Agent Quickstart — CodeRifts

Wire it into your agent

Three steps: guard your tool calls, adopt the policy, read the verdict.

1

Add the preflight guard

Put a guard in front of your agent's API and tool calls. It asks CodeRifts whether the contract is safe before the call runs. CodeRifts ships ready-made, drop-in snippets per framework. Fetch the one for your stack (LangGraph, AutoGen, and more):

Fetch the snippet for your framework

curl https://app.coderifts.com/api/v1/snippets/langgraph
# full framework list: https://app.coderifts.com/api/v1/snippets

The guard sends the old and new contract to CodeRifts and aborts when the verdict is unsafe. The pattern, in any framework:

guard.py

import requests

CODERIFTS = "https://app.coderifts.com/api/v1/diff"
HEADERS   = {"Authorization": "Bearer YOUR_API_KEY"}

def coderifts_guard(old_spec, new_spec):
    verdict = requests.post(
        CODERIFTS, headers=HEADERS,
        json={"old_spec": old_spec, "new_spec": new_spec},
    ).json()
    if verdict["decision"] == "BLOCK" or verdict["safe_for_agent"] is False:
        raise RuntimeError("CodeRifts blocked an unsafe API change: " + verdict["decision"])
    # safe: proceed with the tool call

No key yet? The keyless /api/v1/public/preflight endpoint gives you a verdict for trying it out. The framework snippets show the exact wiring for each runtime.

2

Adopt the recommended policy

CodeRifts publishes a default agent policy: preflight before every tool call, abort on block. Fetch it and enforce it as-is, or customize:

Default agent policy

curl https://app.coderifts.com/api/v1/policy/default

policy/default response

{
  "policy": {
    "name": "CodeRifts Default Agent Policy",
    "rules": [
      {
        "trigger": "before_tool_call",
        "condition": "any_api_call",
        "action": "preflight_check",
        "on_block": "abort_execution",
        "on_warn": "proceed_with_caution"
      }
    ]
  }
}

3

Read the verdict (Decision Spec)

Every CodeRifts response leads with a machine-readable Decision Spec. The verdict comes first in the payload, so a truncating or streaming agent still gets it:

Decision Spec verdict

{
  "decision": "BLOCK",
  "safe_for_agent": false,
  "risk_score": 60,
  "breaking_changes": 4,
  "requires_migration": true,
  "evidence_quality": "high",
  "patterns": ["AUTH_SCHEME_REMOVAL", "ENDPOINT_REMOVAL", "TYPE_NARROWING"],
  "coderifts_version": "1.0",
  "coderifts_governance": {
    "mcp_config": { "url": "https://app.coderifts.com/mcp", "transport": "streamable-http" }
  }
}

Your agent acts on two fields: safe_for_agent (boolean: the agent must not call the updated API when this is false) and decision (one of ALLOW, WARN, REQUIRE_APPROVAL, BLOCK). The full contract is published as a JSON Schema you can validate against:

The Decision Spec schema

curl https://app.coderifts.com/api/v1/decision-spec/schema
# $id: https://coderifts.com/decision-spec/v1.0.json

Native discovery via MCP

CodeRifts is an MCP server. Point your agent at it and 7 governance tools appear automatically, with no integration code.

MCP endpoint

MCP endpoint:  https://app.coderifts.com/mcp   (transport: streamable-http)
Manifest:      https://coderifts.com/mcp.json
Registry:      io.github.coderifts/api-governance

See the full 7-tool list and per-tool REST endpoints on the MCP Integration page.

Endpoints used in this guide

Endpoint	Purpose	Auth
`POST /api/v1/diff`	Full verdict on an OpenAPI / GraphQL / gRPC / AsyncAPI change	key
`GET /api/v1/public/preflight`	Keyless preflight verdict	none
`POST /api/v1/agent-readiness-score`	0-100 agent-readiness score for a spec	key
`GET /api/v1/decision-spec/schema`	The Decision Spec JSON Schema (the contract)	none
`GET /api/v1/policy/default`	Recommended agent policy	none
`GET /api/v1/snippets/{framework}`	Framework integration snippets	none

Get a free API key

Add CodeRifts to your AGENTS.md

Coding agents read AGENTS.md as procedural memory, and more than 60,000 repositories already ship one. Paste this section so any agent working in your repo runs an API-safety check before it merges.

AGENTS.md

## API safety

Before merging changes to API schemas, OpenAPI specs, or
.github/workflows files, get a CodeRifts verdict:

- PR gate: the CodeRifts GitHub App comments on the PR; do not merge
  when the check conclusion is failure or safe_for_agent is false.
- Direct check: POST https://app.coderifts.com/api/v1/public/actionguard-check
  for workflow changes (no auth), or use the MCP tools at
  https://app.coderifts.com/mcp.

Treat WARN findings as review-required, not auto-mergeable.

Make Your AgentAPI-Safe in 3 Steps