
A new and better way to manage modular Git projects

Bump.sh
Spectral
Optic
MuleSoft
Boomi
Gravitee.io
Traefik
Detect breaking API changes before merge. Works with GitHub, GitLab, Bitbucket, and any CI/CD pipeline. Zero config. Free to start.

Website, pricing, platforms and company facts side by side.
|
|
|
|
|---|---|---|
| Website | gitmodules.com | coderifts.com |
| Pricing | ||
| Platforms | — | |
| Company | — | 2026 |
| Listed in |
In their own words, as submitted to SaaSHub.


No description of Git X-Modules yet.
CodeRifts detects breaking changes in OpenAPI schemas on every pull request. It scores risk across 4 dimensions (revenue impact, blast radius, app compatibility, security), enforces governance policies before merge, and translates technical API changes into business impact — blast radius,...
What each product offers, as listed by its team.


Possible disadvantages
An editorial look at what each product does well and who it suits.


Overall verdict
Why this product is good
Recommended for
Overall verdict
Why this product is good
Recommended for
Walkthroughs and reviews on video.
Git X-Modules — submodules done right! A better way to manage modular Git projects
More videos
No CodeRifts videos yet. You could help us improve this page by suggesting one.
How often each product is chosen within a category, 0–100% relative to the other.


As answered by people managing Git X-Modules and CodeRifts.
CodeRifts's answer:
A field rename broke a POS system across 19 restaurants for a week. The PR passed review, tests were green, nobody checked the contract. CodeRifts started as the check that catches this before merge. Then the author of the change stopped being a person: AI agents now propose and execute contract changes, and the question became not just "is this safe" but "was this authorized, and can you prove it later" — which is what the signed, offline-verifiable gate answers.
CodeRifts's answer:
Node.js and Express; Ed25519 signatures with a pinned public keyring; PostgreSQL on Railway; an MCP server with three tools listed in the official MCP Registry; the GitHub Apps and Checks API for merge enforcement; a JavaScript and Python receipt verifier (MIT); Cloudflare Pages for the site. Verified live with npx @coderifts/conformance.
CodeRifts's answer:
Every decision CodeRifts makes is an Ed25519-signed receipt that anyone can verify offline — no API key, no account, no CodeRifts server in the loop. The verdict is a named state (CONTINUE, CONTINUEWITHMONITORING, REQUEST_APPROVAL, STOP), not a score, and it ships with its own published limits: seven "does not prove" statements served live at /.well-known/coderifts.json. Where authorization cannot be established, the answer is never an assumed yes.
CodeRifts's answer:
Diff tools tell you what changed in a contract. CodeRifts decides whether an AI agent may proceed with that change, spends a single-use grant on execution, and keeps the GitHub required check red until the grant exists — and the evidence survives us: the receipt verifies against a pinned key snapshot with a public MIT verifier. If your question is "who allowed that, and can I prove it without trusting the vendor's database", that is the difference.
CodeRifts's answer:
Three people. The one who runs AI agents in production and needs "who allowed that change" to be more than a log line they also control. The one adding a gate to an agent runtime who needs a state to branch on, not a score. And the one an auditor will ask, who needs evidence that survives the vendor. If none of these is you yet, you probably do not need this today.
CodeRifts's answer:
Share your experience with using Git X-Modules and CodeRifts. For example, how are they different and which one is better?