CodeRifts vs Spectral
Spectral lints. A linter is not a grant. CodeRifts authorizes a contract change at a named boundary. Complementary, not equivalent.
API governance vs API linting
Spectral by Stoplight is a powerful open-source API linter that validates OpenAPI and AsyncAPI specs against custom rulesets. CodeRifts is a managed GitHub App that combines linting with breaking change detection, risk scoring, and a policy decision (ALLOW / WARN / REQUIRE_APPROVAL / BLOCK). The App posts CodeRifts / issuer. On coderifts/demo pull request 4 that check concluded failure (check_run 111270526393). A red result stops a merge when branch protection requires it. They overlap on linting but differ significantly in scope.
| Capability | CodeRifts | Spectral |
|---|---|---|
| Primary focus | Full API governance | API design linting |
| Setup | ✓ One-click GitHub App | CLI install + ruleset file |
| API design linting | ✓ Built-in rules | ✓ Highly customizable rulesets |
| Custom linting rules | Via .coderifts.yml | ✓ Full JS/TS custom functions |
| Breaking change detection | ✓ Yes | ✗ No (lint only) |
| Change intent classification | ✓ In the PR comment — 🏗️ Structural · ⚙️ Behavioral · 🔒 Security · ⚡ Performance | ✗ No |
| Generator-aware risk | ✓ In the PR comment — when a code generator is detected the base score is multiplied, capped at 4.0× | ✗ No |
| SDK surface coverage | ✓ In the PR comment | ✗ No |
| Detection confidence scoring | ✓ In the PR comment, and in the REST response with ?debug=true: | ✗ No |
| Risk scoring (0–100) | ✓ 4-dimension model | ✗ No |
| Policy enforcement | ✓ Budgets, freeze, approvals | ✗ No |
| Security analysis | ✓ Yes | ✗ No |
| PR comment report | ✓ 20+ sections | Via CI integration |
| AsyncAPI support | ✓ Yes — message payload and components; servers, bindings and traits are not parsed. AsyncAPI 3 top-level operations are diffed. send is the response side: a removed field is a break and a new required field is not. receive is the request side: a new required field is a break and a removed field is not. | ✓ Yes |
| OpenAPI 3.0 / 3.1 | ✓ Yes | ✓ Yes |
| CLI tool | ✓ npm | ✓ npm |
| REST API | ✓ Yes | ✗ No |
| Pricing | Free $0; Team $149/month after beta (Team is $0 during public beta); Enterprise from $1,500/month. Source: live /pricing/, read 2026-09-20. No Pro tier is sold. During the public beta every organization gets Team features at $0 with a self-serve key, public and private repositories alike, no separate Team key to request, and each key allows 1,000 requests a month: after that, /preflight authorize returns BETA_LIMIT_REACHED while its analysis keeps working; other API routes return 429. | Free (Apache-2.0) |
Key difference
Spectral answers: "Does this spec follow our design standards?" — it validates a single spec against a ruleset. CodeRifts answers: "What changed between the old and new spec, how risky is it, and should we allow it?" — it compares two versions and provides governance. Many teams use both: Spectral for design-time linting, CodeRifts for merge-time governance.
Security changes the semver will not tell you about
Removing an OAuth scope is a breaking change for every consumer that relied on it - their calls start returning 403 while the version number stays green. CodeRifts detects scope removals, security-scheme downgrades (OAuth2 replaced by an API key), and deleted security scheme definitions, and folds them into the risk verdict.
When to choose Spectral
- ✓ You need deeply customizable linting rules written in JavaScript or TypeScript
- ✓ You work with AsyncAPI specs and need linting support for event-driven APIs
- ✓ You only need design-time validation, not merge-time breaking change detection
- ✓ You want a free, self-hosted tool with no vendor dependency
When to choose CodeRifts
- ✓ You need breaking change detection, not just linting — Spectral does not diff specs
- ✓ You want risk scoring and a policy decision that prevents high-risk changes from merging — which it does once the check is required on the branch
- ✓ You want a one-click install; enforcement is a branch-protection setting, instead of maintaining CI pipelines and ruleset files
- ✓ You need security findings, PII detection and policy violations on the same verdict, not a separate lint pass
- ✓ You want both linting and governance in a single tool
Ready to try CodeRifts?
Install in one click. No config files, no CI setup, no credit card required.
A diff tells you what changed. It does not tell you whether it may proceed.