Every capability, and what it authorizes

Breaking Change Detection

Core diff engine for OpenAPI 3.0 and 3.1 schemas.

Detects endpoint removals, required field additions, response type changes, enum restrictions, auth changes, parameter modifications, and more.

Evidence

Auto-Discovery

Automatically finds OpenAPI spec files in your repo.

No configuration needed. CodeRifts scans your repository for .yaml, .yml, and .json files matching OpenAPI patterns.

Evidence

Semver Suggestion

Recommends MAJOR/MINOR/PATCH based on change severity.

Reads your current version from the spec and suggests the correct next version based on the breaking changes detected.

Evidence

Breaking Changes Table

Structured table of every breaking change with details.

Each breaking change gets its own row with endpoint, risk level, action type, and a link to the specific diff.

Evidence

Lifecycle Labels

Tags each change: new-endpoint, field-removed, deprecated, etc.

Every change in the breaking changes table gets a lifecycle icon showing whether it's new, modified, deprecated, or removed.

REST in Peace: a dedicated memorial section for removed endpoints.

Commit Consistency Check

Validates PR title matches the suggested version bump.

Warns when breaking changes are detected but the PR title doesn't include a version bump indicator like feat!:.

Web UI, CLI & REST API

Three ways to use CodeRifts: browser, terminal, or API.

Try in the browser with no signup, run locally via CLI, or integrate into any CI/CD pipeline via the REST API.

Evidence

4D Risk Score

Composite 0–100 score across severity, surface, auth, and stability.

Each PR gets a single risk number combining breaking change severity, affected surface area, authentication impact, and historical stability. Color-coded gauge included.

Confidence Score

How certain is the analysis? 0–100 confidence rating.

Factors in spec completeness, change specificity, and engine agreement. Low confidence triggers a warning so you know when to double-check.

Stability Grade

A+ to F grade based on recent breaking change history.

Tracks your API's breaking change frequency over the last 30 days. Fewer breaks = higher grade. Shown as a letter grade with trend arrow.

Evidence

Change Intent Classifier

Tags each change as structural, behavioral, or security.

Uses change codes and heuristics to classify intent. Structural changes affect shape, behavioral changes affect logic, security changes affect auth.

Auth Downgrade Detection

Flags when endpoints lose authentication requirements.

Detects when OAuth2 is downgraded to API key, when bearer tokens are removed, or when security schemes are weakened. Severity-rated.

Scope & Permission Tracker

Detects OAuth scope changes and permission model shifts.

Tracks when scopes are added, removed, or renamed. Warns when permission boundaries change in ways that could affect API consumers.

AI-Generated Spec Safety

An analysis detail, not a feature. The score is not the decision.

Seven signals in src/ai-spec-detector.js: large restructuring, uniform formatting, commit-message patterns, unrelated changes bundled together, description rewrites, alphabetical reordering, and bulk required-field additions. They describe the change. They do not grant it.

Evidence

Generator-Aware Risk

An analysis detail, not a feature. The multiplier is not the decision.

src/generator-detector.js names generators and multiplies the score (1.3, 1.5, or 2.0 each, product capped at 4.0). A readiness number is ten checks in scoreAgentReadiness, on an advanced route, not one of the three MCP tools. Neither number is a grant.

Evidence

PII Detection

Scans new fields for personally identifiable information.

Detects fields like ssn, credit_card, passport in new or modified schemas. Flags before merge with GDPR/CCPA compliance warning.

Breaking Change Density Score

Measures breaking changes relative to API size.

Score 0–100. A small API with 3 breaks scores higher than a large API with 3 breaks. Critical density triggers automatic block.

API Design Lint

Naming conventions, pagination, error consistency checks.

8 lint rules covering camelCase, pagination patterns, error response formats, and more. Warnings shown in a collapsible section.

Evidence

Auto-Changelog

Categorized changelog: breaking, added, changed, deprecated.

Every PR gets a structured changelog grouped by change type, ready to copy into your release notes.

Evidence

Deprecation Lifecycle Tracker

Tracks deprecated endpoints from announcement to removal.

Monitors x-deprecated and x-sunset headers.

Documentation Coverage Score

A–F grade for spec completeness: descriptions, examples, schemas.

Scores your OpenAPI spec across 5 dimensions: descriptions, examples, error responses, schema completeness, and parameter documentation. Shows delta from base.

Docs Drift Detection

Warns when schema changes happen without documentation updates.

Checks if README, CHANGELOG, or API docs were updated alongside schema changes. Flags PRs that skip documentation.

Heritage Mode

Versioning suggestions for existing endpoints.

Detects high change density PRs and recommends version bumps or deprecation plans for heavily modified endpoints.

CODEOWNERS Suggestion

Auto-generates CODEOWNERS based on domain ownership config.

When no CODEOWNERS file exists, suggests one based on the domain ownership mapping in your .coderifts.yml.

Versioning Strategy

URL vs header versioning analysis and recommendation.

Detects your versioning approach (URL path, header, query param) and flags inconsistencies or missing version indicators.

Evidence

Compatibility Mode Suggestions

Suggests backward-compatible alternatives to breaking changes.

When a breaking change is detected, suggests a backward-compatible alternative instead of just blocking. Includes code examples and migration paths.

Migration Assessment

Estimates consumer migration effort: hours, complexity, affected endpoints.

For each breaking change, estimates the migration effort for API consumers. Factors in change type, endpoint popularity, and complexity.

Governance Health Grade

A–F grade for your API governance posture.

Composite score across policy compliance, exception usage, and documentation quality. Shown as a letter grade.

PR Review Insights

Time to first review, reviewer load, PR size analysis.

Tracks review patterns for API-related PRs. Shows time to first review, number of review rounds, and PR size classification.

Feature Flag Cleanup

Detects stale feature flags across 6 languages, 19 patterns.

Scans changed files for feature flag patterns. Flags stale and aging flags with configurable thresholds.

Evidence

Shadow API Detection

Identifies high-change-density endpoints that may be undocumented.

Flags endpoints with many changes in a single PR, suggesting they may be shadow APIs that need proper documentation.

Overlap Detection

Detects other open PRs modifying the same schema files.

Warns when multiple open PRs touch the same OpenAPI spec, preventing merge conflicts and governance gaps.

Evidence

Semantic Drift Detection

4 patterns: field semantic change, endpoint semantic change, response contract drift, default value drift.

Detects FIELD_SEMANTIC_CHANGE, ENDPOINT_SEMANTIC_CHANGE, RESPONSE_CONTRACT_DRIFT, and DEFAULT_VALUE_SEMANTIC_CHANGE. Goes beyond structural diff to detect when the meaning of fields or endpoints changes even if the schema stays the same.

Token Cost Engine

token_cost_impact field included in OpenAPI diff responses.

OpenAPI diff responses include token_cost_impact showing how API changes affect LLM token consumption. Helps teams understand the cost implications of schema changes for AI-powered consumers.

SDK Surface Coverage

Tracks which endpoints are covered by generated SDKs.

Cross-references your OpenAPI spec with generated SDK clients. Flags endpoints missing from SDKs and new endpoints that need SDK updates.

Generated Spec Drift

Detects when generated specs diverge from the source of truth.

If your spec is auto-generated from code annotations, detects when manual edits create drift between the generated and committed versions.

Domain Ownership

Map API paths to team owners for targeted notifications.

Define which team owns which API paths. Breaking changes to /payments/* notify @payments-team automatically.

Evidence

Exception Lifecycle Manager

Time-boxed exceptions for policy violations with audit trail.

Grant temporary exceptions to governance rules. Each exception has an owner, expiry date, and reason. Expired exceptions auto-revoke.

Branch Risk Profiles

Different risk tolerance per branch pattern.

hotfix/* gets 2x budget, experiment/* never blocks, main/* zero tolerance. Configure per-branch governance rules in .coderifts.yml.

MigraGuard

Opt-in migration gate for database and schema migrations.

Reads database migration files and the application source references they touch — processed in memory, never persisted — and gates unsafe migrations before they merge.

Evidence

ActionGuard

Opt-in workflow gate for GitHub Actions changes.

Compares the uses: action references between a workflow's base and head and reports unpinned refs, pin drift, unverifiable pin claims, major-version jumps and new third-party actions. Diff-based only — pre-existing unchanged refs are not re-flagged. Findings are WARN-tier: ActionGuard can raise a check to neutral, and never on its own to failure.

Evidence

Inhibitory Neuron Filter

Suppress known-safe findings to reduce noise.

POST /api/v1/findings/suppress — Mark specific findings as suppressed so they don't trigger alerts. Like inhibitory neurons in the brain, these filters prevent signal overload from known-safe changes.

Tool Schema Registry

Version agent tool schemas and catch breaking drift before redeploy.

POST /api/v1/registry/tool-schemas registers a schema. /check compares a new version with the registered one. When the comparison is breaking, the route inserts an incident row and, if alert_webhook was stored, POSTs it (src/routes/tool-schema-registry.js). That row is not a grant, and it does not require the merge check.

Evidence

Agent-Safe Badge & Verification — retired 2026-09-23

Retired 2026-09-23. The embeddable compliance badge is no longer offered.

Retired 2026-09-23 — June positioning, withdrawn with the /compliant/ page (which now answers 301 to /verify/). The two endpoints answer 410 Gone since 2026-09-24 (retired 2026-09-23). Measured live on that date: HTTP 410, application/json, Cache-Control: no-store, and a body carrying retryable: false — the one status where retrying is always wrong, said out loud rather than left for a client to infer. The badge route used to answer image/svg+xml; JSON now breaks an embedded badge visibly, which is the point. Historically GET /api/v1/badge/compliant returned an SVG badge showing AGENT-SAFE, WARN or BREAKING, and GET /api/v1/verify/compliant returned full Decision Spec v1.0 verification — this endpoint intentionally serves the legacy v1.0 shape for backward compatibility; the platform contract is Decision Spec 2.0, and agents should branch on execution_action from the preflight API. The shape it serves is documented in the Decision Spec; what a verdict does and does not prove is on /verify/.

Evidence

A2A Protocol Governance Beta — docs on request

Diffs output_schema, handoff_protocol, and message_format. Issues no receipt.

POST /api/v1/a2a/diff diffs our own contract shape (output_schema, handoff_protocol, message_format) and issues no receipt.

Cross-Spec Compatibility Beta — docs on request

Compare specs across formats: OpenAPI, AsyncAPI, GraphQL, gRPC.

POST /api/v1/cross-spec/diff — Detects breaking changes when migrating between API specification formats. Supports OpenAPI 3.x, AsyncAPI 2.x, GraphQL SDL, and Protocol Buffers.

MCP Server (Streamable HTTP)

Claude Desktop compatible MCP server over Streamable HTTP.

GET /mcp — Full Model Context Protocol server exposing exactly three MCP tools via Streamable HTTP. Any MCP-capable client can connect — the server speaks JSON-RPC 2.0 over Streamable HTTP and asks nothing of the host. Configuration examples for Claude Desktop, Cursor, Windsurf and OpenCode are on the install page, each with what was measured on it and when. Several carry LIVE_ROUTE — unverified on current host — which says we have not looked since, not that the route is broken, and not the same as silence.

Evidence