return find_user(request.args["name"])What SlopCop catches.
- A search box that leaks your data
- What a visitor types ends up inside a database query.
- A failed save that looks like a success
- An error is caught and thrown away, so nothing reports the failure.
- A page that runs up your database bill
- A query sits inside a loop: one visit, one call for every row.
- A password shipped with your code
- A credential is written into the source, where anyone with the code can read it.
Four examples from a longer list. It also covers data races, crashes on missing values and code that runs whatever it is handed.
The problem isn’t always in the file you changed.
An input that looks harmless here can do harm three files later. SlopCop follows data through your code and shows your agent where the risk comes together.
return run_query(FIND_USER % name)return conn.execute(sql).fetchall()SlopCop reports one finding
A request parameter reached the query argument of Connection.execute(sql)
Certainty: definite; proof: proven
Fixed while your agent is still on the case.
Connect SlopCop to your coding agent. When a check finds a problem, the finding goes straight back to the agent, so it can fix it and check again. You’re never the middleman.
- Write
users.py
return run_query(FIND_USER % name) - Check
$ slopcop check
db.py:7 a request parameter reached the query - Fix
users.py, db.py
conn.execute(sql, (name,)) - Recheck
$ slopcop check
No new findings | Analysis complete
Thirteen languages.
- C
- C++
- C#
- Go
- Java
- JavaScript
- Kotlin
- PHP
- Python
- Ruby
- Rust
- Scala
- TypeScript
Coverage differs by language. Repositories on GitHub, GitLab.com and Bitbucket Cloud.
It isn’t another AI checking the AI.
SlopCop runs on Bifrost, an open-source static analysis engine that applies written rules the way a compiler does. There is no model in it, so there is nothing to guess.
- Same code, same answer
- Run the check twice and you get the same findings.
- Never a false all-clear
- A check that could not finish says incomplete, never clean.
- Only what the agent changed
- Problems already in your code are counted, and never fail the check.
- Every finding shows its proof
- The rule, the file, the line, and whether it is proven or only possible.
Safe to point at private code.
- Read-only
- It reads the repositories you choose. It cannot change them.
- Never runs your code
- Nothing is built and nothing is executed.
- No language model
- A check never sends your code to one.
Case notes.
Read the blogDavid Baker Effendi
Code intelligence has escaped the code
A surprising amount of program behavior is defined by what is outside the program. Database URLs, feature flags, and library settings sit in configuration files or environment variables, while the code reading them may make some half-assed assumptions on what…
Jonathan Ellis
You're paying too much for code review
I wrote in August that humans shouldn't spend their time reading code anymore. (TLDR: the opportunity cost isn't worth it.) That doesn't mean that you should dispense with code review entirely. It just means that you should have agents perform the reviews (as…
David Baker Effendi
Catching Resources Held Across Async Suspension
An asynchronous function can release every resource before it finishes and still hold one at the wrong time. Borrow a connection from a small pool, then wait for an unrelated network request, and that connection remains occupied while the function is paused.…
Jonathan Ellis
Infrastructure for Agentic Rust
I spent most of my career in managed-runtime languages like Java and Python, so coming to Rust presented a few new land mines for me. I'm now about six months into primarily writing code in Rust, or more accurately, causing code to be authored in Rust, and
The people behind it.
Jonathan Ellis
Founder and CEO. Co-founder and former CTO of DataStax, and former chair of the Apache Cassandra project.
David Baker Effendi
PhD in computer science with published research in static analysis. He builds Bifrost, and helped maintain Joern.
Ryan Svihla
Built diagnostics for distributed systems at DataStax and Dremio. He builds SlopCop’s agent tools and runs its infrastructure.
Rules for your own codebase
We write rules for the mistakes that matter in your code, and set them up with your team on a call.