ZeroSlop

Overview

From the repository's own README, as read at the audited commit.

<p align="center">  <a href="https://zero-slop.ai">    <picture>      <source media="(prefers-color-scheme: dark)" srcset="assets/logo/zero-slop-logo-reversed.svg">      <img src="assets/logo/zero-slop-logo-primary.svg" width="360" alt="Zero Slop">    </picture>  </a></p>      Zero Slop is installed about 1,600 times a week on npm.<p align="center"><strong>Find AI-sounding tells and slop in your writing.</strong></p><p align="center">  Zero Slop finds slop- stock phrasing, mechanical rhythm, vague claims, and canned formatting in writing.<br>  Your existing AI assistant edits the draft; local checks guard its names, numbers, links, quotations, code, tables, and paths.</p><p align="center">  <a href="https://zero-slop.ai/try/"><strong>Try it in your browser</strong></a>  ·  <a href="#install">Install the skill</a>  ·  <a href="#evidence-and-limits">See the evidence</a>  ·  <a href="https://github.com/manavmishra/ZeroSlop/releases/latest">Latest release</a>  ·  <a href="https://zero-slop.ai/brand/">Brand assets</a></p><p align="center">  <a href="https://github.com/manavmishra/ZeroSlop/actions/workflows/validate.yml"><img alt="Validate" src="https://github.com/manavmishra/ZeroSlop/actions/workflows/validate.yml/badge.svg"></a>  <img alt="Version 2.12.1" src="https://img.shields.io/badge/version-2.12.1-72528F?color=C15732">  <a href="https://www.npmjs.com/package/zero-slop"><img alt="npm version" src="https://img.shields.io/npm/v/zero-slop?color=C15732"></a>  <a href="https://www.npmjs.com/package/zero-slop"><img alt="npm downloads" src="https://img.shields.io/npm/dm/zero-slop?color=17634F"></a>  <a href="https://github.com/manavmishra/ZeroSlop/stargazers"><img alt="GitHub stars" src="https://img.shields.io/github/stars/manavmishra/ZeroSlop?style=flat&color=C15732"></a>  <a href="LICENSE"><img alt="MIT license" src="https://img.shields.io/badge/license-MIT-141412"></a>  <a href="https://hol.org/registry/plugins/manav-mishra%2Fzero-slop"><img alt="Listed in the HOL plug

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude mcp add zero-slop-site --env GH_TOKEN=${GH_TOKEN} --env GITHUB_TOKEN=${GITHUB_TOKEN} -- npx -y [email protected]

{
  "mcpServers": {
    "zero-slop-site": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "GH_TOKEN": "${GH_TOKEN}",
        "GITHUB_TOKEN": "${GITHUB_TOKEN}"
      }
    }
  }
}

Exposed tools (2) 2 read · 0 write · 0 destructive

Details

Source

manavmishra/ZeroSlop

npm

zero-slop-site@0.1.0

PyPI

zero-slop

Transports

streamable-http

Credentials it reads

GH_TOKENGITHUB_TOKEN

License

MIT

Stars

118 · pushed 0d ago

Trust audit

Install with care. The audit found things worth knowing before you trust its output.

What the source does

Filesystem

declared (1 observation(s))

Network

declared (3 observation(s))

Shell

none-observed

Dependencies

pinned

Secrets in source

none-found

Findings (25)

await page.goto(`http://127.0.0.1:${server.address().port}/`);

Gb"0;JH,ZM!5fq/l<W?K<<3("zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz

sentence skeleton. When the input contains three or more related drafts, run:

sentence skeleton. When the input contains three or more related drafts, run:

demo-384.avif

demo-750.avif

demo.avif

.codexignore

.pre-commit-hooks.yaml

git_blob = hashlib.sha1(f"blob {len(gif_bytes)}\0".encode() + gif_bytes).hexdigest()

const blob = createHash('sha1').update(`blob ${bytes.length}\0`).update(bytes).digest('hex');

run: node ../../.github/scripts/audit-npm.mjs

run: node ../../.github/scripts/audit-npm.mjs

export const VERSION = JSON.parse(await readFile(new URL("../../package.json", import.meta.url), "utf8")).version;

import { result } from "../../tests/fixtures/mcp-transport.mjs";

const rescueScript = fileURLToPath(new URL("../../../scripts/rescue.py", import.meta.url));

const endpoint = `http://127.0.0.1:${server.address().port}/v1/deslop`;

return `http://127.0.0.1:${server.address().port}`;

assert.equal(validateBaseUrl("http://127.0.0.1:9999"), "http://127.0.0.1:9999");

for href in ("https://localhost/zero-slop.zip", "https://127.0.0.1/zero-slop.zip",

sentence skeleton. When the input contains three or more related drafts, run:

Access is free, without an API key. REST and MCP share capacity and usage limits,

everything. Make sure MCP access and API keys are actually available on Free,

repository-dispatch endpoint. The scheduled sync works without that token.

7. Read `GET https://mcp.zero-slop.ai/internal/counters` with the report token

Gates applied: no_behavioural_pass.

Audited 2026-09-13 · audit v0.4.0 · source sha 4f6d6a421bf1 · full audit: observations/trust-audit/mcp-server/manavmishra__zeroslop.json · Report an issue or request a re-scan

Audit history

Alternatives

Other servers in the same categories, safer ones first.

Questions