CodeRifts
Contract-change decisions with signed, offline-verifiable receipts: a change to an API or MCP contract merges only with a grant bound to that exact change.
Contract-change decisions with signed, offline-verifiable receipts: a change to an API or MCP contract merges only with a grant bound to that exact change.
This page is designed to help you find out whether CodeRifts is good and if it is the right choice for you.
CodeRifts decides whether a change to an API or MCP contract may merge, and signs the decision.
A GitHub App and a GitHub Action post two checks on every pull request that touches a contract file: CodeRifts / issuer and CodeRifts / contract-gate. Require both in branch protection, and a breaking change cannot merge until someone grants that exact change.
Every decision comes with a signed receipt you can verify offline, without asking CodeRifts.
A Claude Code plugin refuses an agent's breaking edit to a contract file before it lands; the pull-request check stays the backstop. An MCP server lets an agent ask before it changes a contract.
Formats: OpenAPI 3.0/3.1, GraphQL, gRPC/protobuf, AsyncAPI and MCP tool manifests. What each format covers, and what it does not, is measured and published: https://coderifts.com/docs/#format-coverage
What it does not prove is published too: https://coderifts.com/verify/
Built on oasdiff for OpenAPI.
Listed in
Signed decision receipts
Every decision comes with a signed receipt you can verify offline, without asking CodeRifts.
Policy Engine
Breaking budgets, freeze windows, approval matrix
Breaking Change Detection
10+ change types, OpenAPI schemas
Offline Verification (OVSE)
A public, MIT-licensed verifier checks any receipt with no API key, no account and no CodeRifts server in the loop.
MCP server with three tools
preflight_change_set, verify_receipt and get_decision_details, listed in the official MCP Registry; works with Claude Code, Cursor and custom hosts.
Merge enforcement on GitHub
A required, app-bound status check stays red until a grant exists; enforce_admins on, workflow pinned by SHA.
Published proof boundaries
The 'does not prove' limits are served live at /.well-known/coderifts.json — what a decision does not establish is a field in the output, not a footnote.
Named-state verdicts
CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL or STOP — a state you can branch on, never a score or a boolean.
Single-use grants
One grant, one execution; an adapter that cannot prove atomic consumption cannot report the atomic success state.
Guarded tool table for AI agents
In the tool table handed to the agent, an ungranted mutation does not exist — nothing to call, not an error.
Multi-protocol contract diff
Breaking-change detection for OpenAPI, GraphQL, gRPC, AsyncAPI and MCP tool schemas, with the same signed verdict on every path.
A field rename broke a POS system across 19 restaurants for a week. The PR passed review, tests were green, nobody checked the contract. CodeRifts started as the check that catches this before merge. Then the author of the change stopped being a person: AI agents now propose and execute contract changes, and the question became not just "is this safe" but "was this authorized, and can you prove it later" — which is what the signed, offline-verifiable gate answers.
Node.js and Express; Ed25519 signatures with a pinned public keyring; PostgreSQL on Railway; an MCP server with three tools listed in the official MCP Registry; the GitHub Apps and Checks API for merge enforcement; a JavaScript and Python receipt verifier (MIT); Cloudflare Pages for the site. Verified live with npx @coderifts/conformance.
Every decision CodeRifts makes is an Ed25519-signed receipt that anyone can verify offline — no API key, no account, no CodeRifts server in the loop. The verdict is a named state (CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP), not a score, and it ships with its own published limits: the "does not prove" statements served live at /.well-known/coderifts.json. Where authorization cannot be established, the answer is never an assumed yes.
Diff tools tell you what changed in a contract. CodeRifts decides whether an AI agent may proceed with that change, spends a single-use grant on execution, and keeps the GitHub required check red until the grant exists — and the evidence survives us: the receipt verifies against a pinned key snapshot with a public MIT verifier. If your question is "who allowed that, and can I prove it without trusting the vendor's database", that is the difference.
Three people. The one who runs AI agents in production and needs "who allowed that change" to be more than a log line they also control. The one adding a gate to an agent runtime who needs a state to branch on, not a score. And the one an auditor will ask, who needs evidence that survives the vendor. If none of these is you yet, you probably do not need this today.
We have collected here some useful links to help you find out if CodeRifts is good.
Check the traffic stats of CodeRifts on SimilarWeb. The key metrics to look for are: monthly visits, average visit duration, pages per visit, and traffic by country. Moreoever, check the traffic sources. For example "Direct" traffic is a good sign.
Check the "Domain Rating" of CodeRifts on Ahrefs. The domain rating is a measure of the strength of a website's backlink profile on a scale from 0 to 100. It shows the strength of CodeRifts's backlink profile compared to the other websites. In most cases a domain rating of 60+ is considered good and 70+ is considered very good.
Check the "Domain Authority" of CodeRifts on MOZ. A website's domain authority (DA) is a search engine ranking score that predicts how well a website will rank on search engine result pages (SERPs). It is based on a 100-point logarithmic scale, with higher scores corresponding to a greater likelihood of ranking. This is another useful metric to check if a website is good.
The latest comments about CodeRifts on Reddit. This can help you find out how popualr the product is and what people think about it.
Do you know an article comparing CodeRifts to other products?
Suggest a link to a post with product alternatives.
Is CodeRifts good? This is an informative page that will help you find out. Moreover, you can review and discuss CodeRifts here. The primary details have been verified within the last quarter. So they could be considered up to date. If you think we are missing something, please use the means on this page to comment or suggest changes. All reviews and comments are highly encouranged and appreciated as they help everyone in the community to make an informed choice. Please always be kind and objective when evaluating a product and sharing your opinion.
