Codebase Health Score

One number from 0 to 100, deducted from a perfect start across six measured dimensions: dead code, zombie code, average file size, test coverage, secrets exposure and duplicate code. It is a summary of scans you have already run, not a scan of its own.

Where to find it

The Health Score is not a tab. It is the headline of the Dashboard tab — a metric card at the top, and a full per-dimension breakdown below the risk files. The MCP server exposes the same number through get_health_score and get_repo_health, which share one implementation with the dashboard so the two can never disagree.

The formula

The score starts at 100 and each dimension subtracts from it. Every deduction is capped, so no single dimension can sink the whole score:

• Dead code ratio — up to 30 points, in proportion to flagged files.
• Zombie code ratio — up to 20 points, in proportion to zombie flags.
• Average file size — a flat 10 points once the average passes 300 lines.
• Test coverage — a flat 10 points when fewer than 10% of source files have a matching test.
• Secrets exposure — up to 15 points, weighted by severity.
• Duplicate code — up to 15 points, in proportion to the duplicated share.

The worst possible total is 100 points of deductions, so the score floors at 0.

On the dashboard

The six dimensions

Dead code and zombie code

Both are ratios of flags to indexed files, and both count only findings you can actually see — a dismissed, suppressed or unverifiable flag is excluded, exactly as it is on the tabs. That is deliberate: the tile and the tab must never disagree.

Average file size

Measured as the highest line number reached in each file, not the sum of its indexed chunks — chunks overlap by ten lines, and summing them inflated every file by about 17%. Over a 300-line average the dimension deducts a flat 10.

Test coverage

A structural estimate: the share of source files that have a matching test file (*.test.*, *.spec.*, or a __tests__ sibling). Mapnostics never runs your suite, so this is a proxy for coverage and not statement coverage.

Secrets exposure

Weighted by severity — 8 points for each critical finding, 5 for high, 2 for medium, 1 for low — then capped at 15, so a noisy scan cannot swallow the score.

Duplicate code

Every indexed chunk is hashed by its normalised content. A hash that appears in two or more files counts as duplicated, and the deduction is proportional to the duplicated share, capped at 15.

Grades

• A — 80 to 100. The dashboard reads "Good — minor issues detected".
• B — 60 to 79. "Moderate — action recommended".
• C — 40 to 59. "Poor — immediate attention needed".
• D — below 40. Same message, deeper hole.

Improving your score

• Start with dead code — it is the biggest single deduction at 30 points, and the easiest to verify.
• Add a test file for the most-imported files. Coverage is a flat 10 points, and the threshold is only 10%.
• Rotate and remove secrets. Each critical finding costs 8 points on its own.
• Split files over 300 lines — that dimension is all-or-nothing, so one push can recover the full 10.