Picture an AI coding agent finishing a Laravel task in a few minutes. The tests pass, the types check and the pull request looks tidy. Buried in the middle is a try block with an empty catch. If the upload to storage ever fails, nobody will know. Nothing is technically wrong, and that is exactly the problem.
That is why a small package that appeared on Laravel News on 27 October caught my eye. It is called Sloppy, and it goes after the mess that AI-written PHP tends to leave behind.
What happened
Sloppy, by heyosseus, is a static analysis tool for the maintenance problems coding agents can leave in PHP projects. According to Yannick Lyn Fatt's write-up on Laravel News, it runs locally, needs no model or API key, and checks for things like swallowed exceptions, duplicate logic, unused constructor dependencies, redundant conditions and unfinished method bodies. It does not try to guess whether a human or an AI wrote the code. The same rules apply to both.
In Laravel projects it adds checks for controller responsibilities and Eloquent use. One example from the article is PodcastEpisode::all()->where('status', 'published')->count(), which loads every row into memory before filtering. Sloppy flags it (rule SL205) and points you to PodcastEpisode::query()->where(...)->count(), so the database does the work. It also looks for possible N+1 queries, queries inside loops and placeholder code such as a "not implemented" exception.
The part I find most interesting is the agent integration. Running vendor/bin/sloppy agents install adds project rules to CLAUDE.md and hooks to .claude/settings.json. An edit hook feeds new findings back to the agent while it works, and a finish hook can send it back once to deal with anything above your threshold. Laravel News is clear that this is feedback, not a gate: the finish check blocks only once, and hook failures let the session carry on. For a real gate, you use a CI check. There are also hooks for Gemini CLI and Codex and an MCP server for on-demand analysis.
Sloppy needs PHP 8.3 or later, supports Laravel 12 and 13, and is MIT licensed. It is meant to sit alongside PHPStan, Psalm, Laravel Pint and your test suite, not replace them.
Why it matters
Most of the code review tools we already trust answer one question: is this code valid? Types line up, formatting is consistent, tests go green. AI agents are very good at passing those checks. What they are less good at is the boring judgement a senior developer applies without thinking: what happens when this fails, does this query scale past a hundred rows, and did I actually finish this method?
Those are maintenance problems, and they don't show up on launch day. They show up six months later as a slow dashboard, a missing invoice or a bug report nobody can reproduce. When a team adds an agent to its workflow, the volume of code goes up, and so does the volume of these quiet problems.
For business owners, this is the real cost of "AI wrote it in an afternoon". The afternoon is cheap. The cleanup is not, unless someone builds the checks in from the start.
How I would use it on a real Laravel app
Most of my work is on long-running business systems, like the platform a UK repair business runs its day on and a point-of-sale built for repair shops. These are not throwaway prototypes. They handle bookings, payments, stock and invoices, so a swallowed exception is not a style issue. It is lost money.
On a codebase like that, I would roll Sloppy out in three steps.
- Baseline first. Run
vendor/bin/sloppy baselineso existing findings are recorded and don't drown the team on day one. Old debt gets its own ticket, not a panic. - Review only what changed. Use
vendor/bin/sloppy review main --merge-baseon every branch. It compares against the common ancestor withmain, orders findings by risk and uses fingerprints rather than line numbers, so adding an import doesn't make an old finding look new. - Gate in CI, nudge in the agent. Install the agent hooks so the coding agent gets feedback while it works, but make the CI check the thing that actually blocks a merge. The hooks are deliberately soft, so don't treat them as a safety net.
I would also turn on the diff checks that flag tests a change skips, removes assertions from, or weakens with an assertion that cannot fail. It is one of the sneakier ways a change can turn a red test green without fixing anything.
Pitfalls to watch
- Auto-fix is not review.
php artisan sloppy:fix --dry-runpreviews mechanical fixes through Rector and Pint. Splitting a large class or merging two similar methods still needs a human decision. - A finding is a question, not an answer. Sloppy can tell you an exception was swallowed. It can't tell you whether the right move is to retry, report or let it fail. That depends on the business process.
- Don't stack tools blindly. If PHPStan, Pint and Sloppy all report on every commit, people start ignoring all three. Decide which one blocks and which ones advise.
This connects to two things I have written about recently: the folder rules I set for AI coding agents and the patch checklist I run on every Laravel app. Same idea each time: let the agent move fast, and put the guardrails where it can't skip them.
A short checklist
- Confirm you are on PHP 8.3+ and Laravel 12 or 13.
- Install Sloppy as a dev dependency and record a baseline.
- Review new findings per branch with
--merge-base. - Add the agent hooks for feedback, and a CI check for the real gate.
- Watch for weakened or skipped tests in every agent-written change.
- Keep a person deciding what a failure should mean.
Want this set up on your codebase?
If your team is shipping more code with Claude, Codex or Cursor and you want the speed without the slow build-up of hidden problems, this is the kind of thing I put in place as part of my AI agent and Laravel development work. Book a free call and tell me what your stack looks like. I'll tell you honestly what I would check first.
Mubashir HussainForward deployed engineer