Log inSubmit server
Tech Debt MCP logo

Tech Debt MCP

Analyzes technical debt, security issues, dependencies, and SQALE metrics across 14 programming languages.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install Tech Debt MCP

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "tech-debt-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "tech-debt-mcp@latest"
      ]
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

Automated check passed— started and listed 16 tools correctly (23d ago).

Overview

tech-debt-mcp MCP server analyzes local projects and source files for technical debt, security issues, maintainability problems, and dependency risks. It exposes MCP tools for project analysis, SQALE metrics, severity and category filtering, recommendations, configuration validation, and custom rules. Use it when an AI coding client needs structured findings from a multi-language codebase. It runs as a local npm package through standard MCP client configuration.

Use cases

  • Analyze a multi-language repository for technical debt
  • Review SQALE ratings before a maintenance sprint
  • Inspect dependency manifests and vulnerability findings
  • Validate custom rules and project configuration

Key features

  • Supports analysis across 14 programming languages
  • Calculates SQALE metrics and ratings
  • Checks dependencies across 10 ecosystems
  • Supports session-scoped regex custom rules
  • Filters findings by severity or category
  • Validates .techdebtrc.json configuration

Tools16

What Tech Debt MCP lets your agent do. Expand a tool for its parameters.

Verified live~1.6k tokens of context

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked Today

Recent health check succeeded.

20/24 checks healthy over the last 90d

What it can do

From the 16 tools this server returned when we ran it; 16 declare their own safety hints.

Runs commands · 1Can delete or modify data · 2Read-only tools · 13
Network at startup3 connections
Files written at startupNone
Install scriptsprepare
npm provenanceSigned build
Package age250 days
Maintainers1

Observed 2026-10-16 in an isolated sandbox. A description of reach, not a security audit.

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 5d ago via OSV.dev · tech-debt-mcp@latest (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars7Stargazers on the source repository.
Last commit3mo agoMost recent push to the default branch.
Availability100%Our rolling endpoint + install checks that succeeded.
Install checkPassedOur sandbox started it and listed its tools.
Tools exposed16Callable tools this server registers over MCP.
Directory activity1 viewsConfig copies, upvotes, and views on AllMCPs.

How Tech Debt MCP works

What tech-debt-mcp MCP server does

tech-debt-mcp MCP server examines source files and project directories to identify technical debt across 14 languages: JavaScript, TypeScript, Python, Java, Swift, Kotlin, Objective-C, C++, C, C#, Go, Rust, Ruby, and PHP. Its checks cover code-quality patterns, maintainability concerns, security-related issues, and language-specific anti-patterns.

The server can calculate SQALE metrics and assign ratings on an A–E scale. It also produces prioritized recommendations and lets callers narrow results by severity or category. Swift projects receive additional checks for SwiftUI patterns, state management, memory leaks, view nesting, and concurrency issues.

Dependency inspection covers manifests from npm, pip, Maven and Gradle, Cargo, Go Modules, Composer, Bundler, NuGet, C and C++, and Swift ecosystems. A vulnerability report can be requested for a project, while configuration validation checks a project or a direct .techdebtrc.json path.

How it works

The MCP tools accept either a project root or an individual file, depending on the operation. Project-level analysis supports summaries, SQALE measurements, recommendations, dependency checks, vulnerability reporting, and filtered issue queries. File-level operations analyze one source file or execute registered custom checks against it.

Custom rules use pattern-based checks with regular expressions. Rules can be added or removed for the current session, listed with list_session_custom_rules, and executed against a file. A pattern-validation tool helps check a custom rule before use. The implementation also validates custom regexes for ReDoS risks and escapes input used by SwiftUI checks.

Inline suppressions are supported for false positives through // techdebt-ignore-next-line and block-comment forms. Path traversal protection applies to tool and resource path inputs, and absolute paths are sanitized in error messages.

Setup and configuration

Install the published package with an MCP client that supports local command-based servers. The documented command runs npx -y tech-debt-mcp@latest, so the client launches the package on demand. VS Code, Cursor, Claude Desktop, Claude Code, Windsurf, and JetBrains configuration examples are provided by the project. Claude Desktop can also use a release MCPB bundle with dependencies included and no runtime npx or internet requirement.

No required environment variables are documented. Projects may use a .techdebtrc.json file, which can be checked with validate_config. That tool accepts either the project root directory or a direct path to the configuration file.

Tools and capabilities

The available operations include:

  • Analyze a complete project or one file.
  • Retrieve debt summaries and SQALE metrics.
  • Get recommendations and filter issues by severity or category.
  • List supported languages.
  • Add, remove, list, validate, and execute session-scoped custom rules.
  • Inspect dependencies and request vulnerability reports.
  • Validate project configuration files.

The repository describes 16 MCP tools and support for 10 dependency ecosystems. Language checks are based on file extensions and include examples such as dynamic code execution, ignored errors, unsafe operations, empty exception handlers, deprecated APIs, and problematic state or memory patterns, depending on the language.

The project also documents security hardening measures, including path traversal prevention, safer regular-expression handling, escaped SwiftUI matching, sanitized path errors, and CodeQL scanning in its CI workflow.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about Tech Debt MCP

tech-debt-mcp is an MCP server that connects AI coding clients to local project files and dependency manifests for technical-debt analysis. Its main tools analyze projects and files, calculate SQALE metrics, report vulnerabilities, check dependencies, provide recommendations, filter issues, validate configuration, and manage session custom rules.

Install it by configuring your MCP client to run `npx -y tech-debt-mcp@latest`. The project provides setup commands or JSON examples for VS Code, Cursor, Claude Desktop, Claude Code, Windsurf, and JetBrains. Claude Desktop users can also install a release MCPB bundle.

It supports JavaScript, TypeScript, Python, Java, Swift, Kotlin, Objective-C, C++, C, C#, Go, Rust, Ruby, and PHP. Use `list_supported_languages` to retrieve the supported-language list through MCP.

Add a session rule with `add_custom_rule`, validate its pattern with `validate_custom_pattern`, and run it against a file with `execute_custom_rules`. You can remove rules with `remove_custom_rule` and inspect only the session-registered rules with `list_session_custom_rules`.

Yes, Cursor is documented as a supported client. Configure it to run `npx -y tech-debt-mcp@latest`, either with the provided command or an MCP configuration entry.

Related MCP servers

All in Developer Tools All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewTech Debt MCP AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/tech-debt-mcp?style=directory)](https://allmcps.com/mcp/tech-debt-mcp)
HTML Embed
<a href="https://allmcps.com/mcp/tech-debt-mcp"><img src="https://allmcps.com/api/badge/tech-debt-mcp?style=directory" alt="Tech Debt MCP on AllMCPs" /></a>