Sloppy: Static Analysis for AI-Written PHP | Mohamed Said [Skip to content](#main) [ ![](https://cdn.msaied.com/01KT78WE565VEMM3PSNQAAB0MH.png) Mohamed SaidLaravel Backend Engineer ](https://msaied.com) - [Home](https://msaied.com) - [Projects](https://msaied.com/projects) - [Articles](https://msaied.com/articles) - [Certificates](https://msaied.com/certificates) - [About](https://msaied.com#about) [ Contact](https://msaied.com#contact) Menu Menu ---- Close - [HomeStart here](https://msaied.com) - [ProjectsCase studies](https://msaied.com/projects) - [ArticlesEngineering notes](https://msaied.com/articles) - [CertificatesCredentials](https://msaied.com/certificates) - [AboutHow I work](https://msaied.com#about) - [ContactGet in touch](https://msaied.com#contact) [Start a conversation](https://msaied.com#contact) [WhatsApp](https://wa.me/201094619204) [Email](mailto:hello@msaied.com) 1. [Home](https://msaied.com) 2. / 3. [Articles](https://msaied.com/articles) 4. / 5. [AI](https://msaied.com/articles?category=ai) 6. / 7. Sloppy: Static Analysis for AI-Written PHP and Laravel Code [AI](https://msaied.com/articles?category=ai) [PHP](https://msaied.com/articles?category=php) Sloppy: Static Analysis for AI-Written PHP and Laravel Code ============================================================ Sloppy is a local static analysis tool that catches maintenance problems AI coding agents leave in PHP projects — swallowed exceptions, N+1 queries, and more — without requiring a model or API key. ![](https://cdn.msaied.com/01M22N44A70A5MC2S599JP0MPH.webp) [Mohamed Said](https://msaied.com#person) Published 26 Oct 2026 · Updated 29 Oct 2026 · 4 min read ShareCopy linkCopied ![Sloppy: Static Analysis for AI-Written PHP and Laravel Code](https://cdn.msaied.com/809/0b89594a93580cc874cf4eb0da818f38.png) On this page +1. [What Is Sloppy?](#what-is-sloppy) 2. [PHP and Eloquent Checks](#php-and-eloquent-checks) 3. [Swallowed Exceptions (SL107)](#swallowed-exceptions-sl107) 4. [Collection Instead of Database Query (SL205)](#collection-instead-of-database-query-sl205) 5. [Integrating with AI Coding Agents](#integrating-with-ai-coding-agents) 6. [Reviewing Only New Findings](#reviewing-only-new-findings) 7. [Installation and Automated Fixes](#installation-and-automated-fixes) 8. [Key Takeaways](#key-takeaways) What Is Sloppy? --------------- [Sloppy](https://github.com/Heyosseus/sloppy) is an open-source static analysis tool by [heyosseus](https://github.com/Heyosseus) aimed at the maintenance problems AI coding agents commonly leave behind in PHP projects. It runs entirely locally — no model, no API key — and checks for patterns such as swallowed exceptions, duplicate logic, queries inside loops, and unfinished method bodies. Importantly, Sloppy makes no attempt to detect AI authorship. The same rules apply to code you write yourself. Think of it as a complement to PHPStan, Psalm, and Laravel Pint: those tools leave certain maintenance concerns unreported, and Sloppy fills that gap. PHP and Eloquent Checks ----------------------- Sloppy ships with general PHP rules covering cyclomatic complexity, unused constructor dependencies, and redundant conditions. Laravel projects get additional rules for controller responsibilities and Eloquent usage. ### Swallowed Exceptions (SL107) An empty `catch` block silently discards failures: ```php use Illuminate\Support\Facades\Storage; function archiveTranscript(string $sessionId, string $transcript): void { try { Storage::disk('s3')->put("transcripts/{$sessionId}.txt", $transcript); } catch (\Throwable $exception) { // nothing here } } ``` Sloppy flags this as `SL107`. Whether you log the error, retry, or let the exception propagate is your call — Sloppy just makes sure you make one. ### Collection Instead of Database Query (SL205) Calling `::all()` before filtering loads every row into memory: ```php $publishedCount = PodcastEpisode::all() ->where('status', 'published') ->count(); ``` The fix pushes the work to the database: ```php $publishedCount = PodcastEpisode::query() ->where('status', 'published') ->count(); ``` Other Laravel-specific checks flag possible N+1 queries, queries inside loops, and placeholder implementations left with "not implemented" comments or exceptions. Integrating with AI Coding Agents --------------------------------- Sloppy includes a Claude Code integration you can install with: ```bash vendor/bin/sloppy agents install ``` This adds project rules to `CLAUDE.md` and hooks to `.claude/settings.json`. An edit hook feeds new findings back to the agent during a session; a finish hook can send it back to address findings above your configured threshold. The finish check blocks once — if the agent tries to finish again, it can proceed with unresolved findings recorded in the transcript. Hook failures also allow the session to continue. Sloppy also documents hooks for Gemini CLI and Codex, generated instructions for other coding tools, and an MCP server for on-demand analysis. Treat the hooks as development feedback; use a CI check when you need a hard build gate. Reviewing Only New Findings --------------------------- For existing applications, you can scope analysis to a branch without treating inherited debt as new work: ```bash vendor/bin/sloppy diff main --merge-base vendor/bin/sloppy review main --merge-base ``` Both commands compare against the branch's common ancestor with `main`. Findings use fingerprints rather than line numbers, so adding an import does not surface an old finding as new. You can also snapshot existing findings into a baseline: ```bash vendor/bin/sloppy baseline ``` Sloppy provides CI reporting and Pest expectations for tracking new technical debt, plus diff-only checks that flag tests weakened or removed by a change. Installation and Automated Fixes -------------------------------- Sloppy requires PHP 8.3 or later and supports Laravel 12 and 13: ```bash composer require --dev heyosseus/sloppy # Standalone vendor/bin/sloppy # Laravel php artisan sloppy ``` For mechanical fixes, preview changes before applying them: ```bash php artisan sloppy:fix --dry-run ``` Sloppy generates a Rector configuration scoped to files with fixable findings, formats rewrites with Laravel Pint, and can remove comments that only repeat the code beneath them. Rector and Pint are optional dependencies. Structural decisions — splitting a large class, deciding whether two similar methods should share an abstraction — still require human review. Key Takeaways ------------- - Runs locally with no model or API key required - Catches swallowed exceptions, N+1 queries, queries inside loops, and placeholder implementations - Complements PHPStan, Psalm, and Pint rather than replacing them - Claude Code integration provides live feedback during agent sessions - Baseline and diff commands let you focus on new debt without noise from existing issues - Automated fix pass uses Rector and Pint; structural refactors still need manual review - MIT licensed, supports PHP 8.3+, Laravel 12 and 13 --- *Source: [Sloppy: Static Analysis for AI-Written PHP — Laravel News](https://laravel-news.com/sloppy)* - [static analysis](https://msaied.com/articles?search=static%20analysis) - [PHP](https://msaied.com/articles?search=PHP) - [Laravel](https://msaied.com/articles?search=Laravel) - [AI](https://msaied.com/articles?search=AI) - [code quality](https://msaied.com/articles?search=code%20quality) - [Eloquent](https://msaied.com/articles?search=Eloquent) Frequently asked questions --------------------------- Does Sloppy require an API key or internet connection to run?No. Sloppy runs entirely locally and does not require a model, API key, or network connection. How does Sloppy differ from PHPStan or Psalm?Sloppy focuses on maintenance concerns those tools typically leave unreported — such as swallowed exceptions, queries inside loops, and placeholder implementations — rather than type correctness. It is designed to complement, not replace, type checkers. Can I use Sloppy on an existing project without flagging all pre-existing issues?Yes. You can record existing findings in a baseline with `vendor/bin/sloppy baseline`, then use the `diff` or `review` commands to surface only findings introduced by a specific branch. ![Mohamed Said](https://cdn.msaied.com/01M22N44A70A5MC2S599JP0MPH.webp)About the author ---------------- [Mohamed Said](https://msaied.com#person)Senior Backend Engineer specializing in Laravel, scalable SaaS platforms, APIs, and cloud infrastructure. I build secure, high-performance web applications that help businesses grow. [About](https://msaied.com#about) [GitHub ↗](https://github.com/EG-Mohamed) [LinkedIn ↗](https://www.linkedin.com/in/msaiedm/) [WhatsApp ↗](https://wa.me/201094619204) [Email Address ↗](mailto:hello@msaied.com) [My CV ↗](https://drive.google.com/file/u/0/d/1MF20IPRJyzfy32mhEutjL5EpSls0w2Q8/view) [Previous articleVolker Dusch on the PHP RCE Vulnerabilities and Disclosure](https://msaied.com/articles/volker-dusch-on-the-php-rce-vulnerabilities-and-disclosure) [Next articleFilament v5.8: Deferred Schema Loading, Table Grouping Improvements, and More](https://msaied.com/articles/filament-v58-deferred-schema-loading-table-grouping-improvements-and-more) On this page ------------- 1. [What Is Sloppy?](#what-is-sloppy) 2. [PHP and Eloquent Checks](#php-and-eloquent-checks) 3. [Swallowed Exceptions (SL107)](#swallowed-exceptions-sl107) 4. [Collection Instead of Database Query (SL205)](#collection-instead-of-database-query-sl205) 5. [Integrating with AI Coding Agents](#integrating-with-ai-coding-agents) 6. [Reviewing Only New Findings](#reviewing-only-new-findings) 7. [Installation and Automated Fixes](#installation-and-automated-fixes) 8. [Key Takeaways](#key-takeaways) ### Have a technical challenge? Tell me what you’re building. I reply within two working days. [Start a conversation](https://msaied.com#contact) Related articles ----------------- [ ![](https://cdn.msaied.com/808/d118ca0a73009ac41175d54bc274a4d5.png) Laravel · 4 min read### Filament v5.8: Deferred Schema Loading, Table Grouping Improvements, and More 26 Oct 2026 ](https://msaied.com/articles/filament-v58-deferred-schema-loading-table-grouping-improvements-and-more) [ ![](https://cdn.msaied.com/807/5d78d8a7c09c6847fd813a03863ea3fa.png) PHP · 4 min read### Volker Dusch on the PHP RCE Vulnerabilities and Disclosure 23 Oct 2026 ](https://msaied.com/articles/volker-dusch-on-the-php-rce-vulnerabilities-and-disclosure) [ ![](https://cdn.msaied.com/805/a4dfa0e7c7e3c01fb99f0f970866675b.png) AI · 3 min read### Decide with Jev Episode 3: Turn AI Answers into Decisions with PHP Rules 23 Oct 2026 ](https://msaied.com/articles/decide-with-jev-episode-3-turn-ai-answers-into-decisions-with-php-rules) Have a technical challenge? ---------------------------- Tell me what you’re building. I reply within two working days. [Discuss your project ↗](https://msaied.com#contact) © 2026 Mohamed Said · Built with Laravel, meant to last.Senior Backend Engineer specializing in Laravel, scalable SaaS platforms, APIs, and cloud infrastructure. I build secure, high-performance web applications that help businesses grow. - [Home](https://msaied.com) - [Articles](https://msaied.com/articles) - [Certificates](https://msaied.com/certificates) - [GitHub](https://github.com/EG-Mohamed) - [LinkedIn](https://www.linkedin.com/in/msaiedm/) - [WhatsApp](https://wa.me/201094619204) - [Email Address](mailto:hello@msaied.com) - [My CV](https://drive.google.com/file/u/0/d/1MF20IPRJyzfy32mhEutjL5EpSls0w2Q8/view) - [Sitemap](https://msaied.com/sitemap.xml)