Fifteen rules enforce one narrow TypeScript philosophy
anti-slop targets code that compiles while discarding information the type checker once knew. Its 15 generic rules reject patterns such as chained assertions, parameters typed as object, contracts returning unknown, module mocking, Reflect.get, and dictionaries whose values use weak types. Another rule requires a safety comment before every non-const assertion. The premise is coherent: make unsafe boundaries explicit and keep precise inferred types intact for as long as possible.
This is policy, not a neutral correctness layer. no-runtime-typeof rejects ordinary narrowing outside type predicates unless its option allows guards. no-module-mocking pushes tests toward dependency seams. no-shape-in-symbol-names even rejects the word shape in identifiers. A team adopting all 15 rules is agreeing to a style of architecture and testing, not merely catching syntax mistakes. Read every rule before letting an installation agent switch them all to errors.
The plugin belongs in your repository, not node_modules
The README explicitly says to vendor the source. Manual setup means copying src/ into a tool directory, installing matching current versions of Oxlint and its plugin package, registering a local TypeScript entry point, merging a list of agent-directory ignores, and enabling the rules. The supplied skill can do that initial work and validate the result. Afterward, the copied files belong to your project.
That choice makes local edits simple. A team can weaken no-runtime-typeof, remove a rule that conflicts with existing boundaries, or add project-specific tests without waiting on an upstream release. It also removes the normal package update path. Open issue 13 asks for an npm package because vendored code is harder to update. There is no latest GitHub release, so buyers cannot use release tags as a clean upgrade ledger either.
What happened when we ran it
Our sandbox installed 11 pnpm packages in 25 seconds and consumed 64 MB on disk. The checkout at commit 6d53855 held 66 files, roughly 5,236 source lines, and measured 0.2 MB before installation. There was no build target, so we skipped the build rather than inventing one. The repository's test command succeeded in 10 seconds.
Those numbers describe the plugin repository, not the cost of applying it to a mature codebase. We did not run its rules across another project or count violations, so our run says nothing about migration volume. The repository has one CI workflow and no Dockerfile or tests directory. The successful command is still useful evidence that the checked-out rule suite completed in a fresh Node 22 Debian container without secrets.
False positives can turn a principle into cleanup work
Open issue 18 gives the most useful adoption evidence. Its reporter ran no-known-value-widening over a 568,000-line TypeScript monorepo and found that 117 of 150 binding-position reports involved Record with a closed union of keys. In those examples, replacing the annotation with satisfies preserved the same missing-key checks and type information. The issue argues that 78 percent of that cohort creates churn without recovering evidence.
Other open reports are narrower but point in the same direction. Issue 29 says unions containing unknown can evade one rule, while issue 24 says an empty SAFETY marker can satisfy the assertion-comment check. Issue 27 reports that a valid safety comment above an exported constant is missed. These are normal problems for young static-analysis rules, yet they matter because anti-slop recommends enabling every generic rule as an error. Trial it on a representative directory before making CI block the whole repository.
Oxlint is required and ESLint support is absent
The configuration examples register JavaScript plugins through Oxlint or Vite+. Open issue 23 asks for ESLint support because some projects cannot replace their current linter. The README offers no ESLint adapter. Teams with custom ESLint rules, editor integrations, or shareable configs must decide whether running a second linter is worth the extra command and configuration.
Effect projects get one additional rule in a separate plugin. It rejects relative imports of exported service constructors outside test files and pushes runtime callers toward the owning Layer and contextual service. Keeping that rule opt-in prevents an Effect architecture preference from affecting ordinary projects. Package imports and static constructors remain outside its scope, which is more careful than applying a name pattern everywhere.
August issue traffic shows interest, not settled behavior
GitHub recorded 3,704 stars, 19 combined open issues and pull requests, and a last push on August 18, 2026 when we fetched the repository. Issue updates continued through August 24, including detailed reports with proposed patches. That is active user scrutiny. It also means several edge cases and distribution questions remain unresolved after the last push.
anti-slop is worth a branch-level trial for teams already unhappy with how easily TypeScript assertions and broad types spread. The 25-second install and 10-second passing test run make inspection cheap. Adoption is the expensive part: review each diagnostic, measure noise in your own code, keep the rules that expose real risk, and accept that your vendored copy is now part of the codebase you maintain.