Where there are numbers.
DataFlowBench is our own benchmark of how well a static analyzer follows data from a source to a sink. Each question is a small test program, half with a real flow and half with a near miss. It measures Bifrost, the open-source engine a SlopCop check runs, beside seven other analyzers, CodeQL and Semgrep Community Edition among them.
| Analyzer | Questions | Right | Wrong | No answer |
|---|---|---|---|---|
| Bifrost 0.15.1 | 886 | 527 | 1 | 358 |
| CodeQL 2.27.2 | 812 | 594 | 146 | 72 |
| Semgrep CE 1.181.0 | 746 | 132 | 22 | 592 |
The benchmark measures the engine on test programs, with sources and sinks it supplies. It is not a measurement of a SlopCop check, and it does not estimate accuracy on real projects.
SlopCop vs Semgrep
Side by side, with our benchmark of Bifrost and Semgrep Community Edition and when Semgrep is the better pick.
SlopCop vs CodeQL
Side by side, with our benchmark of Bifrost and CodeQL in eleven languages and when CodeQL is the better pick.
SlopCop and CodeRabbit.
| SlopCop | CodeRabbit | |
|---|---|---|
| What it is | Hosted static analysis of the change a coding agent makes. | Automated, context-aware code reviews that catch bugs, enforce standards and learn from a team’s feedback. |
| A finding comes from | A written rule, which the finding names. The service pins its rules, so a check run twice on the same code gives the same result. | An AI review of the change, which CodeRabbit says draws on more than 50 third-party linters and security analysis tools. |
| Where it runs | In the agent’s loop, from the CLI or over MCP, and on GitHub pull requests. | On pull requests on GitHub, GitLab, Azure DevOps and Bitbucket, in VS Code, Cursor, Windsurf and JetBrains IDEs, and from a CLI that works with Claude Code and Codex. |
| Charged by | The check. | The user (CodeRabbit’s pricing). |
Pick CodeRabbit when you want AI-written review comments on the lines of a change, a reviewer that adapts to your team’s preferences, or reviews on GitLab, Azure DevOps or Bitbucket and inside your IDE. A SlopCop check finds what static analysis can prove, and does not know whether your feature works.
No benchmark sets a SlopCop check beside CodeRabbit. Our blog tested five AI code reviewers on 95 pushes of 47 pull requests to one open-source project in November 2026, and CodeRabbit reported 38 of the 102 material findings the five made between them. A SlopCop check was not one of the five: our entry was Mjolnir, a separate open-source tool.
SlopCop and SonarQube.
| SlopCop | SonarQube | |
|---|---|---|
| What it is | Hosted static analysis of the change a coding agent makes. | The platform that verifies code, whether a developer or an AI agent wrote it, before it ships. It reviews every branch and pull request for bugs, maintainability issues and technical debt, and its quality gates decide what merges. |
| Languages | Thirteen. | More than 45. |
| Where it runs | On SlopCop’s hosted service, which keeps its own clone of a repository and reads the source without building or running it. | SonarQube Cloud is managed by Sonar. SonarQube Server is self-managed inside your perimeter, air-gapped included. |
| With coding agents | A skill and a Stop hook have Claude Code and Codex run a check and fix what it finds. Agents with no shell reach it over MCP. | Plugins, a CLI and an MCP server bring its checks into Claude Code, Cursor, Copilot and Codex as the agent writes. |
| Charged by | The check. | Lines of code (Sonar’s pricing). |
Pick SonarQube when code has to stay inside your own perimeter, for quality gates that record every check, for governance and compliance reporting across an organization, or for a language SlopCop does not cover.
No benchmark of ours covers SonarQube, so this page has no numbers for it.
SlopCop and your agent’s own review.
| SlopCop | The agent’s review | |
|---|---|---|
| What it is | A check by static-analysis rules, which the agent runs on its change. | The agent reviewing its own change, with no new tool: /code-review in Claude Code, and /review in the Codex CLI, which reviews uncommitted changes, a commit or a branch. |
| A finding comes from | A written rule and the line that raised it. A rule that can’t finish makes the check incomplete, never clean. | The model’s judgment of the change. Anthropic says Claude Code’s review looks for correctness bugs and, depending on the model and effort level, for reuse, simplification and efficiency cleanups. |
| Charged by | The check. | Claude Code’s review runs in your own session and counts toward your plan’s usage. |
Ask for the review when the question is one no rule describes, such as whether the change is correct for what you asked, or could be simpler. The two answer different questions, and an agent can run both.
What a SlopCop check is.
- Findings from rules
- The hosted check’s findings come from static-analysis rules, run by Bifrost, an open-source engine. Each names its rule, its severity, and the file and line. The guide to reading a report has the rest.
- What the change introduced
- A check reports the findings on the lines a change added or touched. Findings already in the code never fail it, and a rule that can’t finish makes the check incomplete, never clean.
- In the agent’s loop and on pull requests
- A skill and a Stop hook have Claude Code and Codex run a check and fix what it finds. The SlopCop GitHub App checks each push to a pull request.
- Priced by the check
- A workspace gets 1,000 free checks each calendar month, and each check after those costs $0.001. Repositories are free, and there is no per-seat price. Pricing has the credit packs.
Sources.
- How this page was checked
- Each statement about another product comes from that product’s own pages, listed here, as they read on the day given. Products change, so read their pages before you decide.
- CodeRabbit
- Read on 11 November 2026: docs.coderabbit.ai, www.coderabbit.ai, www.coderabbit.ai/
cli, docs.coderabbit.ai/ tools, www.coderabbit.ai/ pricing. - SonarQube
- Read on 11 November 2026: www.sonarsource.com/
products/ sonarqube, www.sonarsource.com/ solutions/ ai-code-verification, www.sonarsource.com/ plans-and-pricing. - Claude Code and Codex
- Read on 11 November 2026: code.claude.com/
docs/ en/ code-review-local, learn.chatgpt.com/ docs/ codex/ cli. - DataFlowBench
- Our own benchmark, version 0.9.2, released on 7 November 2026 and read on 12 November 2026: dataflowbench.slopcop.com. Its method, the frozen snapshot and the cases and raw evidence are public.
- Names
- Semgrep, CodeQL, CodeRabbit, SonarQube, Claude Code and Codex are trademarks of their owners. SlopCop is not affiliated with them, and none of them endorses this page.