Governance features.
One PR comment.

4D Risk Score

Composite 0–100 score across severity, surface, auth, and stability.

Each PR gets a single risk number combining breaking change severity, affected surface area, authentication impact, and historical stability. Color-coded gauge included.

Confidence Score

How certain is the analysis? 0–100 confidence rating.

Factors in spec completeness, change specificity, and engine agreement. Low confidence triggers a warning so you know when to double-check.

Stability Grade

A+ to F grade based on recent breaking change history.

Tracks your API's breaking change frequency over the last 30 days. Fewer breaks = higher grade. Shown as a letter grade with trend arrow.

Evidence

Change Intent Classifier

Tags each change as structural, behavioral, or security.

Uses change codes and heuristics to classify intent. Structural changes affect shape, behavioral changes affect logic, security changes affect auth.

Auth Downgrade Detection

Flags when endpoints lose authentication requirements.

Detects when OAuth2 is downgraded to API key, when bearer tokens are removed, or when security schemes are weakened. Severity-rated.

Scope & Permission Tracker

Detects OAuth scope changes and permission model shifts.

Tracks when scopes are added, removed, or renamed. Warns when permission boundaries change in ways that could affect API consumers.

AI-Generated Spec Safety

Detects when specs are AI-generated and flags common AI mistakes.

Identifies patterns typical of LLM-generated OpenAPI specs: hallucinated endpoints, inconsistent naming, missing security schemes, and overly generic descriptions.

Evidence

Generator-Aware Risk

Adjusts risk scoring based on spec generator (Swagger Codegen, OpenAPI Generator, etc.).

Detects the generator used and adjusts confidence and risk scores based on known generator quirks and limitations.

Evidence

PII Detection

Scans new fields for personally identifiable information.

Detects fields like ssn, credit_card, passport in new or modified schemas. Flags before merge with GDPR/CCPA compliance warning.

Breaking Change Density Score

Measures breaking changes relative to API size.

Score 0–100. A small API with 3 breaks scores higher than a large API with 3 breaks. Critical density triggers automatic block.

API Design Lint

Naming conventions, pagination, error consistency checks.

8 lint rules covering camelCase, pagination patterns, error response formats, and more. Warnings shown in a collapsible section.

Evidence

Auto-Changelog

Categorized changelog: breaking, added, changed, deprecated.

Every PR gets a structured changelog grouped by change type, ready to copy into your release notes.

Evidence

Deprecation Lifecycle Tracker

Tracks deprecated endpoints from announcement to removal.

Monitors x-deprecated and x-sunset headers. Warns when deprecated endpoints are removed without the sunset period completing.

Documentation Coverage Score

A–F grade for spec completeness: descriptions, examples, schemas.

Scores your OpenAPI spec across 5 dimensions: descriptions, examples, error responses, schema completeness, and parameter documentation. Shows delta from base.

Docs Drift Detection

Warns when schema changes happen without documentation updates.

Checks if README, CHANGELOG, or API docs were updated alongside schema changes. Flags PRs that skip documentation.

Heritage Mode

Versioning suggestions for existing endpoints.

Detects high change density PRs and recommends version bumps or deprecation plans for heavily modified endpoints.

CODEOWNERS Suggestion

Auto-generates CODEOWNERS based on domain ownership config.

When no CODEOWNERS file exists, suggests one based on the domain ownership mapping in your .coderifts.yml.

Versioning Strategy

URL vs header versioning analysis and recommendation.

Detects your versioning approach (URL path, header, query param) and flags inconsistencies or missing version indicators.

Evidence

Compatibility Mode Suggestions

Suggests backward-compatible alternatives to breaking changes.

When a breaking change is detected, suggests a backward-compatible alternative instead of just blocking. Includes code examples and migration paths.

Migration Assessment

Estimates consumer migration effort: hours, complexity, affected endpoints.

For each breaking change, estimates the migration effort for API consumers. Factors in change type, endpoint popularity, and complexity.

Governance Health Grade

A–F grade for your API governance posture.

Composite score across policy compliance, exception usage, deprecation adherence, and documentation quality. Shown as a letter grade.

PR Review Insights

Time to first review, reviewer load, PR size analysis.

Tracks review patterns for API-related PRs. Shows time to first review, number of review rounds, and PR size classification.

Feature Flag Cleanup

Detects stale feature flags across 6 languages, 19 patterns.

Scans changed files for feature flag patterns. Flags stale and aging flags with configurable thresholds.

Evidence

Shadow API Detection

Identifies high-change-density endpoints that may be undocumented.

Flags endpoints with many changes in a single PR, suggesting they may be shadow APIs that need proper documentation.

Overlap Detection

Detects other open PRs modifying the same schema files.

Warns when multiple open PRs touch the same OpenAPI spec, preventing merge conflicts and governance gaps.

Evidence

Semantic Drift Detection

4 patterns: field semantic change, endpoint semantic change, response contract drift, default value drift.

Detects FIELD_SEMANTIC_CHANGE, ENDPOINT_SEMANTIC_CHANGE, RESPONSE_CONTRACT_DRIFT, and DEFAULT_VALUE_SEMANTIC_CHANGE. Goes beyond structural diff to detect when the meaning of fields or endpoints changes even if the schema stays the same.

Synaptic Weight Engine

Neural hotspot map showing endpoint criticality weights.

Assigns synaptic weights to each endpoint based on usage patterns, change frequency, and downstream dependencies. Generates a neural hotspot map to visualize which endpoints carry the most risk.

Shadow Agent Detection Beta — docs on request

Detect unauthorized or undocumented agent integrations.

POST /api/v1/shadow-agent/detect — Scans API traffic patterns and spec changes to identify shadow agents: unauthorized integrations that bypass governance controls.

Axiom Monitor Beta — docs on request

Real-time API axiom health status dashboard.

GET /api/v1/axiom/status — Monitors core API axioms (backward compatibility, idempotency, versioning) and reports violations in real time.

Policy Compliance Index Beta — docs on request

Aggregate compliance score across all governance rules.

GET /api/v1/compliance/index — Calculates a weighted compliance score across all active governance policies. Tracks score trends over time for audit reporting.

Token Cost Engine

token_cost_impact field included in OpenAPI diff responses.

OpenAPI diff responses include token_cost_impact showing how API changes affect LLM token consumption. Helps teams understand the cost implications of schema changes for AI-powered consumers.

SDK Surface Coverage

Tracks which endpoints are covered by generated SDKs.

Cross-references your OpenAPI spec with generated SDK clients. Flags endpoints missing from SDKs and new endpoints that need SDK updates.

Generated Spec Drift

Detects when generated specs diverge from the source of truth.

If your spec is auto-generated from code annotations, detects when manual edits create drift between the generated and committed versions.

Policy Engine

YAML-defined rules: max breaking changes, required deprecation periods, auth requirements.

Define governance rules in .coderifts.yml. The engine evaluates every PR against your policies and blocks merges that violate them.

Evidence

Freeze Windows

Block breaking changes during release freezes or peak traffic periods.

Configure date ranges when breaking changes are prohibited. PRs opened during freeze windows get a hard block with the freeze reason.

Evidence

Approval Matrix

Require specific approvers for high-risk changes.

Configure who must approve based on risk level: security changes need @security-team, auth changes need @platform-lead.

Evidence

Domain Ownership

Map API paths to team owners for targeted notifications.

Define which team owns which API paths. Breaking changes to /payments/* notify @payments-team automatically.

Evidence

Exception Lifecycle Manager

Time-boxed exceptions for policy violations with audit trail.

Grant temporary exceptions to governance rules. Each exception has an owner, expiry date, and reason. Expired exceptions auto-revoke.

Breaking Budget

Set a maximum number of allowed breaking changes per PR.

Configure a breaking change budget in your policy. PRs exceeding the budget get a policy violation with the count and limit shown.

Evidence

Branch Risk Profiles

Different risk tolerance per branch pattern.

hotfix/* gets 2x budget, experiment/* never blocks, main/* zero tolerance. Configure per-branch governance rules in .coderifts.yml.

MigraGuard

Opt-in migration gate for database and schema migrations.

Reads database migration files and the application source references they touch — processed in memory, never persisted — and gates unsafe migrations before they merge.

Evidence

ActionGuard

Opt-in workflow gate for GitHub Actions changes.

Compares the uses: action references between a workflow's base and head and reports unpinned refs, pin drift, unverifiable pin claims, major-version jumps and new third-party actions. Diff-based only — pre-existing unchanged refs are not re-flagged. Findings are WARN-tier: ActionGuard can raise a check to neutral, and never on its own to failure.

Evidence

Inhibitory Neuron Filter

Suppress known-safe findings to reduce noise.

POST /api/v1/findings/suppress — Mark specific findings as suppressed so they don't trigger alerts. Like inhibitory neurons in the brain, these filters prevent signal overload from known-safe changes.

Tool Schema Registry

Version agent tool schemas and catch breaking drift before redeploy.

POST /api/v1/registry/tool-schemas registers and versions a tool schema. /check compares a new version against the registered production schema and returns ALLOW/WARN/BLOCK with the breaking changes. Breaking drift is logged as an incident (GET /api/v1/registry/incidents) and can trigger a webhook alert.

Evidence

API Stability Badge

4 embeddable SVG badges for README: stability, streak, governance, risk.

Shields.io-style badges generated server-side. Embed in your README to show your API's governance posture.

Evidence

Agent-Safe Badge & Verification

Embeddable compliance badge for your README.

GET /api/v1/badge/compliant returns an SVG badge showing AGENT-SAFE, WARN, or BREAKING grade. GET /api/v1/verify/compliant returns full Decision Spec v1.0 verification — this endpoint intentionally serves the legacy v1.0 shape for backward compatibility; the platform contract is Decision Spec 2.0, and agents should branch on execution_action from the preflight API. Learn more.

Evidence

A2A Protocol Governance Beta — docs on request

Agent-to-Agent protocol diff and pipeline simulation.

POST /api/v1/a2a/diff compares A2A agent cards for breaking changes. POST /api/v1/a2a/simulate runs multi-step pipeline simulations to detect cascading failures across agent chains.

Cross-Spec Compatibility Beta — docs on request

Compare specs across formats: OpenAPI, AsyncAPI, GraphQL, gRPC.

POST /api/v1/cross-spec/diff — Detects breaking changes when migrating between API specification formats. Supports OpenAPI 3.x, AsyncAPI 2.x, GraphQL SDL, and Protocol Buffers.

MCP Server (Streamable HTTP)

Claude Desktop compatible MCP server over Streamable HTTP.

GET /mcp — Full Model Context Protocol server exposing exactly three MCP tools via Streamable HTTP. Compatible with Claude Desktop, Cursor, and any MCP-capable AI agent. JSON-RPC 2.0 protocol.

Evidence

Slack & Teams Notifications

Shipped: webhook alerts for breaking changes and BLOCK verdicts.

Configure in .coderifts.yml under notifications: Slack and Teams webhook URLs, trigger on breaking, all, or high-risk changes, mute selected repos. BLOCK decisions can also notify via environment-level webhooks with no config file.