A Nightly Tech-Debt Scan That Costs Nothing

The solo founder wakes up to 14 new commits. All from AI.

The code works. Tests pass. But something feels off.

Technical debt grows quietly when generation is cheap. Comments say TODO: refactor this. Functions have names like helper_2_final. Nobody owns it.

Last week, I built a small watchdog for that. It scans the repository every night, asks an LLM to summarize risky patterns, and posts the result to a private Telegram bot. The bill stays at zero.

Here is the whole approach.

The problem with AI-heavy weeks

AI tools produce more code per hour. Reviews get slower. Debt compounds faster than humans can track.

Most solo devs cannot afford a hosted code-analysis service. But a free-tier server plus a free-model API can cover the basics.

I used MonkeyCode's free model access and free server option for this experiment. No paid plan. No credit card.

The tool is deliberately simple. It does not replace a real review. It highlights suspicious growth before it becomes invisible.

How the scanner works

Each night, a cron job clones the repo and runs three steps:

1. Extract TODO, FIXME, HACK, and XXX comments with file paths.
2. Collect the last 30 commits and their diffs.
3. Send a compact prompt to the LLM and ask for a risk list.

The prompt is the core artifact. Here is the template I use:

You are a conservative code reviewer. Analyze the diff below.
List only concrete risks: duplicated logic, dead code, security smells, or broken abstractions.
For each risk, give the file, one line, and a one-sentence fix.
Do not praise the code. Be terse.

The output goes to a markdown file and optionally to Telegram.

The server script

I wrote the scraper in Python. It runs on the free server provided by MonkeyCode. The full script is under 120 lines.

A reduced version looks like this:

import subprocess
from pathlib import Path

REPO = Path("/tmp/repo")
MARKERS = ["TODO", "FIXME", "HACK", "XXX"]


def clone_or_pull():
    if REPO.exists():
        subprocess.run(["git", "-C", str(REPO), "pull"], check=True)
    else:
        subprocess.run(["git", "clone", "https://example.com/your/repo.git", str(REPO)], check=True)


def find_markers():
    hits = []
    for file in REPO.rglob("*.py"):
        for i, line in enumerate(file.read_text(errors="ignore").splitlines(), 1):
            if any(m in line.upper() for m in MARKERS):
                hits.append(f"{file}:{i}: {line.strip()}")
    return hits[:100]


def build_prompt(commit_log, markers):
    return f"""
REPO: solo-project
COMMITS:\n{commit_log}\n\nMARKERS:\n{chr(10).join(markers) or 'none'}\n\nFollow the reviewer instructions.\n"""

The same script calls the model endpoint, parses the response, and writes report.md. Then a cron rule runs it at 2 AM.

0 2 * * * cd /path/to/scanner && python run.py

What the report looks like

After three nights, the report caught issues I had missed:

• A function parse_config that existed in two files with different edge-case behavior.
• An unused database migration generated by an AI refactor.
• A FIXME left in the login flow for six days.

None of these broke the build. All of them were time bombs.

Why this setup matters for indie devs

A solo founder cannot hire a review team. But they can automate a first-pass triage.

The free server removes the hosting cost. The free model removes the API cost. The only expense is the founder's attention each morning.

This fits a specific workflow: shipping daily, keeping the bill at zero, and accepting the limits of a free tier.

Limits you should accept

This is not a replacement for human review. The LLM can hallucinate file paths or overstate risks.

The scan only works on repositories that fit within the free model's context window. My prompt stays under 4,000 tokens, but a monorepo will blow up.

Also, the free server has limited CPU and storage. It handles a small Python script, but not a full CI runner.

I do not use this for code that handles customer data or payment flows. The report stays on private infrastructure, yet the model call still sends a diff to a third party. Be careful with proprietary code.

Who should not use this

If your company requires strict data isolation, skip this pattern. If your repo has thousands of files, prefilter before asking an LLM.

If you have a real QA team, you do not need a nightly bot to point at comments.

But if you are one developer shipping fast on a budget, a two-line cron job plus a free model is enough to sleep better.

Disclosure: This article was prepared as part of MonkeyCode's product outreach.

The full scanner is on my public repo. Fork it, swap in your target paths, and watch your debt surface at 2 AM.