CodeRifts

On every pull request that changes an API contract (OpenAPI, GraphQL, gRPC, AsyncAPI, MCP tool manifests), CodeRifts decides whether the change may proceed and issues a signed receipt you can verify offline — no key, no call back to us. Once your branch protection requires the check, a contract change stays red until a grant exists. Every decision names what it proves and what it does not.

Only a granted change can proceed.

CodeRifts is a gate for API-contract changes made by people and by AI agents. On every pull request that touches a contract artifact it computes the change, decides whether it may proceed, and issues an Ed25519-signed receipt bound to the head commit, the change fingerprint and the issuing App.

How it works

1. Install CodeRifts on a repository.
2. In branch protection, require the check CodeRifts / issuer. Until it is required, the check is advisory. For the full gate, add the contract-gate Action as a second required check (CodeRifts / contract-gate): https://github.com/marketplace/actions/coderifts-contract-gate
3. Open a pull request that changes a contract — the check stays red without a grant; a config-only change is green.

What it decides on

Removed endpoints and fields, changed types, newly required request fields, removed enum values, auth-scheme changes, MCP tool-description drift (a schema that did not change can still carry a new instruction), and tool-schema drift for agent tools.

What you get

• A required GitHub check (CodeRifts / issuer) that is red without a grant and bound to this App's id — a check with the same name from another app does not satisfy it
• A PR comment naming the breaking changes and the next step
• A signed, offline-verifiable receipt — verify it with the MIT verifier, no key needed: https://coderifts.com/verify/
• Every decision names its limits: what it proves, and what it does not

Configuration

.coderifts.yml names the contract artifacts to track. Enforcement is a branch-protection setting, not a config key: policy keys describe the analysis, they do not move the grant.

Free during beta. Free covers public repositories; private authorization and enforcement are on Team.

Docs: https://coderifts.com/docs/ · Install: https://coderifts.com/install/ · Trust Center: https://coderifts.com/trust-center/