slopguard
what an agent may write
Security guardrails that fire in the one second between "the model produced it" and "it exists on disk". Secrets, injections, fake packages — refused, not flagged.
The problem
Without it
Veracode tested 100+ models: 45% of generated code has an OWASP Top 10 vulnerability. Your scanners run in CI. By then the secret is already in your git history.
With slopguard
✗ SLOPGUARD blocked this write to src/lib/supabase.ts [SG-6] Supabase service_role key in client-reachable code fix: this file ships to the browser. Use the anon key on the client, keep privileged calls behind a server route.
Not a warning you scroll past. The write did not happen.
Each block hands the model a rule ID and a fix, so it corrects itself. You just watch it get it right on the second try.
When to reach for it
-
You vibe code with Claude Code
Four hooks intercept writes, installs and session start. Enforcement lives here.
-
You use Cursor, Copilot, Windsurf or Aider
Drop
AGENTS.mdin any repo — every major agent reads the 18 rules. -
Your agent installs its own dependencies
npm and PyPI get asked before the install runs. A 404 is a hallucination.
-
You share rule files or MCP configs
Pre-flight catches hidden Unicode in
CLAUDE.mdand swapped MCP entries (CVE-2025-54136).
What you get
-
Blocks at write time, not at review
Secrets, string-built SQL, eval, weak crypto — denied before they touch disk.
-
18 rules, 9 machine-enforced
Written to the model, with the reasoning included — so it generalizes.
-
Never echoes your secrets
Blocked credentials are redacted. The guard that catches a leak doesn't become one.
-
Skills and a red teamer
/slopguard:harden,/slopguard:preflight, plus a subagent that reviews like an attacker. -
Tunable in one file
Every pattern in one readable
rules.mjs. Half the test suite is code that must not trip a rule. -
Nothing to run
Plain Node scripts, standard library only. No telemetry, no config, no keys.
Install · 60 seconds
-
Install the plugin in Claude Code
/plugin marketplace add manpreet171/slopguard /plugin install slopguard@slopguard
-
Drop the rules into your project
Works in Cursor, Copilot, Windsurf, Cline, Aider and Codex too.
curl -O https://raw.githubusercontent.com/manpreet171/slopguard/main/AGENTS.md
-
Restart and it's live
No config, no API key, no dependencies.
✗ SLOPGUARD blocked this install — [SG-4] 2 package(s) do not exist: • express-mongoose-helper-utils (npm: 404 not found) • react-query-toolkit-pro (npm: 404 not found)
Source & docs
Full rule list, sourced threats (docs/THREATS.md),
tuning guide, red-team agent. MIT.