AI writes your code.
slopGrade decides: it passes or it blocks.
A deterministic gate on every PR. Slop and cross-tenant leaks never reach main — no score, no debate.
Your team merges code no human wrote.
AI agents open PRs faster than review can keep up. Slop slips through, queries forget the org filter, a key leaks into a log. At volume, human review catches nothing — you need a deterministic gate, not an opinion.
One loop: detect → block → verify
The gate lives in your GitHub Actions CI. It reads each PR's diff, decides, and writes its verdict as a required check. No code leaves your runner.
Copy the snippet
One GitHub Actions workflow pasted into your repo. Keyless OIDC — nothing to store.
- uses: slopgrade/ci@v0.3.1The PR opens
The gate reads the diff on the runner and classifies it against {gates} classes of slop and tenant leaks.
$ slop scan --diff origin/main…HEADPass / block verdict
One required check, true or false. Red → merge is disabled by the branch ruleset.
slop · blocked → merge disabledThe fix goes green
The agent fixes, re-pushes, the gate re-runs. Green → the PR is mergeable again.
slop · pass → ready to merge124 classes of gate. 5 layers. 0 false positives.
The cross-tenant leak — a query with no org filter — is the class CodeQL and human review miss, and it's our #1. The moat isn't the mechanism: it's the curated, turnkey rulepack, calibrated to zero false positives on 5,000+ real repos before every release. You turn it on; you don't write it.
Tenant isolation
Every org-scoped query must carry its filter. The #1 cross-tenant leak in prod, caught before merge.
Secrets & injection
Hardcoded keys, SQL/command/XXE/SSRF, deserialization — the bulk of the catalog.
Crypto & auth
Weak algorithms, short keys, RSA padding, reflected CORS, missing access control.
Deterministic slop
Invented numbers, dead guards, hand-rolled native controls — the formula, never an LLM.
Physical split, 0 egress
Extraction stays on your runner; only a verdict leaves. The code doesn't travel.
Every class, with the code it blocks.
A sample of the 124 classes — grouped by category, each with the exact pattern it catches before it reaches main. Detection runs on your runner; this is what it looks for.
✗ db.from('invoices').select('*')✗ create view billing as select * … security definer✗ User.create(req.body) // is_admin passes through✗ db.query('select * from u where id = ' + req.params.id)✗ exec('convert ' + req.query.file)✗ fetch(req.query.url) // hits 169.254.169.254✗ libxml.parseXml(body, { noent: true })✗ jwt.verify(t, key, { algorithms: ['none'] })✗ const stripe = 'sk_live_4eC39Hq…'✗ app.use(csrf({ ignoreMethods: ['POST'] }))✗ crypto.createHash('md5').update(password)✗ new https.Agent({ rejectUnauthorized: false })✗ createCipheriv('aes-256-cbc', key, ZERO_IV)✗ uses: some/action@main # not a SHA✗ "lodahs": "*" // typo'd name, floating range✗ cidr_blocks = ["0.0.0.0/0"] # port 22✗ FROM node:latest✗ DEBUG = TrueNot another scanner. A turnkey gate.
CodeQL and Semgrep are engines you configure and tune. Human review doesn't scale to agent-speed PRs. slopGrade is the curated rulepack you turn on — 124 classes calibrated to zero false positives across 5,000+ real repos, including the cross-tenant leak you'd otherwise write and tune the query for yourself.
Deterministic by design · open-source client, auditable · we run it on slopGrade itself before it ships to you.
Free advisory forever. From $24 per repo, tapering.
You pay for what you protect, not per head. A dormant repo costs $0 — and the more you protect, the less each repo costs. Unlimited users, always.
Straight answers.
QWhat is slopGrade?
A deterministic CI gate for AI-written code: on every GitHub pull request it decides pass or block before the code reaches main. No score, no debate.
QDoes my code leave my CI?
No — 0 egress. Extraction stays on your GitHub Actions runner; only a verdict leaves. The code doesn't travel (physical split).
QHow much does it cost?
Advisory (scan without blocking) is free forever on all your repos. Blocking mode is $24 per repo per month, down to $11 at volume.
QIs there a free trial?
Yes: 14 days free, up to 5 repos, no credit card. After the trial you keep the repos you want or fall back to free advisory.
QWhat does the firewall detect?
The 11 most critical classes block free (open-source client); the full firewall covers 124 classes across six categories — injection, crypto, infra, auth, access, supply-chain — including the #1 cross-tenant leak. Calibrated to 0 false positives on 5,000+ real repos.
Put a gate between the AI and your main branch.
Create an account, paste the snippet, protect your first repo in two minutes. 14 days free, up to 5 repos, no card.