// Blog
Engineering insights.
API governance, breaking change prevention, and developer productivity.
What Is MCP Governance?
The MCP 2026-07-28 spec takes the protocol stateless — production infrastructure that needs governance. What that means: validating tool schemas, gating actions before they run, and signing every verdict. Verified live against the endpoint.
Read article →What Is a Semver Violation — and How Do You Prove One?
A breaking change shipped in a patch or minor release breaks the version-number promise. How to detect one deterministically — and prove it with a signed, verifiable receipt, not a changelog you have to trust.
Read article →What is zero-config API governance?
Most governance tools die at the setup step. Zero-config governance is active from the first pull request - it auto-discovers your API contracts, enforces with safe defaults, and still ships a signed, verifiable verdict.
Read article →What is agent-safe API governance?
AI agents no longer just read your API - they call it and ship the changes too. Agent-safe API governance catches every contract change at the pull request and signs the verdict, so an agent can verify what changed, not just trust it.
Read article →What a breaking-change verdict should tell an AI agent
An API diff tells you what changed. An AI agent needs to know what it means, how to fix it, and whether it is safe to call. A walk through the machine-readable verdict CodeRifts returns on every diff.
Read article →A Discovery and Attestation Protocol for AI Tool Contracts
How an agent gets a current, trustworthy API contract to diff against with zero per-call config. A working sketch: contract by hash, verdict by hash, git for provenance, and the repo itself as a transparency log.
Read article →Why Registry-Level Validation Is Non-Negotiable for AI Agents
AI agents break silently when APIs change. Here is why catching breaking changes at the diff layer is not enough — and what registry-level validation actually means in practice.
Read article →Azure DevOps PR Validation for OpenAPI Specs (Breaking-Change Detection)
Learn how to add OpenAPI breaking-change detection to Azure DevOps PR validation. Practical pipeline patterns, branch policies, and rollout strategies for platform teams.
Read article →OpenAPI Breaking-Change Detection in Azure DevOps Pull Requests
Add OpenAPI breaking-change detection to Azure DevOps PR pipelines. Catch incompatible schema changes before merge with semantic diff, branch policies, and risk scoring.
Read article →When Your API Contract Breaks, Your SBOM Becomes Invalid
SBOMs track your software dependencies, but they are blind to API breaking changes. Learn why API contracts are supply chain artifacts and how to close the gap.
Read article →Optic Is Archived. Here Are Your Options.
Optic, the popular API breaking change detection tool, was archived in January 2026. Here is a fair comparison of the alternatives: oasdiff, Bump.sh, Spectral, and CodeRifts.
Read article →How a Field Rename Broke 19 Restaurants for a Week
A single API field rename passed code review, passed all tests, and took down POS systems across 19 restaurants. Here is what went wrong and how to prevent it.
Read article →Optic Is No Longer Maintained — Here's How to Keep Catching Breaking API Changes
The popular OpenAPI governance tool was archived on January 12, 2026. If you relied on it for breaking change detection, here's what happened and what your options are now.
Read article →