Your coding agent runs slopcop
Claude Code, Codex, opencode, or anything with a shell. The bundled skill tells it how.
SlopCop documentation
Catch what your agent wrote, before you push.
SlopCop checks a change with static analysis that proves its findings, from inside your coding agent's loop. These docs cover the slopcop CLI, the agents it runs in, the hosted check service, and the web app.
$ slopcop
orders/ExportServlet.java:48 definite · error
request parameter reaches SQL text
ID: 0f8fad5b-d9cb-469f-a165-70867728950e
bifrost.security.java.servlet-parameter-to-jdbc:
req.getParameter("q") reaches Statement.executeQuery
through OrderQuery.build (OrderQuery.java:21)
1 new finding across 1 file(s); 72 already in the code
Analysis complete
$ echo $?
1How a check works
One command, one request, one report.
There is no local analyzer. The CLI sends one git patch to the hosted service, the service applies it to your base commit and runs Bifrost over the files the change writes, and your agent reads the result.
Your coding agent runs
The CLI diffs the working tree
From the merge base with your upstream branch: unpushed commits, unstaged edits, untracked files.
Its own clone, Bifrost on top
The patch is applied at the base commit. Your code is read, never run, and never sent to a language model.
New findings fail the check
The agent fixes them and checks again until none are left. Findings already in the code never fail it.
Start here
Pick where you are.
QuickstartInstall the CLI, add the skill to your agent, sign in, and run your first check in five minutes.
Claude CodeWhere the skill lives, the Stop hook that checks what a session wrote, and the one line to add to CLAUDE.md.
CodexThe same for Codex: skills folders, trusting the hook, and what the CLI reads from the thread.
Gate a change in CIRun slopcop in GitHub Actions with a token, pick the base, and upload SARIF to code scanning.
Read a reportStatus, certainty, new versus existing findings, and what incomplete and inconclusive mean.
Credits and what it costsChecks are free, and so is your first repository. What an active repository costs after that.
What to expect
Answers it can prove.
Traced to a rule
Each finding names the rule that raised it, its severity, its certainty, and the file and line. The analysis is static, deterministic, and runs the same way twice.
Across files
Data flow is traced through the files the change writes: a request parameter that reaches a SQL query three files later is one finding, with the path that proves it.
Never a false all-clear
A rule that cannot finish makes the check incomplete, never clean. The report says what was not covered, so your agent never reads silence as safety.
Built for agents
No prompts, one request, a closed exit-code contract, and JSON or SARIF output. An agent can run it after every edit without a human in the loop.
Exit codes
The contract an agent reads.
0Clean. The check completed and the change added no finding.
1Findings. The change added one. Fix it and check again.
2Incomplete, or the CLI or service failed. Never an all-clear.
3Still running when the timeout ran out. Run the same check again.
4Refused, and only a person can clear it. Read the code and remedy.