DebtZero: AI Technical Debt Resolver
Find technical debt in your codebase before it finds you.
This extension scans your workspace for 48 catalogued patterns across seven
categories of technical debt — from hardcoded secrets and SQL injection risks to
circular imports, god modules, and missing tests — then ranks what it finds by
business impact and gives you a prioritised plan.
Detection is deterministic static analysis. AI assistance is strictly opt-in and
never runs without your consent.
Features
Health score and dashboard
Every scan produces a health score out of 100, a breakdown by debt category, and
a sortable dashboard of every finding. Open it with Tech Debt: Show Dashboard.
One-click fixes
Findings with a safe, mechanical fix are corrected in place — unused imports,
hard-pinned versions, missing API versioning, and more. Nothing is applied
silently that you cannot reverse: Tech Debt: Undo All Auto-Fixes restores
every file changed during the session.
Optional AI-assisted fixes
Some debt has no mechanical fix. When you enable Copilot assistance, the
extension falls back to Copilot for those cases and always shows you a diff to
accept or reject before anything is written. Disabled by default.
Impact and sprint planning
Findings are scored by category weight, severity, and confidence, with a boost
when the same pattern recurs across multiple services — a signal that the issue
is systemic rather than local. The Impact & Plan tab turns that into a
ranked, effort-estimated shortlist.
Dependency vulnerability checks
Dependencies are checked against the OSV.dev public
vulnerability database. This is a deterministic lookup, not an AI judgement.
Quick start
- Install the extension.
- Open a folder or workspace.
- Run Tech Debt: Scan Workspace from the Command Palette (
Ctrl+Shift+P).
The dashboard opens automatically after the first scan. The Tech Debt icon in
the Activity Bar shows your health score and findings tree.
Commands
| Command |
Description |
Tech Debt: Scan Workspace for Tech Debt |
Full scan of every folder in the workspace |
Tech Debt: Scan Current File for Tech Debt |
Re-scan just the active file |
Tech Debt: Show Tech Debt Dashboard |
Open the dashboard |
Tech Debt: Show Health Score |
Show the current score |
Tech Debt: Review & Fix All Auto-fixable Issues |
Step through fixes with accept/skip |
Tech Debt: Undo All Auto-Fixes |
Revert every fix applied this session |
Tech Debt: Filter Findings by Category |
Narrow the findings list |
Tech Debt: Show Pattern Catalog Coverage |
List all detectable patterns |
Tech Debt: Enable Copilot-Assisted Review & AI Fix (Consent) |
Opt in to AI assistance |
Tech Debt: Send Feedback |
Report a false positive or suggestion |
Settings
| Setting |
Default |
Description |
techDebt.scanOnSave |
true |
Re-scan a file when you save it |
techDebt.scheduledScanInterval |
60 |
Minutes between background full scans (0 disables) |
techDebt.excludePaths |
node_modules, venv, .git, out, dist |
Glob patterns to skip |
techDebt.maxFilesToScan |
15000 |
Upper bound on files read per scan |
techDebt.severityThreshold |
info |
Minimum severity to report |
techDebt.enableCveScanning |
true |
Check dependencies against OSV.dev |
techDebt.enableCopilotReview |
false |
Opt in to Copilot-assisted review and fixes |
If a scan hits maxFilesToScan, the result is reported as partial — a health
score from a truncated scan understates real debt, so it is never presented as a
complete picture.
What it detects
| Category |
Examples |
| Security |
Hardcoded secrets, SQL injection, XSS, command injection, insecure deserialization, weak cryptography, path traversal, permissive CORS, missing security headers |
| Dependency |
Known CVEs, deprecated libraries, version fragmentation, hard-pinned versions, transitive bloat |
| Architectural |
Circular imports, god modules, layering violations, shared-library coupling, missing dependency injection, inconsistent error handling and config patterns |
| Inefficient patterns |
N+1 queries, unbounded queries, missing connection pooling, missing caching, repeated computation in loops, redundant API calls |
| Code |
Duplicated logic, dead code, unused imports, long methods, deep nesting, blocking calls in async code |
| Infrastructure |
Dockerfile drift, inconsistent build configuration |
| Design and API |
Inconsistent endpoint patterns, missing API versioning, missing response models |
Run Tech Debt: Show Pattern Catalog Coverage for the full list.
Continuous integration
The same analysis engine ships as a headless CLI, so local results and pipeline
results always agree:
node out/cli/scanCli.js <repoPath> --format markdown --fail-on error
Useful flags: --fix (mechanical fixes only), --changed-files (scope output to
a pull request), --format json|markdown, --severity-threshold, --no-cve.
AI-assisted fixes are structurally unavailable in the CLI. Automation applies
deterministic fixes only — never an unreviewed AI edit.
Data and privacy
- Dependency scanning sends package names and versions to OSV.dev. Set
techDebt.enableCveScanning to false for fully offline use.
- Copilot assistance sends the relevant file contents to GitHub Copilot, and
only when you have explicitly opted in. It is off by default.
- All other analysis runs locally. Your source code is not otherwise transmitted.
Requirements
- VS Code 1.118.0 or later
- GitHub Copilot — optional, only for AI-assisted fixes
Known limitations
- Analysis is regex and line-based rather than full AST parsing, so unusual
formatting can cause a missed or spurious finding. Use Send Feedback to
report these.
- AI-assisted fixes are scoped to a single file. Debt needing coordinated
multi-file changes — circular imports, duplicated logic extraction — may only
get a partial fix, which is exactly why the diff is shown before applying.
missing-tests uses a test-to-source file ratio, not a real coverage tool.
License
MIT © 2026 Anjali Sadhukhan
