ai-slopcheck

Deterministic scanner for AI-style code failures. 72 rules. No LLM. No backend.

Catches the mistakes AI coding assistants leave behind — stub functions, silent error handling, hallucinated placeholders, hardcoded secrets, and 68 more patterns across Python, JS/TS, Go, C/C++, SQL, and Markdown.

Install

pip install ai-slopcheck

Quick Start

# Scan a project
ai-slopcheck scan . --output findings.json --fail-on warning

# View results
ai-slopcheck summary findings.json

# GitHub Security tab (SARIF)
ai-slopcheck sarif findings.json

# Only scan changed files (CI)
ai-slopcheck scan . --changed-files git --fail-on warning

What It Catches

Features

• 72 deterministic rules — no LLM, no network, no randomness
• 6 languages — Python, JS/TS, Go, C/C++, SQL, Markdown
• Inline suppression — # slopcheck: ignore[rule_id]
• SARIF output — integrates with GitHub Security tab
• Diff-only mode — scan only changed files (--changed-files git)
• Baselines — suppress existing findings, fail only on new ones
• API snapshots — detect removed API routes
• Tree-sitter — optional AST context for better precision
• Threaded — multi-core scanning (--jobs N)
• Confidence filtering — --min-confidence medium for high-signal-only mode

GitHub Actions

name: slopcheck
on: [pull_request]
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with: { python-version: '3.12' }
      - run: pip install ai-slopcheck
      - run: ai-slopcheck scan . --output findings.json --fail-on warning
      - run: ai-slopcheck github-annotations findings.json
      - run: ai-slopcheck sarif findings.json > results.sarif
      - uses: github/codeql-action/upload-sarif@v3
        with: { sarif_file: results.sarif }

Baselines (Incremental Adoption)

# First run: baseline existing findings
ai-slopcheck scan . --output findings.json --fail-on none
ai-slopcheck create-baseline findings.json

# CI: only fail on NEW findings
ai-slopcheck scan . --baseline .ai_slopcheck/baseline.json --fail-on warning

CLI Reference

Key scan Options

Configuration

Create .ai_slopcheck/config.yaml:

rules:
  # Disable a rule
  js_loose_equality:
    enabled: false
  
  # Enable an opt-in rule with custom threshold
  deep_nesting:
    enabled: true
    max_depth: 5
  
  # Configure detection
  hallucinated_placeholder:
    allowed_domains: ["example.com", "localhost"]

Tree-sitter (Optional)

For better precision (~5% improvement on string/comment context detection):

pip install ai-slopcheck[ast]
# Or manually:
pip install tree-sitter-python tree-sitter-javascript tree-sitter-go tree-sitter-typescript

Project Layout

ai_slopcheck/
├── cli.py                 — 6 CLI commands
├── config.py              — 50+ Pydantic config models
├── models.py              — Finding, ScanResult (stable contract)
├── engine/
│   ├── scanner.py         — Threaded orchestrator
│   ├── suppression.py     — Inline ignore parser
│   └── context_filter.py  — String/comment detector
├── parsers/
│   └── treesitter.py      — Optional AST adapter
├── rules/
│   ├── generic/           — 71 cross-repo rules
│   └── repo/              — 1 architecture rule
├── output/
│   ├── sarif.py           — SARIF v2.1.0
│   ├── annotations.py     — GitHub annotations
│   └── markdown_summary.py
└── state/
    └── store.py           — Baseline persistence

Documentation

Contributing

See CONTRIBUTING.md. Quick summary:

1. Branch from develop
2. Add rule + config + tests
3. pytest && ruff check .
4. Merge request

License

MIT — Euraika 2026