What SlopCop catches.

A search box that leaks your data: What a visitor types ends up inside a database query.
A failed save that looks like a success: An error is caught and thrown away, so nothing reports the failure.
A page that runs up your database bill: A query sits inside a loop: one visit, one call for every row.
A password shipped with your code: A credential is written into the source, where anyone with the code can read it.

Four examples from a longer list. It also covers data races, crashes on missing values and code that runs whatever it is handed.

The problem isn’t always in the file you changed.

An input that looks harmless here can do harm three files later. SlopCop follows data through your code and shows your agent where the risk comes together.

routes.pywhere it comes in

return find_user(request.args["name"])

users.pywhere it is passed on

return run_query(FIND_USER % name)

db.pywhere it does harm

return conn.execute(sql).fetchall()

SlopCop reports one finding

A request parameter reached the query argument of Connection.execute(sql)
Certainty: definite; proof: proven

A detective in a hat and trench coat, seen from behind, stands back with one hand in his pocket and holds a magnifying glass up in front of him.

Fixed while your agent is still on the case.

Connect SlopCop to your coding agent. When a check finds a problem, the finding goes straight back to the agent, so it can fix it and check again. You’re never the middleman.

Writeusers.py return run_query(FIND_USER % name)
Check$ slopcop check db.py:7 a request parameter reached the query
Fixusers.py, db.py conn.execute(sql, (name,))
Recheck$ slopcop check No new findings | Analysis complete

A riveted tin robot types at a desk under a lamp. A detective in a hat and trench coat leans over its shoulder, one hand on it, reading the page in the typewriter.

Thirteen languages.

C
C++
C#
Go
Java
JavaScript
Kotlin
PHP
Python
Ruby
Rust
Scala
TypeScript

Coverage differs by language. Repositories on GitHub, GitLab.com and Bitbucket Cloud.

It isn’t another AI checking the AI.

SlopCop runs on Bifrost, an open-source static analysis engine that applies written rules the way a compiler does. There is no model in it, so there is nothing to guess.

Same code, same answer: Run the check twice and you get the same findings.
Never a false all-clear: A check that could not finish says incomplete, never clean.
Only what the agent changed: Problems already in your code are counted, and never fail the check.
Every finding shows its proof: The rule, the file, the line, and whether it is proven or only possible.