tech-debt-scan

Tech Debt Scan

Analyse a codebase for technical debt across five domains. Produce a scored report, a prioritised remediation backlog, and an executive summary.

Read references/scoring-rubric.md before scoring any domain.

---

Step 1 — Gather Inputs

Ask for:

1. ADO connection — org / project / repo / branch + PAT (Code: Read scope)
2. Tech stack hint (optional) — e.g. ".NET 8, React, Azure SQL"
3. Scope (optional) — specific folders or modules to focus on

If the user pastes a file tree, dependency file, or code samples instead, work from that.

---

Step 2 — Fetch Repository Structure

GET https://dev.azure.com/{org}/{project}/_apis/git/repositories/{repo}/items
    ?scopePath=/&recursionLevel=Full&api-version=7.1
Authorization: Basic base64(:{PAT})

Prioritise fetching content for: *.csproj · package.json · pom.xml · requirements.txt · Dockerfile · azure-pipelines.yml · appsettings*.json · .env* · README.md · Program.cs / app.py / index.js (entry points) · up to 10 source files across different modules · any *test* folders.

Skip binary files. Cap at ~30 file reads for large repos.

---

Step 3 — Score Five Domains

Read references/scoring-rubric.md for the full signal list and weights.

Domains (0–100, higher = more debt):

1. Architecture & Design — structure, coupling, EOL frameworks, missing IaC
2. Code Quality & Complexity — god classes, missing error handling, TODOs, no linting
3. Security & Compliance — secrets in code, no secrets management, HTTP endpoints, missing SAST
4. Data & Integration — hardcoded URLs, no retry patterns, mixed data access, no API spec
5. Testing & Observability — no tests, no logging framework, no health checks, no pipeline test step

Per domain, produce:

• Score (0–100) + severity: Low 0–30 / Medium 31–60 / High 61–80 / Critical 81–100
• Top 3 findings with file path evidence
• Confidence: High (direct evidence) / Medium (structural inference) / Low (inferred from absence)