DebtZero: AI Technical Debt Resolver

title: "DebtZero: AI Technical Debt Resolver" description: "Scan, prioritize, and resolve technical debt in VS Code"

Overview

Find technical debt in your codebase before it finds you.

This extension scans your workspace for 48 catalogued patterns across seven categories of technical debt, from hardcoded secrets and SQL injection risks to circular imports, god modules, and missing tests, then ranks what it finds by business impact and gives you a prioritised plan.

Detection is deterministic static analysis. AI assistance is strictly opt-in and never runs without your consent.

Features

Health score and dashboard

Every scan produces a health score out of 100, a breakdown by debt category, and a sortable dashboard of every finding. Open it with Tech Debt: Show Dashboard.

One-click fixes

Findings with a safe, mechanical fix are corrected in place: unused imports, hard-pinned versions, missing API versioning, and more. Nothing is applied silently that you cannot reverse: Tech Debt: Undo All Auto-Fixes restores every file changed during the session.

Optional AI-assisted fixes

Some debt has no mechanical fix. When you enable Copilot assistance, the extension can propose supported single-file changes and always shows you a diff to accept or reject before anything is written. Deterministic fixes run first and appear in Source Control before AI work begins. Unattended AI application is disabled. Disabled by default.

God-module splits, circular imports, shared-logic extraction, layering moves, and pagination contracts require coordinated repository changes. DebtZero labels these findings Multi-file/manual and never sends them to its single-file AI fixer.

Impact and sprint planning

Findings are scored by category weight, severity, and confidence, with a boost when the same pattern recurs across multiple services, a signal that the issue is systemic rather than local. The Impact & Plan tab turns that into a ranked, effort-estimated shortlist.

Dependency vulnerability checks

Dependencies are checked against the OSV.dev public vulnerability database. This is a deterministic lookup, not an AI judgement.

Quick start

Install the extension.
Open a folder or workspace.
Run Tech Debt: Scan Workspace from the Command Palette (Ctrl+Shift+P).

The dashboard opens automatically after the first scan. The Tech Debt icon in the Activity Bar shows your health score and findings tree.

Commands

Command	Description
`Tech Debt: Scan Workspace for Tech Debt`	Full scan of every folder in the workspace
`Tech Debt: Scan Current File for Tech Debt`	Re-scan just the active file
`Tech Debt: Show Tech Debt Dashboard`	Open the dashboard
`Tech Debt: Show Health Score`	Show the current score
`Tech Debt: Review & Fix Supported Issues`	Apply local fixes, then review AI diffs
`Tech Debt: Undo All Auto-Fixes`	Revert every fix applied this session
`Tech Debt: Filter Findings by Category`	Narrow the findings list
`Tech Debt: Show Pattern Catalog Coverage`	List all detectable patterns
`Tech Debt: Enable Copilot-Assisted AI Fixes (Consent)`	Opt in to AI-generated fixes
`Tech Debt: Enable Copilot Review During Scans (Consent)`	Opt in to scan-time AI review
`Tech Debt: Send Feedback`	Report a false positive or suggestion

Settings

Setting	Default	Description
`techDebt.scanOnSave`	`true`	Re-scan a file when you save it
`techDebt.scheduledScanInterval`	`60`	Minutes between background full scans (`0` disables)
`techDebt.excludePaths`	Dependencies, virtual environments, generated output	Glob patterns to skip
`techDebt.maxFilesToScan`	`15000`	Upper bound on files read per scan
`techDebt.severityThreshold`	`info`	Minimum severity to report
`techDebt.enableCveScanning`	`true`	Check dependencies against OSV.dev
`techDebt.enableCopilotReview`	`false`	Opt in to reviewed single-file AI proposals
`techDebt.enableCopilotScanReview`	`false`	Opt in to up to five AI review calls per full scan

If a scan hits maxFilesToScan, the result is reported as partial. A health score from a truncated scan understates real debt, so it is never presented as a complete picture. Re-running the same capped workspace does not continue with a next batch. Raise the limit, narrow the workspace, or adjust excluded paths.

What it detects

Category	Examples
Security	Hardcoded secrets, SQL injection, XSS, command injection, insecure deserialization, weak cryptography, path traversal, permissive CORS, missing security headers
Dependency	Known CVEs, deprecated libraries, version fragmentation, hard-pinned versions, transitive bloat
Architectural	Circular imports, god modules, layering violations, shared-library coupling, missing dependency injection, inconsistent error handling and config patterns
Inefficient patterns	N+1 queries, unbounded queries, missing connection pooling, missing caching, repeated computation in loops, redundant API calls
Code	Duplicated logic, dead code, unused imports, long methods, deep nesting, blocking calls in async code
Infrastructure	Dockerfile drift, inconsistent build configuration
Design and API	Inconsistent endpoint patterns, missing API versioning, missing response models

Run Tech Debt: Show Pattern Catalog Coverage for the full list.

Continuous integration

The same analysis engine ships as a headless CLI, so local results and pipeline results always agree:

node out/cli/scanCli.js <repoPath> --format markdown --fail-on error

Useful flags: --fix (mechanical fixes only), --changed-files (scope output to a pull request), --format json|markdown, --severity-threshold, --no-cve.

AI-assisted fixes are structurally unavailable in the CLI. Automation applies deterministic fixes only, never an unreviewed AI edit.

Data and privacy

Dependency scanning sends package names and versions to OSV.dev. Set techDebt.enableCveScanning to false for fully offline use.
Copilot assistance sends the relevant file contents to GitHub Copilot, and only when you have explicitly opted in. It is off by default.
All other analysis runs locally. Your source code is not otherwise transmitted.

Requirements

VS Code 1.118.0 or later
GitHub Copilot (optional, only for AI-assisted fixes)

Known limitations

Analysis is regex and line-based rather than full AST parsing, so unusual formatting can cause a missed or spurious finding. Use Send Feedback to report these.
AI-assisted fixes modify one existing file. Coordinated refactors are marked Multi-file/manual and are excluded from all fix commands until an atomic multi-file engine with repository tests exists.
AI proposals are rejected when they add imports for nonexistent local modules, introduce arbitrary hard-coded row caps, remove embedded script or style boundaries, or truncate a large file.
AI changes always require file-diff approval. Automated validation cannot prove behavioral correctness for changes such as authentication caching.
missing-tests uses a test-to-source file ratio, not a real coverage tool.

Anjali Sadhukhan Dev