Most governance tools die at the setup step. Zero-config governance is active from the first pull request, with no config file and no CI edit.
Zero-config API governance is governance that runs correctly from the first pull request with no setup file, no CI pipeline edit, and no manual pointer to your spec. You install it once, it discovers your API contracts, and it starts enforcing on its own. Configuration is available for teams that want to tune policy, but nothing has to be configured for the governance to work.
Most API governance tools fail for a boring reason: nobody finishes setting them up. The detection engine may be excellent, but if it needs a CI pipeline edit, a config file, and a manual list of spec paths before it does anything, the task slides down the backlog and the tool never runs on a real pull request.
Zero-config flips the default. Instead of off until configured, the tool is on until you tune it. Governance is active from the first pull request, and the configuration is something you reach for later, not a gate you have to pass first.
Saying “no config” is easy. Making it true requires three things working together.
Spec auto-discovery. The tool has to find your API contracts by itself. If you still have to tell it where your OpenAPI files live, that is config. Real zero-config means the tool looks for your spec files in the repository and picks them up automatically.
Safe defaults. With no config, the tool still has to make sensible decisions: what counts as breaking, whether to block or warn, how to score risk. Defaults have to be conservative enough to be useful on day one.
Optional refinement. Config is not removed, it is made optional. Teams that want freeze windows, breaking budgets, ownership routing, or approval matrices can add them later, in a version-controlled file, without changing how the tool was installed.
Auto-discovery is the technical core of zero-config. When no schema path is configured, the system scans the repository for OpenAPI and Swagger specification files and analyzes them on every pull request. You do not declare where the spec is; the tool finds it. If you later want to pin specific files or exclude others, you can, but the default behavior needs no input.
This is what separates a genuinely zero-config tool from one that merely has a short setup. If the first run requires you to name your spec, the tool is config-light, not config-free.
An important distinction: zero-config does not mean you lose control. It means the control is opt-in. Governance runs with safe defaults immediately, and a configuration file, when you add one, layers policy on top: breaking budgets, freeze windows, domain ownership, approval rules. The file is optional, version-controlled, and simulated before merge. You get governance on day one and precision when you want it.
The most common worry about zero-config is that convenience costs rigor. It does not have to. The verdict a zero-config tool issues can be exactly as strong as a configured one: deterministic, so the same change always produces the same result, and cryptographically signed, so anyone can verify the decision without trusting the vendor. Installation effort and verdict integrity are independent. You can have both a one-click install and a verdict you can prove.
Verified finding
On the public demo pull request coderifts/demo#4 (2026-07-21), CodeRifts issued a deterministic BLOCK on 3 breaking changes and signed the verdict as an Ed25519 receipt.
sha256:70699341…cfecsha256:f3de7721…a3342026-07-k1 · 2026-07-21The same signed, verifiable verdict ships whether or not a config file is present. Anyone can verify it against the published public key with the open-source verifier.
It is API governance that runs correctly from the first pull request with no setup file, no CI pipeline edit, and no manual pointer to your spec. You install it once and it discovers your API contracts and enforces on its own.
No. Zero-config means the configuration is optional, not absent. Governance works out of the box with safe defaults, and you can add a config file later to tune policies, ownership, freeze windows, and budgets.
Through auto-discovery. When no schema path is configured, the system looks for your OpenAPI or Swagger spec files in the repository automatically, so you do not have to point it at them.
No. The verdict is deterministic and cryptographically signed from the first pull request, whether or not you add a config file. Configuration changes policy, not the integrity of the verdict.
Because most governance tools die at the setup step. If a tool needs a CI pipeline edit and a config file before it does anything, teams postpone it. Zero-config means governance is active from the first pull request.
CodeRifts is zero-config API governance as a GitHub App: one install, no CI config, auto-discovery of your spec files, and a signed verdict on every pull request. See a live demo PR, or read what agent-safe API governance means.