SlopGuard v1.0.0 · 100% Native Rust AST Engine
The Codebase Firewall for AI Coding Agents
Intercept hallucinations, broken imports, phantom API calls, and leaked keys before they reach git commit. Sub-millisecond latency powered by pure Rust.
Engine: 100% Pure Rust
Protocol: MCP JSON-RPC 2.0
Firewalls: 26 Active AST Rules
Startup: < 3ms
License: MIT Open Source
slopguard monitor — native terminal console
LIVE
AI Hygiene Health
100/100 [GRADE A+]
17 Active AST Firewalls Armed
Engine Latency
1.8 ms (Rust Native)
Zero runtime dependencies
MCP TELEMETRY OSCILLOSCOPE
REALTIME PULSE
Live Agent Tool Inspection Stream
slopguard_scan_diffsrc/api/auth.tsCLEAN (1.2ms)
slopguard_check_snippetsrc/billing.tsBLOCKED (1.5ms)
slopguard_sanitize_filesrc/utils/calc.tsSANITIZED (2.1ms)
Core Principles
Why AI Codebases Require an AST Firewall
Unfinished Placeholders & Silent Catches
AI coding models frequently leave todo stubs, unimplemented functions, or silent empty catch blocks that swallow exceptions in production.
Phantom Imports & Ghost Packages
LLMs hallucinate package exports that do not exist (e.g. useLocalStorage from react) and import third-party libraries not listed in package.json.
Hardcoded Secrets & Unsafe Dynamic Eval
Agents accidentally paste live API keys, tokens, private keys, or unsafe eval() / pickle.loads() calls directly into committed source files.
Interactive Playground
Intercept Hallucinations Before Commit
AI Generated Diff (Vulnerable)
try {
await syncDatabase();
} catch (err) {
// silently swallow error
}
SlopGuard Enforced
try {
await syncDatabase();
} catch (err) {
logger.error("Database sync failed", { err });
throw new DatabaseSyncException(err);
}
Detection Engine
26 Active AST Firewalls
no-redos-vulnerabilityCRITICAL / ERROR
Halts catastrophic backtracking regexes generated by LLMs with nested quantifiers ((a+)+, (.*a)*) that cause exponential CPU freezing on Node.js, Python, and Go servers.
no-silent-error-swallowingERROR
Halts chained catch(() => {}), uninspected API error tuples, and Go blanked error identifiers.
no-floating-promisesERROR
Traps dangling asynchronous promises that lack await, void, or error rejection handlers.
no-sql-injection-riskERROR
Catches raw template literal concatenation in SQL queries and ORM raw clauses.
no-command-injection-riskERROR
Prevents unescaped shell execution, exec(), child_process, and system command interpolation.
no-path-traversal-riskERROR
Traps unsanitized file path joins, open(), readfile(), and arbitrary directory traversal.
no-prototype-pollutionERROR
Stops unsafe __proto__, constructor.prototype, and recursive unsafe object merges.
no-hardcoded-secretsERROR
Catches leaked OpenAI, Anthropic, HuggingFace keys, AWS credentials, and private keys.
no-unsafe-dynamic-evalERROR
Blocks dangerous eval(), new Function(), pickle.loads(), and command injection vulnerabilities.
no-ai-todo-placeholdersERROR
Traps unfinished todo stubs, unimplemented!() macros, and placeholder exceptions.
no-silent-catch-passERROR
Halts empty try/catch blocks and Python except: pass that swallow critical runtime bugs.
no-hallucinated-importsERROR
Verifies imported identifiers exist in the target package (e.g. useLocalStorage from react).
no-phantom-api-routesERROR
Validates client fetch/axios API routes against active backend endpoint definitions.
no-circular-dependenciesERROR
Detects circular module import loops that cause TDZ crashes at production runtime.
no-ghost-dependenciesERROR
Prevents importing external libraries not declared in package.json or Cargo.toml.
no-ghost-env-varsERROR
Flags environment variables referenced in code but missing from .env.example templates.
no-type-safety-degradationERROR
Halts compiler suppression escapes like @ts-ignore, : any, and double casts.
no-mock-hallucinationsERROR
Blocks hardcoded placeholder URLs (jsonplaceholder, test emails) left in production files.
no-dummy-secrets-mocksERROR
Traps dummy tokens and fake mock credentials left in code by AI agents.
no-ai-sycophancy-watermarksWARN
Cleans chat watermarks like "As an AI...", "Here is the code:", and "Hope this helps".
no-deep-nesting-sprawlWARN
Flags excessive pyramid-of-doom spaghetti control flow (depth >= 5).
no-duplicate-shadow-utilitiesWARN
Stops agents from duplicating existing codebase helper functions using token similarity.
no-ai-conversational-bloatWARN
Strips conversational comments and tutorial chatter generated by LLMs.
no-excessive-scope-driftWARN
Warns when an agent diff touches unrelated configs or sensitive credential files.
no-coverage-theaterWARNING
Prevents LLMs from generating vacuous test assertions (expect(true).toBe(true), assert 1 == 1) and empty test callbacks that artificially inflate test coverage metrics.
no-disabled-tlsCRITICAL / ERROR
Halts dangerous SSL/TLS bypasses (NODE_TLS_REJECT_UNAUTHORIZED='0', verify=False, InsecureSkipVerify: true) injected by AI models to bypass local certificate validation.
Performance
Zero-Overhead Rust Engine
| Tool | Startup Latency | Scan Time (10k LOC Diff) | Memory Footprint |
|---|---|---|---|
| SlopGuard (Native Rust) | < 3 ms | ~8 ms | ~6 MB |
| Biome | ~45 ms | ~30 ms | ~28 MB |
| ESLint | ~620 ms | ~480 ms | ~140 MB |
| SonarQube Scanner | ~4,200 ms | ~3,100 ms | ~600 MB |
Integration
Installation & Setup
Standalone Binary
Windows x64 executable with zero dependencies:
curl -LO https://github.com/avelone123123/slopguard/releases/download/v1.0.0/slopguard-v1.0.0-windows-x64.exe .\slopguard-v1.0.0-windows-x64.exe
Cargo Install
Build and install to your user bin directory:
cargo install slopguard slopguard monitor
Cursor MCP Setup
Add to ~/.cursor/mcp.json for live interception:
{
"mcpServers": {
"slopguard": {
"command": "slopguard",
"args": ["mcp"]
}
}
}
Claude Code
Connect the stdio MCP server:
claude mcp add slopguard slopguard mcp
Git Pre-Commit Hook
Block unverified slop from repository commits:
slopguard hook install
GitHub Actions CI
Generate CI workflow file automatically:
slopguard ci