CodeRifts vs oasdiff
Which is right for your team?
Built on oasdiff for OpenAPI. What oasdiff does for OpenAPI, the same gate does for MCP tool manifests, with the decision signed. oasdiff gives you the raw breaking-change diff; CodeRifts wraps that diff in a deterministic risk verdict - a 0-100 score, a cost estimate, a policy decision, and a signed receipt. Both tools detect breaking changes in OpenAPI specs. oasdiff is an open-source Go CLI and GitHub Action, now with a hosted Pro tier at oasdiff.com that adds PR comments, per-change approvals, and an audit trail. CodeRifts is a one-click install; enforcement is a branch-protection setting. The analysis is a deterministic risk verdict: every change gets a 0-100 risk score, a cost estimate, a policy decision, and a cryptographically signed, externally verifiable receipt. Here is an honest comparison.
Re-read 2026-10-03, oasdiff.com/pricing still says the monthly price is $100, up to 5 reviewers across 5 repositories, and an audit trail of who approved what, and when. The plan name on oasdiff.com/pricing is Pro. That page does not mention MCP.
| Capability | CodeRifts | oasdiff |
|---|---|---|
| Setup | ✓ One-click GitHub App install | GitHub Action YAML config |
| Breaking change detection | ✓ Yes | ✓ Yes |
| Change intent classification | ✓ In the PR comment — 🏗️ Structural · ⚙️ Behavioral · 🔒 Security · ⚡ Performance | ✗ No |
| Generator-aware risk | ✓ In the PR comment — when a code generator is detected the base score is multiplied, capped at 4.0× | ✗ No |
| SDK surface coverage | ✓ In the PR comment | ✗ No |
| Detection confidence scoring | ✓ In the PR comment, and in the REST response with ?debug=true: | ✗ No |
| Risk scoring (0–100) | ✓ 4-dimension model | ✗ No |
| Policy engine (budgets, freeze, approvals) | ✓ Yes | ⚠️ Approvals + merge gate (Pro) — no budgets or freeze windows |
| Security analysis | ✓ Yes | ✗ No |
| API design linting | ✓ Yes | ✗ No |
| Migration cost estimation | ✓ Yes | ✗ No |
| PR comment with full report | ✓ 20+ sections | Inline annotations; approve / reject controls on Pro |
| CLI tool | ✓ npm | ✓ Go binary, Docker |
| REST API | ✓ Yes | ✗ No |
| Web UI for quick diff | ✓ Yes | ✓ Side-by-side review page (Free) |
| Pricing | Free $0; Team $149/month after beta (Team is $0 during public beta); Enterprise from $1,500/month. Source: live /pricing/, read 2026-09-20. No Pro tier is sold. During the public beta every organization gets Team features at $0 with a self-serve key, public and private repositories alike, no separate Team key to request, and each key allows 1,000 requests a month: after that, /preflight authorize returns BETA_LIMIT_REACHED while its analysis keeps working; other API routes return 429. | Free CLI (open source) + Pro $100/mo (5 reviewers / 5 repos) + Enterprise |
| Maintenance | Managed SaaS | Self-hosted CLI, or managed on Pro / Enterprise |
| OpenAPI 3.0 / 3.1 | ✓ Yes | ✓ Yes |
| GraphQL / gRPC | ✓ GraphQL available | ✗ No |
| Signed, portable verdict receipt | ✓ Ed25519 — verify offline against the published public key, no account | ✗ No — audit trail is in-product (Pro) |
| Runtime guard that can stop an agent tool call | ✓ Fail-closed — wired guard path only | ✗ No — pull-request time only |
| Published proof boundaries | ✓ What each proof does and does not prove | ✗ Not published |
oasdiff column checked against oasdiff.com/pricing on 2026-08-28.
When to choose oasdiff
- ✓ You want a free, open-source CLI you can run anywhere, including air-gapped CI
- ✓ You want per-change human approvals with a hosted review UI (oasdiff Pro)
- ✓ Your team is comfortable wiring GitHub Actions and maintaining CI YAML
- ✓ You need diff classification and a merge gate, and that is enough
When to choose CodeRifts
- ✓ You want a risk NUMBER and a cost estimate, not just a severity label - our verdict scores every change 0-100 and estimates blast radius and fix cost
- ✓ You want deterministic, reproducible decisions - the same spec pair always produces the same byte-identical verdict fingerprint
- ✓ You want cryptographic evidence, not just review history - every verdict returns an Ed25519-signed receipt any external party can verify against our published key
- ✓ You are building for AI agents - agent-native action-verdict API, MCP server, and governance policies agents can consume directly
- ✓ Your PRs change more than specs - CodeRifts also cross-checks schema migrations against live code references (MigraGuard), one app for both gates
- ✓ You want a one-click install; enforcement is a branch-protection setting. A YAML file names artifacts. It does not move the grant
The honest difference
oasdiff Pro and CodeRifts now overlap on the approval workflow: both can gate a merge and route breaking changes to humans. The difference is what the human sees and what survives the decision. oasdiff shows you the diff and records who clicked approve. CodeRifts shows you a risk score, a cost estimate, and the endpoints the change reaches — not your consumers, which we do not observe - and issues a signed receipt that proves, to anyone, what was decided and on what basis. If your API feeds AI agents or downstream teams that need evidence rather than trust, that is the gap we fill.
Ready to try CodeRifts?
Install in one click. No config files, no CI setup, no credit card required.
A diff tells you what changed. It does not tell you whether it may proceed.