Tech Debt MCP v2.0.0 — Phase 2: Dependency Analysis & Config Validation

Breaking Changes

• src/index.ts refactored — the 882-line monolith has been replaced by a 16-line entry point delegating to src/server/ modules (setup.ts, handlers.ts, tools.ts, formatters.ts, configValidator.ts, dependencyHandlers.ts). Code importing internals will need to update paths.
• Version bump 1.1.0 → 2.0.0 — major version reflects the new dependency analysis subsystem and architectural refactor.

New MCP Tools (3 new, 16 total)

• check_dependencies — scans a project for package manifest files, parses dependencies across ecosystems, and returns a structured report splitting production vs development dependencies. Validates input is a directory, surfaces filesystem scan errors and parse failures.
• validate_config — validates .techdebtrc.json files for JSON syntax and schema correctness. Checks ignore, include, rules, severity, languageOverrides, and customPatterns fields. Guards against non-object top-level values (null, array, primitive). Reuses CustomRulesEngine.validatePattern() for custom pattern validation.
• get_vulnerability_report — generates an offline dependency inventory for vulnerability review. Lists all dependencies by ecosystem in tabular format. Accepts includeDev flag (default: false). Online CVE lookup planned for Phase 2b via OSV API.

New Dependency Parsers (10 ecosystems)

All parsers live under src/analyzers/dependencies/ with full test suites:

• npm (package.json) — production + dev dependencies with version parsing
• pip (requirements.txt, pyproject.toml, Pipfile) — supports PEP 508, extras, environment markers, editable installs, pyproject.toml [project] and Poetry [tool.poetry]
• Maven/Gradle (pom.xml, build.gradle, build.gradle.kts) — GAV coordinates, scope detection
• Cargo (Cargo.toml) — [dependencies], [dev-dependencies], [build-dependencies] with inline table support
• Go (go.mod) — require blocks with // indirect detection
• Composer (composer.json) — require + require-dev
• Bundler (Gemfile) — gem declarations with group-based dev detection
• NuGet (packages.config, Directory.Build.props, *.csproj) — PackageReference and legacy packages.config
• C/C++ (CMakeLists.txt, conanfile.txt, conanfile.py, vcpkg.json) — Conan, vcpkg, CMake FetchContent
• Swift (Package.swift, Podfile, Cartfile) — SPM .package(), CocoaPods, Carthage

Architecture Refactor

• src/index.ts: 882 lines → 16 lines (entry point only)
• src/server/setup.ts: McpServer instantiation and stdio transport wiring
• src/server/handlers.ts: all CallToolRequestSchema dispatch cases (~325 lines)
• src/server/tools.ts: centralized TOOL_DEFINITIONS array (16 tools)
• src/server/formatters.ts: output formatting helpers
• src/server/configValidator.ts: .techdebtrc.json validation logic
• src/server/dependencyHandlers.ts: check_dependencies + get_vulnerability_report handlers with recursive file discovery

Bug Fixes

• C# analyzer nesting — extracted checkDisposableType helper to reduce nesting depth in csharpAnalyzer.ts
• Debugger false positives — JS/TS analyzers now use lookbehind (?<!["'])debugger\b to reduce false positives from quoted pattern names
• Config validator — guards JSON.parse result against null/array/primitive before Object.keys()
• Config key sync — VALID_CONFIG_KEYS and VALID_RULE_KEYS now match the TechDebtConfig type (include, languageOverrides, maxParameters, minCommentRatio)
• .csproj parser — createDependencyParser() now returns NugetParser for .csproj files (was discovered but silently skipped)
• Report accuracy — "No package manifests" check uses packageFiles.length instead of filtered dependency count; parsed files with 0 filtered deps are no longer silently dropped
• console.error removed — production code no longer writes to stderr (pollutes MCP stdio transport)

New Dependency: toml@^3.0.0

Added for parsing Cargo.toml, pyproject.toml, and Pipfile.

Community & Docs

• CODE_OF_CONDUCT.md — Contributor Covenant v2.1
• CLAUDE.md — project conventions for AI-assisted development
• .techdebtrc.json — project-specific config (test exclusions, custom patterns)
• TECH_DEBT_SCAN.md — self-scan results with before/after comparison (101 → 81 issues, 3.4% → 2.9% debt ratio)
• Updated ARCHITECTURE.md, CONTRIBUTING.md, README.md, ROADMAP.md, CHANGELOG.md

Quality

• 311 tests (290 passing + 21 todo) across 21 suites
• SQALE Rating: A (2.9% debt ratio)
• 0 critical issues

Installation

npm install -g tech-debt-mcp@2.0.0

Documentation

See CHANGELOG.md for the full changelog.