One living review for your codebase
Find problems early and follow them into deeper context as your review grows with your code, fixes, and team’s rules.
Read-only access without executing your code.
First findings arrive while analysis continues.
The password verdict is calculated, then ignored before a session is created.
const valid = await verify(user, password);
return createSession(user);const valid = await verify(user, password);
if (!valid) return null;
return createSession(user);Turn what you learn into what you check
SlopCop finds recurring problems in your code and history, proposes deterministic rules, and brings them into the way your team works.
Connect related findings and past fixes to discover patterns worth preventing.
Explore source-backed rulesMake the intended behavior explicit and check it against your repository.
“Failed authentication must not create a session.”
Failed verification should be rejected; successful verification should still create a session. Check the original occurrence, the fix, and near misses before enforcing a rule.
Give engineers, coding agents, and CI the same rulebook, with the enforcement level your team needs.
Example: Warn when this pattern returns.
People and AI agents get deterministic feedback as they work, before the next pull request.
Developers and coding agents work against the same repository rules.
Read-only source access without builds, execution, or dependency installation.
The GitHub App reads source in the repositories you select. Sending a deep-review action as an issue requires optional Issues write permission and your confirmation.
Anyone holding a valid report-access link can view the report. Links are unlisted, and access is not restricted to your GitHub collaborators. Treat private-code report links as sensitive.
Credential-like matches are reported by location without the matched value. Flagged files are excluded from source excerpts. Detection is bounded and does not guarantee that every secret is found.
Our work spans static analysis, distributed systems, coding-model evaluation, and agentic coding infrastructure.
Brokk founder and CEO, DataStax co-founder and former CTO, and former Apache Cassandra project chair. He also led our Power Ranking coding-model benchmark.
PhD in computer science, with published research in static analysis. He develops Bifrost’s code intelligence and helped maintain and extend Joern’s analysis.
At DataStax and Dremio, he built diagnostics for distributed systems, including Apache Cassandra tooling and Dremio’s diagnostic collector. Today he builds Brokk’s agentic coding tools and the infrastructure behind them.
Structured analyzer evidence and bounded source excerpts. Deeper review adds a bounded selection of source, project documentation, architecture samples, and available recent commit metadata. It does not read the entire repository or its full history.
AI claims must reference supplied evidence. Invalid citations are rejected. Traceability does not prove that a diagnosis or suggested fix is correct. Reports keep skipped work and incomplete results visible.
Connect GitHub for repositories you authorize, including private repositories. Public GitHub, GitLab, and Bitbucket URLs work too. Reviews start from the latest default-branch commit.
Supported source languages: JavaScript, TypeScript, Python, Java, Rust, Go, Ruby, C, C++, PHP, Scala, C#, Kotlin.
How repository analysis worksCorrectness, performance, maintainability, tests, credentials, and risky APIs, with deeper data-flow checks for security-sensitive and correctness issues. Findings are candidates to verify, and suggested fixes need validation.
See the checks and examplesConnect GitHub to see what SlopCop finds in your repository.