are supported for false positives through `// techdebt-ignore-next-line` and block-comment forms. Path traversal protection applies to tool and resource path inputs, and absolute paths are sanitized in error messages.

## Setup and configuration

Install the published package with an MCP client that supports local command-based servers. The documented command runs `npx -y tech-debt-mcp@latest`, so the client launches the package on demand. VS Code, Cursor, Claude Desktop, Claude Code, Windsurf, and JetBrains configuration examples are provided by the project. Claude Desktop can also use a release MCPB bundle with dependencies included and no runtime `npx` or internet requirement.

No required environment variables are documented. Projects may use a `.techdebtrc.json` file, which can be checked with `validate_config`. That tool accepts either the project root directory or a direct path to the configuration file.

## Tools and capabilities

The available operations include:

- Analyze a complete project or one file.
- Retrieve debt summaries and SQALE metrics.
- Get recommendations and filter issues by severity or category.
- List supported languages.
- Add, remove, list, validate, and execute session-scoped custom rules.
- Inspect dependencies and request vulnerability reports.
- Validate project configuration files.

The repository describes 16 MCP tools and support for 10 dependency ecosystems. Language checks are based on file extensions and include examples such as dynamic code execution, ignored errors, unsafe operations, empty exception handlers, deprecated APIs, and problematic state or memory patterns, depending on the language.

The project also documents security hardening measures, including path traversal prevention, safer regular-expression handling, escaped SwiftUI matching, sanitized path errors, and CodeQL scanning in its CI workflow.

_Full upstream README: https://allmcps.com/mcp/tech-debt-mcp/readme_