API Contract Governance
for the Agent Era
When AI agents call your APIs, breaking changes don't just affect users — they break autonomous workflows. CodeRifts catches contract breaks before they reach production. Tested and validated production-grade by Grok (xAI) on a real agent tool stack.
Validated by
“Flags matched exactly as described, including the 0–100 scores and agent impact notes. Zero false positives.”
“The /registry-validate endpoint is exactly the registry-level guardrail we need.”
Latest“Catching breaks at the PR, before they cascade into agent workflows, is the right enforcement point. Solid pattern.”
The Problem: Agents Depend on Stable Contracts
AI agents are the fastest-growing API consumers. And they are the most fragile.
Agents call APIs via MCP, A2A, and function calling
AI agents depend on stable API schemas to function. When a field is renamed, a type changes, or an endpoint is removed, agents built on that schema silently break.
No tool catches this before deployment
Observability tools like Datadog and Arize alert after the break. By then, autonomous workflows have already failed, data has been lost, and users are affected.
Enterprise platforms are pivoting away
MuleSoft, Boomi, and Gravitee are building agent frameworks. They are leaving API contract governance behind — the very foundation agents depend on.
Breaking changes are invisible until production
A field rename in one service can cascade through dozens of agent integrations. Without contract enforcement at the PR level, these breaks ship undetected.
What CodeRifts Does for Agent-Dependent APIs
Six capabilities purpose-built for the agent era.
AI-Generated Spec Safety
Detects AI-generated schemas and flags quality risks across 7 signals — hallucinated endpoints, inconsistent naming, missing constraints, and more.
Generator-Aware Risk Scoring
Applies a 1.5x risk multiplier when specs are auto-generated. AI-produced schemas carry higher inherent risk — CodeRifts accounts for that.
SDK Surface Coverage
Shows how many downstream consumers — including agent integrations — a breaking change affects. Know the blast radius before you merge.
Policy Engine
Freeze windows, breaking budgets, and approval gates protect agent-critical endpoints. Define rules once, enforce them on every pull request.
PR-Native Enforcement
Catches breaks before merge, not after agent failures in production. Every pull request gets a full risk report — zero configuration required.
Agent Tool Schema Registry
Register your agent tool schemas, then check every new version against the registered production schema. CodeRifts blocks breaking drift before redeploy, logs it as an incident, and can fire a webhook alert — so a renamed or removed field never silently breaks your agents.
Verdicts you can prove
Every CodeRifts verdict returns an Ed25519-signed chain receipt. The public key is published - any external party can verify any receipt without an account. Broken chain plus a destructive action escalates to REQUIRE_APPROVAL, fail closed. Determinism survives the crypto: the receipt lives outside the hashed verdict body, so the same input still yields a byte-identical fingerprint.
Query our docs, do not just crawl them
CodeRifts documentation is a live MCP endpoint. Agents can query it in natural language and get answers grounded in our actual docs, with source links - no scraping, no guessing. Point your agent at the MCP server below, or use the search endpoint directly.
MCP server https://91e8f0b5-daeb-4ba7-9114-69956d8d3f96.search.ai.cloudflare.com/mcp
search https://91e8f0b5-daeb-4ba7-9114-69956d8d3f96.search.ai.cloudflare.com/search
chat https://91e8f0b5-daeb-4ba7-9114-69956d8d3f96.search.ai.cloudflare.com/chat/completionsEvery Tool Tells You What Broke
Datadog shows you what broke. Arize tells you when your agent fails. CodeRifts is the only PR-native governance layer with deterministic, independently verifiable signed verdicts — at the pull request.
Observability
Alerts after the break
Datadog, New Relic, Grafana
Agent Monitoring
Detects agent failure
Arize, LangSmith, Weights & Biases
CodeRifts
Prevents the break
At the pull request, before merge
Agent Governance Roadmap
Purpose-built contract enforcement for every agent protocol.
MCP Server Contract Enforcement
Validate Model Context Protocol server schemas against breaking changes before deployment.
A2A Protocol Governance
Agent-to-Agent protocol contract validation. Ensure inter-agent communication schemas remain stable.
Multi-Provider LLM Spec Governance
Govern API specifications across multiple LLM providers. Detect schema drift between provider versions.
Try the Agent Readiness Score
Score any OpenAPI spec for agent-readiness across 9 signals. Returns a 0–100 score with per-signal diagnostics.
POST /api/v1/agent-readiness-score
curl -X POST https://app.coderifts.com/api/v1/agent-readiness-score \
-H "Authorization: Bearer $CODERIFTS_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"spec": {
"openapi": "3.0.3",
"info": { "title": "Payments API", "version": "2.1.0" },
"paths": {
"/payments": {
"post": {
"operationId": "createPayment",
"security": [{ "bearerAuth": [] }],
"requestBody": {
"content": {
"application/json": {
"schema": {
"type": "object",
"required": ["amount"],
"properties": {
"amount": { "type": "number" },
"currency": { "type": "string", "enum": ["USD","EUR","GBP"] }
}
}
}
}
},
"responses": {
"200": {
"description": "Payment created",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"id": { "type": "string" },
"status": { "type": "string" }
}
}
}
}
}
}
}
}
},
"components": {
"securitySchemes": {
"bearerAuth": { "type": "http", "scheme": "bearer" }
}
}
}
}'Requires a beta API token. Get your token →
Get Ahead of Agent Contract Breaks
Start catching breaking changes today. Join the waitlist for agent-specific governance features.
Join the Waitlist for Agent Contract Governance
Be the first to know when MCP, A2A, and multi-provider governance features ship.
No spam. Only agent governance updates.