[~]
Loading how a scan works
loading architecture & FAQ
Your app works on your laptop, for one user, with four rows in the database. CleanSlop maps how your app connects, passes precise code trees to specialized decision models for judgment, and returns only verified production risks and remediation.
The failures that hurt a newly launched app are rarely a single bad line. They are paths across files: how a route, helper, data store, and external service interact when real users and traffic arrive.
Step 01
CleanSlop identifies your stack from the repository and lockfile, maps how your routes, Server Actions, webhooks, background jobs, data layer, and external services connect, and surfaces production risks using deterministic sensors paired with high-probability lessons learned from production codebases.
What goes into each code tree
Instead of dumping your repository into a prompt, CleanSlop traces the exact execution path:
The route, Server Action, webhook, or job that triggers the pathImported middleware, auth wrappers, validators, and utilitiesThe database query, transaction, queue, or external API callStep 02
Flagging a file in isolation raises false alarms whenever an auth guard, validator, or limit lives a hop away in a shared helper. CleanSlop walks the import and call graph inward and outward to assemble a focused code tree containing only the files and functions that govern that execution path.
Step 03
Each code tree is passed to specialized decision models that evaluate the deeper context of your code. Paths that are already protected along the call chain are filtered out, leaving only confirmed production risks ranked by severity with structured remediation ready for your coding agent or editor.
Single-file linters flag noise because they cannot see past one file, while whole-repo prompts burn tokens and hallucinate call paths. Passing only the connected code tree to decision models solves both.
Production bugs rarely sit on a single line. A route or component imports a shared helper, which reaches a database or external service three files away. CleanSlop follows imports and function calls across modules so judgment sees the complete execution path.
A file that looks risky on its own is often protected by middleware, an auth wrapper, or a validator one hop away. Because the code tree includes those callers and callees, decision models filter out false alarms before you ever see the report.
Before assembling code trees, CleanSlop fingerprints the frameworks, ORMs, auth libraries, queues, and SDKs in your lockfile. Judgment evaluates how your specific stack behaves under real traffic rather than matching generic text patterns.
Mapping, code-tree extraction, and model judgment run on CleanSlop's infrastructure, not inside your editor's chat session. Your coding agent keeps its full context window free for writing and verifying fixes.
Instead of handing you 200 raw warnings or unverified suspicions to triage by hand, CleanSlop returns only the confirmed issues that held up against their surrounding code tree, ranked by severity.
Every confirmed finding carries the exact files and call-path context from its code tree. Your coding agent pulls in the remediation brief via CLI or MCP, patches the code, and runs a verification rescan to confirm the issue closed.
CleanSlop identifies your stack before running checks so findings match the framework, database, auth library, and services your project actually uses.
Sharpest on Next.js with Supabase, including apps started in Lovable and Bolt, then the rest of the TypeScript web-app mainstream.
Data-layer checks bind to the database client and ORM your project actually uses.
Session helpers and auth boundaries are followed through the files that import them, not matched as brand names in comments.
Background job and worker checks run when the matching client is in the project.
Storage and payment flows are scoped to the services your lockfile actually includes.
AI provider integrations and model calls are recognized directly from your project's dependencies.
Running audit prompts, markdown skill packs, or linter wrappers that ask a general-purpose LLM to evaluate your repo still depends on an expensive frontier model exploring files from scratch. You get probabilistic results that change from run to run, heavy token burn, and a bloated context window right when your agent needs to focus on fixing code.
| What matters | Pasting code into chat | Markdown SKILL.md packs | Linters & LLM eval wrappers | CleanSlop |
|---|---|---|---|---|
| How it works | Open-ended chat over whatever files you paste | Markdown prompts telling an agent to role-play an auditor | Single-file linters plus an LLM prompt grading the repo | Deterministic sensors & lessons + code-tree decision models |
| What the model sees | Arbitrary files or whole-repo dumps | Long playbooks plus unstructured repo exploration | Single files in isolation, then a broad evaluation prompt | Only the precise code tree for each execution path |
| Same code, same answer? | Different findings every run | Probabilistic; two runs on the same commit disagree | Syntax rules repeat; LLM evaluations drift across runs | Same checkout, same map, same code trees |
| What it costs your context window | Paste the repo. Pay frontier chat rates. | Requires a frontier model and bloats your agent's context window | Local linters, then frontier token burn to evaluate the repo | Runs outside your agent's context window |
| Cross-file guards & false alarms | Misses helpers and middleware in other files | Depends on which files the agent happens to open | Flags single files without checking callers or wrappers | Follows the call and import tree to verify safeguards in context |
| Remediation in your editor | Copy-paste into a new chat | Context window is already full before fixing starts | Terminal warnings or a local report to triage by hand | CLI, remote MCP, and web deliver verified fixes and rescan |
CleanSlop runs outside your coding agent's context window and delivers confirmed findings and structured fix context back into Claude Code, Codex, Cursor, Devin, Lovable, Replit, Grok Bot, or Muse.
Tell your agent “Scan with cleanslop.com” to run npx -y @cleanslop/cli scan on your local working tree (including uncommitted changes, while .env files and private keys stay on your machine), or connect any editor to our remote OAuth 2.1 MCP server at /mcp with one URL and no API keys.
Authenticate with a read-only GitHub App or let your agent sign you in from the CLI with Stripe's Link Agent Identity (no form, password, or browser trip). Every credit pack or monthly plan waits for your approval in your browser or Link before anything is charged.
Your agent pulls in only the confirmed findings and their code-tree remediation context, applies the fixes without burning tokens hunting through the repo, and runs a follow-up rescan to verify what resolved. On the web, use Copy for LLM, turn on scheduled Autoscan, or book a 15-minute engineer triage call.
Straight answers on how scans work, how precise code trees keep false alarms down, what happens to your code, and how CleanSlop compares to other tools.
No. CleanSlop combines deterministic sensors and high-probability lessons learned from production codebases with specialized decision models. Instead of sending your whole repository to a general chat model, we map how your app connects, extract the precise code tree for each execution path, and pass those trees to our decision models to evaluate the deeper context of your code.
Built-in checks in app builders and hosting platforms catch single-file or build-time issues, like a missing environment variable or a failed build. CleanSlop maps how your routes, data access, background work, and external services connect across files, then passes the precise code trees to specialized decision models so we catch multi-file architectural and scaling risks that only show up under real traffic.
Checking one file in isolation flags noise whenever an auth guard, validator, or limit lives a hop away in an imported helper or middleware. CleanSlop assembles the precise code tree along each call and import path and passes it to specialized decision models. Paths that are already handled in context are filtered out, so your report and coding agent only receive confirmed issues ranked by severity.
When our decision models confirm a risk over a code tree, CleanSlop already knows the entrypoints, helpers, and call path involved. Instead of handing your coding agent a vague file warning that forces it to search your repository and burn context tokens, CleanSlop delivers the confirmed finding with structured remediation steps and the exact files along the path, then verifies the fix on a follow-up rescan.
Local testing runs with one user, a warm process, and a handful of rows. Architectural and scaling risks only surface when concurrent users, larger tables, slow third-party networks, and process restarts happen at the same time. CleanSlop traces how your execution paths behave under production conditions before real users hit them.
Your formatter, linter, and CI pipeline already handle code style, file length, and dead code. A 500-line file can be perfectly safe in production, while a 30-line route handler can stall under real traffic. We focus the scan on runtime reliability, trust boundaries, data isolation, and scaling under real traffic.
No, not unless you explicitly opt in. Customer scans never feed lessons into our learning system unless you turn on training for a specific GitHub repository in your settings, and folders uploaded from your coding agent are never used for training.
No. We do not execute your code, install packages, or write to your repository. Analysis is read-only over a shallow clone on the web, or over the folder your agent uploads. The GitHub App is read-only on the repos you tick, and you can revoke it. Agent uploads never write back to git.
We keep a read-only snapshot of your code next to the report for as long as your plan keeps history (7 days on Free, 30 on Starter, 1 year on Pro, unlimited on Max), then delete it. During judgment, only the extracted code trees are evaluated by our decision models, never your whole repository. When scanning from the CLI, .env files and private keys stay on your machine.
Tell your agent “Scan with cleanslop.com”, or connect over MCP. It scans the folder you are working in, including unpushed changes, while .env files and keys stay on your machine. Sign in with GitHub or Stripe Link. Every credit pack or monthly plan waits for your approval before anything is charged. The agent pulls in the confirmed issues and their remediation steps, applies the fixes, and runs a follow-up scan to confirm they closed. More on using CleanSlop from your agent.
A collection of SKILL.md files, clever audit prompts, or linter wrappers that ask an LLM to evaluate your repository still depends on an expensive frontier model exploring your codebase from scratch. You get probabilistic results where two runs on the same commit disagree, heavy token burn, and a bloated context window right when your coding agent needs to focus on fixing code. CleanSlop runs outside your agent's context window, judges precise code trees with specialized decision models, and returns verified findings with actionable remediation.
Pick a repo, or tell your agent “Scan with cleanslop.com”. Your report is a few minutes away.
Start freeFor AI coding agents: how to use CleanSlop (Markdown)