CodeRifts

CodeRifts provides contract-change authorization and governance for AI agents and API teams. Its diff engine checks OpenAPI 3.0 and 3.1 specifications for breaking changes, including removed endpoints, added required fields, changed response types, authentication changes and parameter modifications. It can find matching .yaml, .yml and .json specification files in repositories. Security analysis flags weakened authentication, and schema scans identify newly added or modified fields such as SSNs, credit-card numbers and passports with GDPR/CCPA warnings. Teams can define YAML rules in .coderifts.yml for limits, deprecation and authentication requirements; the policy engine can block merges that break those rules. Documented integrations include GitHub App, GitHub Actions, GitLab CI, Bitbucket Pipelines, REST API and CLI. Its MCP server provides tools for preflighting changes, verifying receipts and retrieving decision details. CodeRifts says it processes specifications in memory and discards them after analysis, retaining derived verdicts and metadata instead of schema bodies or source code. The free plan includes 1,000 authorization cases/month. The Team plan is $149 a month, billed free during beta.

CodeRifts focuses on detecting API contract changes and enforcing team-defined rules through repository and CI integrations. Its free plan has a monthly authorization-case limit, while Team is billed free during beta.

CodeRifts may suit API teams and developers who want governance checks for OpenAPI contract changes in CI workflows. Its policy controls also address teams seeking merge blocks for specified contract requirements.

CodeRifts is a governance tool for teams managing OpenAPI contracts and AI-agent authorization. It best suits API teams that want breaking-change checks and policy enforcement inside their repository workflow. Its focused controls are useful, though beta terms and the lack of a formal SLA may rule it out for teams that need established service commitments.

Overview

CodeRifts evaluates changes to OpenAPI 3.0 and 3.1 specifications, with an emphasis on whether a proposed change breaks compatibility or violates team rules. It can block merges when YAML policies in .coderifts.yml fail, making it more than a reporting tool for teams that want governance decisions to affect delivery.

Its data approach is a meaningful consideration for organizations reviewing source exposure: specifications are processed in memory and discarded after analysis, while verdicts and metadata are retained rather than schema bodies or source code. The GitHub App still needs pull-request read/write, contents read, checks write and metadata read permissions, so teams should weigh those access rights against their repository policy.

Key features

• Contract-change detection: The diff engine catches endpoint removals, newly required fields, response-type changes, narrowed enums, authentication changes and parameter modifications. This targets compatibility risks that can otherwise reach consumers unnoticed.
• Repository discovery: It finds OpenAPI specifications in matching .yaml, .yml and .json files. Automatic discovery reduces setup friction for repositories that follow those patterns, but teams with different layouts should account for the pattern requirement.
• Security and privacy checks: It flags authentication downgrades such as replacing OAuth2 with API keys, removing bearer tokens or weakening security schemes. It also scans changed schemas for fields such as SSNs, card numbers and passport numbers, with GDPR/CCPA warnings.
• Policy and delivery controls: YAML rules can set limits and require deprecation or authentication conditions, with merge blocking for violations. Documented integrations include GitHub App, GitHub Actions, GitLab CI, Bitbucket Pipelines, REST API and CLI; the CLI's npx coderifts diff command works wherever Node.js runs.
• Agent-facing tools: The MCP server provides preflight_change_set, verify_receipt and get_decision_details. These tools expose change checks and decision details to agent workflows without changing the product's core focus on contract governance.

The API allows 100 authenticated requests per API key per minute and 30 anonymous non-agent requests per IP per minute. Those ceilings matter for teams automating frequent checks and should be considered alongside plan case quotas.

Pricing

The Free plan costs free and includes a public provider-verifiable boundary, 1,000 authorization cases per month and verification at no charge. It is a sensible way to evaluate or govern a lower-volume public workload, but the case cap and public boundary make it a poor fit for private production use.

Team is $149 a month, billed free during beta. It includes a private production boundary and 10,000 authorization cases per month; overage is $15 per 1,000 cases, prorated. That moves private production use into reach, but teams should budget for usage beyond the included quota and note that the beta billing term is distinct from the stated monthly price.

Enterprise is $1,500 a month, billed per month, with a private bespoke boundary, volume-commitment authorization cases, discounted overage and unlimited users, agents and repositories. It is aimed at organizations that need scale across teams and repositories; the volume-commitment model and higher monthly cost are unnecessary for modest workloads. There is no free trial, so the Free plan is the entry point for evaluation.

Platforms

CodeRifts is available through API and web interfaces, with documented CI integrations and a Node.js CLI. The CLI can run anywhere Node.js runs, giving teams a command-line path beyond the listed API and web platforms.

Who it's for

Choose CodeRifts if your API team needs OpenAPI compatibility checks, authentication and PII warnings, and rules that can stop a merge. It is especially relevant when those checks need to fit into existing GitHub, GitLab or Bitbucket delivery workflows. Teams with private production requirements should look beyond Free to Team or Enterprise.

It is a less convincing choice for organizations that require a formal SLA or independent assurance today: the service has no formal SLA, targets 99.9% uptime, and publishes no SOC 2 report or third-party assessment. Support is available by email, but no response time is promised during public beta.

Pros and cons

• Pros: Broad breaking-change checks address concrete compatibility risks across OpenAPI 3.0 and 3.1.
• Pros: Merge-blocking YAML policies and multiple CI routes make governance enforceable in existing delivery processes.
• Pros: In-memory specification processing avoids retaining schema bodies or source code after analysis.
• Cons: Free use is capped at 1,000 authorization cases monthly and limited to a public boundary, excluding private production use.
• Cons: The service lacks a formal SLA, and no SOC 2 report or third-party assessment is published.
• Cons: GitHub integration requires write access to pull requests and checks, which may exceed some teams' preferred permission scope.

Alternatives

For a wider comparison, browse API Governance Software.

• Apiway is another freemium option with API, self-hosted and web platforms. Its free Start Free plan grants 200,000 credits on a company address or 100,000 on a personal address, once, with 100 reads and 10 writes per minute; choose it when that credit-based allowance and self-hosting matter more than CodeRifts' contract-change governance focus.
• ATA API Governance offers a free allowance of 30 endpoints, one team, three users and five Developer Studio applications, plus a Startup plan at $35.60 a year. Pick it when that endpoint-and-team allowance or its broad platform coverage better fits your setup.
• Postman has a free plan with an API client and core tools, specs and mock servers, Native Git, Collection Runner and 50 AI credits. It is the alternative to consider when those API development tools and its extension, desktop and web availability are the priority.
• Routebase gives its free plan one user, two projects, 1,000 mock requests monthly, an auto-generated docs portal and OpenAPI import/export. Choose it when mock requests and a documentation portal are a closer match than contract authorization checks.
• SwaggerHub provides free basic API design and documentation, with a free trial and a Team 1 User plan at $740 a year, billed over 12 months. Consider it when API design and documentation are the central need.
• API Architect has a free plan for one active project with essential features and community support, and a Starter plan at €29 a month for two projects, standard analytics and support in 48 hours. Choose it if project-based access and that stated support response fit better.
• Apigee API hub is available at no additional cost to eligible Apigee organizations in supported regions and requires an API hub-supported region. It is the natural alternative when those eligibility conditions are met.
• Apistaq offers a free plan of up to three APIs, 1M requests per month and one portal, and a Builder plan at $149 a month for up to 25 APIs, 10M requests and five portals. Choose it when API and portal capacity is the deciding factor.

Verdict

CodeRifts is best for API teams that need OpenAPI breaking-change detection and enforceable repository policies, particularly when merge blocking and security checks are central to their workflow. Its strongest reason to choose is the combination of detailed contract checks with CI enforcement; its strongest reason to look elsewhere is the lack of a formal SLA and published independent assessment. Start with Free for a public, lower-volume use case, but private production teams should compare the paid plans against their quota and assurance requirements.