Slop Sheriff

A cowboy with a code review habit

There’s a new
reviewer in town.

Meet Slop Sheriff. Your pull request rides in; a robot cowboy checks the claims, follows the evidence, and leaves you findings worth a closer look.

Put the Sheriff to work See a review ↓
Slop Sheriff, a robot cowboy carrying review notes and following code tracks toward a Clean code sign
GitHub pull requests. A little frontier spirit.Self-hosted · Review-only · Advisory by default

01 / A posse with a purpose

Different trails.
One review.

Focused lanes inspect the change from different angles. Their evidence comes together in one report, with related findings reconciled and uncertainty kept visible.

01

Reuse & designCore lane

Look for duplicated logic, competing representations, and abstractions that earn their place.

02

Claims & specificationCore lane

Compare the change with its stated requirements. Find gaps between what was promised and what was built.

03

Engineering qualityCore lane

Trace correctness, failure paths, trust boundaries, and the cost of maintaining the code.

04

Test against the specRequirements and real interfaces

Exercise explicit requirements through the available UI, API, or runtime. Unavailable execution stays unverified.

05

Test healthWhen affected tests are in scope

Check whether tests protect public behavior, catch relevant failures, and tolerate internal refactors.

06

DiscoverabilityWhen public web content is in scope

Inspect crawl controls, metadata, semantics, rendering, and the paths that help people find the page.

07

Writing qualityWhen authored language is in scope

Flag concrete clarity problems in prose, strings, and comments, with an economical rewrite.

02 / Show your work, partner

Short impact.
Long evidence.

Each new finding leads with an impact summary of at most 300 characters. Expand it for the evidence and a suggested remedy.

Findings keep stable identities across reviews. After a completed full review, follow-up reviews inspect the changed files and revalidate selected earlier findings.

The cowboy voice is optional. Set personality: false for plain language; evidence and severity stay the same.

Slop Sheriff Synthetic example · Engineering quality
Important

Check ownership before returning the invoice

src/invoices/get-invoice.ts · line 24

A signed-in user can fetch another account’s invoice by changing the ID. Check the invoice’s account against the caller before returning its contents.

Evidence & suggested fix

Evidence. In this invented example, the handler authenticates the caller, then loads an invoice by ID without checking its account. A request as account A with account B’s invoice ID returns B’s invoice.

Remedy. Scope the lookup to the caller’s account. Add an API test that requests an invoice belonging to another account and expects access to be denied without returning invoice content.

Scope. This illustrates the finding format. It is not a result from a live review or a performance claim.

Illustrative finding. No customer code or review results shown.

03 / Your ranch. Your rules.

Give the Sheriff
a place to hang
its hat.

Run your own deployment with your own GitHub connection, model access, and infrastructure. You control which repositories it reviews and pay the services you use.

Follow the setup guide

  1. Set up your infrastructure

    Clone the repository and install with Bun. Create your Vercel and Convex projects, and configure AI Gateway model access.

  2. Connect your GitHub App

    Authorize the repositories you choose and connect GitHub events through Vercel Connect and Eve’s native GitHub channel.

  3. Validate, deploy, then enable reviews

    Run the offline checks, configure the required secrets, and deploy your app. Follow the guide to verify webhook delivery before reviewing a pull request.

Start advisory. Commit this optional configuration to your repository’s base branch as .github/slop-sheriff.yml. Configuration is read from the trusted base revision, so a pull request cannot change its own review policy.

# .github/slop-sheriff.yml
blocking: false
personality: true
profile: balanced

Review powers, carefully scoped.

The app reads repository contents and pull request context, and writes review comments and Checks. It does not push branches, merge pull requests, or change repository settings. Provider credentials stay out of the repository sandbox.

Review the required GitHub permissions and service configuration in the self-hosting guide.

A second set of eyes.

Model-assisted review can miss bugs or raise false positives. Humans remain responsible for decisions. Failed or unavailable checks remain visible as limitations; an incomplete review is not a clean bill of health.

The Sheriff reviews code and writing for concrete problems. It does not determine whether a person or AI wrote them.