return find_user(request.args["name"])What SlopCop catches.
- A search box that leaks your data
- What a visitor types ends up inside a database query.
- A failed save that looks like a success
- An error is caught and thrown away, so nothing reports the failure.
- A page that runs up your database bill
- A query sits inside a loop: one visit, one call for every row.
- A password shipped with your code
- A credential is written into the source, where anyone with the code can read it.
The problem isn’t always in the file you changed.
An input that looks harmless here can do harm three files later. SlopCop follows data through your code and shows your agent where the risk comes together.
return run_query(FIND_USER % name)return conn.execute(sql).fetchall()SlopCop reports one finding
A request parameter reached the query argument of Connection.execute(sql)
Fixed while your agent is still on the case.
Connect SlopCop to your coding agent. When a check finds a problem, the finding goes straight back to the agent, so it can fix it and check again. You’re never the middleman.
- Write
users.py
return run_query(FIND_USER % name) - Check
$ slopcop check
db.py:7 a request parameter reached the query - Fix
users.py, db.py
conn.execute(sql, (name,)) - Recheck
$ slopcop check
No new findings | Analysis complete
Thirteen languages.
- C
- C++
- C#
- Go
- Java
- JavaScript
- Kotlin
- PHP
- Python
- Ruby
- Rust
- Scala
- TypeScript
Coverage differs by language. Repositories on GitHub, GitLab.com and Bitbucket Cloud.
It isn’t another AI checking the AI.
SlopCop runs on Bifrost, an open-source static analysis engine that applies written rules the way a compiler does. There is no model in it, so there is nothing to guess.
- Same code, same answer
- Run the check twice and you get the same findings.
- Never a false all-clear
- A check that could not finish says incomplete, never clean.
- Only what the agent changed
- Problems already in your code are counted, and never fail the check.
- Every finding shows its proof
- The rule, the file, the line, and whether it is proven or only possible.
Safe to point at private code.
- Read-only
- It reads the repositories you choose. It cannot change them.
- Never runs your code
- Nothing is built and nothing is executed.
- No language model
- A check never sends your code to one.
Case notes.
Read the blogJonathan Ellis
A cheapskate's guide to coding with expensive models
It seems straightforward that you should be able to save money by having a smart, expensive model delegate straightforward tasks to cheaper models, and this is in fact the case. With Mjolnir , you can even do this cross-provider; here's price vs performance o…
Jonathan Ellis
Comparing Jev, Gemini, and OpenAI decision models
One of the ways that Mjolnir makes your agents smarter is by delivering relevant github events to them so they stay looped in to what's happening with the rest of the team. Mj github notifications Some of these can be done deterministically: activity on your…
David Baker Effendi
Code intelligence has escaped the code
Bifrost v0.14.4 correlates Java configuration reads with entries in named .properties files, and reports ambiguous or incomplete matches as such.
Jonathan Ellis
You're paying too much for code review
Five AI code reviewers compared on 95 pushes of 47 pull requests: material findings, false positives and cost per review.
The people behind it.
Jonathan Ellis
Founder and CEO. Co-founder and former CTO of DataStax, and former chair of the Apache Cassandra project.
David Baker Effendi
PhD in computer science with published research in static analysis. He builds Bifrost, and helped maintain Joern.
Ryan Svihla
Built diagnostics for distributed systems at DataStax and Dremio. He builds SlopCop’s agent tools and runs its infrastructure.
Rules for your own codebase
We write rules for the mistakes that matter in your code, and set them up with your team on a call. How custom rules work