Documentation

Everything needed to use isitslop.org as a person, as a program, or as a tool inside an AI assistant. This page is the documentation URL for directory listings; it is kept accurate with every release.

1. What it is

Is it slop? gives software one public number: how sloppy it is, from 0% to 100%. Two measurements, each out of 100. Quality is read from the GitHub repository: commits by humans other than the author, maintenance over the last year, issues filed. Popularity is read from the owner's Google Analytics: reach, and how many visitors come back. Average the two and subtract from 100.

Only verified owners can list a thing, every rule is code, and the methodology page is generated from the code that computes the score. No model is involved: heuristics only. Operated by API Blaze, LLC; MIT licensed at github.com/jayjaychicago/isitslop.

2. Using the website

Look something up

Type a domain or a GitHub repository into the search box on the home page. Anything in the index shows its score, verdict and history. Anything not in the index can be previewed: the Quality signals of any public repository are shown without creating an entry.

Get your own thing scored

1. Claim it at /claim. Sign in with GitHub. A repository is yours if your account can push to it. A website is yours after a DNS TXT record, a file at a well-known path, or an email to admin@ your domain. Nothing is listed before this passes.
2. Connect the sources. Link the repository that builds the thing (private repositories work and are never named), and connect the Google Analytics 4 property with your own Google sign-in. Both are read-only.
3. Request a grade. Accept the terms, the rules run, the result is published on your entry page and the home page. Popularity refreshes daily, Quality monthly, and the history stays visible.
4. Disagree? Appeal from the entry page. Appeals and their answers are public.

3. Score API

One call: the current score of a URL. Served at https://api.isitslop.org through an API gateway; interactive docs, a playground and your usage are in the developer portal.

Get a key

Sign in with GitHub on the API page and create a key. Keys are free, tied to your GitHub account, and can be revoked there at any time. Send the key as the X-API-Key header.

Request

curl -H "X-API-Key: $ISITSLOP_API_KEY" "https://api.isitslop.org/score?url=apiblaze.com"

The only parameter is url: a website such as example.com or a repository such as github.com/owner/repo. Schemes and www. are ignored.

Response

{
  "found": true,
  "url": "https://apiblaze.com",
  "sloppy": 60,
  "quality": 79,
  "popularity": 0,
  "verdict": "fringe_craft",
  "label": "Fringe Craft",
  "gradedAt": "2026-11-03T14:09:50.189Z",
  "page": "https://isitslop.org/s/38f774a9-0e5f-4fe4-ba46-5ec0716a3233"
}

Errors

Nothing about the caller is stored beyond the gateway's usage counters. The OpenAPI 3.1 description is at /openapi.yaml.

4. MCP connector

The same lookup as a tool for AI assistants, over the Model Context Protocol. It is a remote server at https://mcp.isitslop.org using the Streamable HTTP transport, reachable over HTTPS only, and needs no sign-in: it reads public scores and nothing else. The server is run by the same operator as the website and calls the operator's own API.

Add it to Claude

1. Open Settings, then Connectors, then Add custom connector.
2. Name it Is it slop? and paste https://mcp.isitslop.org as the URL. No OAuth client is needed.
3. Enable it in a conversation and ask, for example: "Is apiblaze.com slop?"

Add it to Claude Code or another client

claude mcp add --transport http isitslop https://mcp.isitslop.org

Any client that speaks Streamable HTTP can use the URL directly. The MCP Inspector works with the same URL for testing.

Tools

There are no write tools. The tool never modifies anything on isitslop.org or anywhere else, never reads the conversation, and takes only the one URL it is given. Example prompts: "How sloppy is github.com/honojs/hono?", "Compare the isitslop scores of these three sites."

Errors from the tool

A URL that is not in the index returns found: false with the label "Not in the index", not an error, so the assistant can say so plainly. A malformed URL returns an error message naming the problem. The server answers within a second; scores are precomputed, so a call does no grading.

5. Data handling

The full policy is at /privacy. In short:

• The API and the connector read public data only. A score lookup stores nothing about the caller or the conversation. The gateway keeps per-key usage counts for quotas.
• Owners' Google data is turned into two subscores and discarded. No visitor counts, no property names, nothing from Google is kept in a grade. The connection itself is stored encrypted and erased on disconnect or delete.
• Repositories are read with the owner's own GitHub token, read-only. Private repositories are scored but never named.
• Processors: Cloudflare (API and edge), Vercel (website), Neon (database), Amazon SES (email), Google Analytics (the site's own visit counts), apiblaze (API gateway and keys).
• Retention: an entry and its grades stay until the owner or the operator deletes them. Sessions last 30 days. Feedback and contact messages are emailed, not stored.
• Your rights: delete your entry yourself from its page, or write to us through the support form.

6. Security

• Every endpoint is HTTPS only. The MCP server and the score API live on the operator's own domains.
• Public reads need no credentials and expose nothing that is not already on the website.
• Owner actions require a GitHub sign-in session or the owner key returned by verification. Stored GitHub and Google tokens are encrypted at rest with a key held only by the API.
• API keys are per user, revocable instantly from the API page, and never shown again after creation.
• The connector exposes one read-only tool with no free-form request construction, so there is nothing for a prompt to redirect.
• Report a vulnerability through the support form. We acknowledge within two working days and fix before disclosure. The code is public, so you can also open a pull request.

7. Reliability and limits

• Public reads are served from Cloudflare's edge with a cache of up to a minute, so a lookup does not touch the database on every call.
• Score API keys carry a quota shown in the developer portal. The website's own endpoints are rate limited per IP.
• Grades are precomputed. Popularity refreshes daily at 04:10 UTC, Quality on the first of each month; owners can request a fresh grade up to five times a day.
• If a refresh fails, the previous grade stays, the entry shows why, and the operator is alerted.

8. Support

The support form, or an issue at GitHub. Bugs and rule changes are welcome as pull requests. A wrong score on your own entry is best raised as a public appeal from its page.

9. Versions and changes

The score API is version 1.0.0 and its shape is stable; new fields may be added, existing ones are not removed or renamed. The scoring rules carry their own version, shown on the methodology page and in every grade, so a change in the rules is visible in the history. Changes are announced on the blog, and every change is a commit in the public repository.

10. Directory listing kit

What a connector directory such as Anthropic's asks for, and where each item is. Anthropic's own requirements are at claude.com/docs/connectors/building/submission.

Listing text