Enables auditing of backend code that targets ClickHouse: scans files for anti-patterns like SELECT *, interpolated SQL, missing LIMITs, and N+1 queries in loops, returning deterministic PASS/FAIL with findings.
Enables auditing of backend code that targets PostgreSQL: scans files for anti-patterns like SELECT *, interpolated SQL, missing LIMITs, and N+1 queries in loops, returning deterministic PASS/FAIL with findings.
Enables auditing of backend code that targets Redis: scans files for anti-patterns like N+1 Redis calls in loops, missing timeouts, and other backend slop, returning deterministic PASS/FAIL with findings.
This server does not currently have a deployable release on Glama. Follow the repository's setup instructions to install and configure it for your MCP client, including any required credentials and local dependencies.
Stop AI-generated APIs and SQL from shipping as naive slop: polyglot skill + MCP verifier for TypeScript/JS, Python, Go, Rust, Java/Kotlin, C#, PHP, Ruby, PostgreSQL, ClickHouse, Redis and async workers.
An agent skill plus an MCP server in one package. The skill tells your coding agent what slop to avoid; the MCP tools then deterministically verify the result, so the agent can't just claim it's done.
Works with Claude Code, Claude Desktop, Codex and Antigravity.
Rule | Severity | Catches |
| ERROR | Banned SELECT *. Project explicit columns. |
| ERROR | String-interpolated or concatenated SQL. Use parameterized bindings ($1, ?, :name, %(name)s, @p1) or a typed query builder. |
| ERROR | DB/HTTP call inside a loop (N+1). Batch with IN (...), ANY($1), bulk upsert, JOIN or a dataloader. |
| ERROR | Silent or print-only error handler (catch/except/if err != nil/rescue). Log structured context and propagate or map the error. |
| ERROR | Type escape (': any', 'as any', 'as unknown as'). Validate the boundary with a schema (Zod, TypeBox, Valibot) and use the inferred type. |
| ERROR | Type-checker/linter suppression. Fix the underlying type or lint error. |
| ERROR | Raw error stack/message/traceback returned to the client. Return a sanitized error code and log the details server-side. |
| ERROR | Unfinished TODO/FIXME or not-implemented placeholder in backend code. |
| ERROR | UPDATE/DELETE without a WHERE clause rewrites or wipes the whole table. Add a WHERE (or use TRUNCATE deliberately). |
| ERROR | Hardcoded credential. Load it from the environment or a secret manager and rotate the leaked value. |
| ERROR | TLS certificate verification disabled. Fix the CA bundle instead of trusting any certificate. |
| ERROR | Passwords hashed with a fast digest. Use argon2id, scrypt or bcrypt. |
| ERROR | Security token from a non-cryptographic RNG. Use crypto.randomBytes/randomUUID, secrets.token_urlsafe, or crypto/rand. |
| ERROR | eval / dynamic code or shell command built from input. Pass arguments as an array (execFile, subprocess.run([...]), exec.Command(bin, args...)). |
| ERROR | JWT decoded without signature verification. Use jwt.verify / jwt.decode with key and an explicit algorithms allowlist. |
| WARN | CORS allows every origin. List the allowed origins explicitly, especially with credentials. |
| WARN | Outbound HTTP call without a timeout can hang a worker forever. Pass timeout=. |
| WARN | fetch() without an AbortSignal never times out. Pass |
| WARN | Go's default http client has no timeout. Use &http.Client{Timeout: ...} or a context deadline. |
| WARN | Unbounded read: no LIMIT/take. Paginate with a cursor or an explicit limit. |
| WARN | Error return discarded with |
| WARN | .unwrap() panics the request/worker on error. Propagate with |
| WARN | Bare |
The skill additionally requires strict schema validation at every boundary (Zod, Pydantic, validator, serde, @Valid, FluentValidation), explicit LIMITs and pagination, idempotent retries, and offloading work over ~2s to a queue.
Rules marked ERROR make the audit return status: "FAIL"; WARN is reported but does not fail.
Related MCP server: frontend-unslop
# Claude Code
claude mcp add backend-unslop -s user -- npx -y backend-unslop-mcp
# Codex
codex mcp add backend-unslop -- npx -y backend-unslop-mcpClaude Desktop (~/Library/Application Support/Claude/claude_desktop_config.json) and Antigravity (~/.gemini/config/mcp_config.json):
{
"mcpServers": {
"backend-unslop": {
"command": "npx",
"args": ["-y", "backend-unslop-mcp"]
}
}
}Restart the app afterwards.
npx -y backend-unslop-mcp install-skills # clients that are installed
npx -y backend-unslop-mcp install-skills --all # every locationClient | Location |
Claude Code |
|
Codex |
|
Antigravity |
|
Claude Desktop has no skills folder, so it receives the rules through the MCP prompt and the load_*_rules tool.
Kind | Name | Purpose |
Prompt |
| The full skill text, for GUI clients |
Tool |
| Returns the full backend-unslop ruleset. Call before writing code if the backend-unslop skill is not already loaded. |
Tool |
| Deterministically scans backend and SQL files for slop: SELECT *, SQL interpolation, N+1 queries, UPDATE/DELETE without WHERE, silent error handlers, type escapes, stack leaks, hardcoded secrets, disabled TLS, weak password hashing, insecure tokens, injection, unverified JWTs, missing timeouts, unbounded queries and TODO placeholders. Accepts files or directories; with no files it audits the git working-tree changes. Suppress a verified false positive with a |
Tool |
| Auto-detects and runs compiler/type/syntax checks: TypeScript (tsc --noEmit), Go (go vet), Rust (cargo check), Python (py_compile), PHP (php -l), Ruby (ruby -c). Missing toolchains are reported as SKIPPED. |
Tool |
| Alias of verify_backend_compile, kept for backwards compatibility. |
File paths resolve against the server's working directory and cannot escape it. Directories honour .gitignore and skip node_modules, build output and minified files.
The same audit runs without an agent. It exits 1 on any ERROR, so it works as a pre-commit hook or CI step:
npx -y backend-unslop-mcp audit # git working-tree changes
npx -y backend-unslop-mcp audit src app # files or directories
npx -y backend-unslop-mcp audit src --json # machine-readable
npx -y backend-unslop-mcp rules # list every ruleThe checks are regex and structure based: fast, offline and predictable, but heuristic. For a verified false positive, add a comment on the line or the line above, with a reason:
// unslop-ignore NO_SELECT_STAR -- why this is safe hereSuppressions without a reason are reported as SUPPRESSION_WITHOUT_REASON errors, and every honoured suppression is listed in the audit output so reviewers can see it.
The agent loads the skill and writes code under its constraints.
Before finishing, the skill requires the audit and verification tools.
On FAIL, the agent fixes every finding and re-runs until PASS. Missing toolchains are reported as SKIPPED, never as passing.
All share the engine in unslop-core.
git clone https://github.com/fikrifirmanf/backend-unslop-mcp
cd backend-unslop-mcp && npm install
npm test # every rule is checked against its good/bad examples
node src/server.mjs # speaks MCP over stdioMIT © Fikri Firman Fadilah
This server cannot be deployed
Enforces architectural invariants and code quality rules inside your AI agent's edit loop.
Statically audits MCP tool surfaces for token cost, schema quality, and design issues.
Stateless TS/JS compiler facts for agents: references, imports, impact. No repo index or OAuth.
Scores your code across 12 areas, with findings, fix prompts, and re-assessment in your AI agent