MCP Integration — CodeRifts

What is the Model Context Protocol?

MCP is an open standard that lets AI agents discover and call tools from external services. Instead of hardcoding API calls, agents read a manifest file (mcp.json) that describes available tools, their input schemas, and endpoints. The agent then calls whichever tools it needs to complete a task. At runtime the authoritative discovery is the protocol’s own tools/list call against the server; mcp.json is a static advertisement clients use to find and configure the server, not the live tool list.

Discover

Client finds the server via mcp.json, then calls tools/list for the live tools and their input schemas.

Call

Agent constructs a JSON request matching the tool's input_schema and sends it to the endpoint.

Act

Agent receives structured results and uses them to make decisions — block a deploy, warn a developer, or approve a merge.

MCP Tools

Every tool is callable via any MCP-compatible client. Pass your API key as an Authorization: Bearer header.

Tool	Input	Output
preflight_change_set	`artifacts`, `preflight_mode` (required: analyze \| authorize), `context` (operation required when authorize), `previous_receipt`, `idempotency_key`	Mode-discriminated (Decision Spec v2): analyze → `analysis_outcome`, `may_execute:false` (no execution vocab); authorize → `decision`, `execution_action`, optional `chain_receipt`. See /decision-spec/
verify_receipt	`token`	`valid`, `reason`, `payload` (present only when `valid`)
get_decision_details	`decision_id` or `fingerprint`	stored `decision_result` (verdict + receipt) + `meta` (source, created_at)

Only the three tools above are exposed through MCP. The endpoints below are REST integrations for callers without an MCP client — the agent-relevant surface, not the full product API.

Agent-relevant REST endpoints

Direct HTTP without an MCP client. This is the agent-relevant surface — not the full product API. Auth: Authorization: Bearer unless a route is documented as keyless.

Endpoint	Description
`POST /api/v1/diff`	Analyze an API contract change.
`POST /api/v1/preflight`	Change-set preflight (same job as `preflight_change_set`). Requires `preflight_mode`; authorize may mint a receipt.
`POST /api/v1/verify-receipt`	Verify a CodeRifts receipt.
`POST /api/v1/decisions/lookup` · `GET /api/v1/decisions/:id`	Retrieve a previously issued decision.
`POST /api/v1/agent-readiness-score`	Score an API or manifest for agent readiness.
`POST /api/v1/registry-validate`	Validate a set of specs together.
`POST /api/v1/agent/preflight`	Evaluate changed agent tool schemas.
`POST /api/v1/mcp-diff`	Compare two MCP manifests.

Test Your MCP Manifest

Paste your mcp.json URL or content below and get an instant agent readiness score.

Plans & Limits

Start building with the free tier. Upgrade when you need higher limits or advanced tools.

Tier	Requests / month	Requests / minute	Price
Free	1,000	100	$0
Pro	Unlimited	100	$49 / mo
Team	Unlimited	100	$79 / mo
Enterprise	Unlimited	Custom	Custom

Free tier is permanent. No credit card required. Pro and Team include unlimited repos at a flat per-organization price. Rate limit is 100 requests per minute per key on every tier.

Quickstart

Add CodeRifts to your MCP client in under 60 seconds. Choose your client below.

Claude Desktop

Open Settings → Developer → Edit Config and add the CodeRifts server to your claude_desktop_config.json:

claude_desktop_config.json

{
  "mcpServers": {
    "coderifts": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://app.coderifts.com/mcp", "--header", "Authorization: Bearer ${CODERIFTS_API_KEY}"],
      "env": { "CODERIFTS_API_KEY": "YOUR_API_KEY" }
    }
  }
}

Restart Claude Desktop. You will see CodeRifts tools in the tool picker.

Claude Code

Save this as .mcp.json in your repository root and commit it. Unlike a desktop user-config, Claude Code auto-loads it for everyone who works in the repo — and it loads the same way when Claude Code runs non-interactively in CI:

.mcp.json

{
  "mcpServers": {
    "coderifts": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://app.coderifts.com/mcp", "--header", "Authorization: Bearer ${CODERIFTS_API_KEY}"],
      "env": { "CODERIFTS_API_KEY": "YOUR_API_KEY" }
    }
  }
}

Every session in that repo now has preflight_change_set, verify_receipt and get_decision_details available without per-developer setup.

Gate contract changes in CI

Tools an agent can call are not a gate. Add a step that runs on contract changes and fails the job, so a risky change cannot pass whether the diff came from a human or from an agent:

.github/workflows/contract-gate.yml

- name: CodeRifts contract gate
  run: npx coderifts diff base.yaml head.yaml --ci --threshold 50

--ci exits non-zero once the risk score crosses --threshold, which fails the job. Full flag reference: CLI integration.

For the full governance decision — branch on execution_action (CONTINUE | CONTINUE_WITH_MONITORING | REQUEST_APPROVAL | STOP; unrecognised values fail closed) with a signed receipt — call the authorize preflight (the preflight_change_set MCP tool, or the Custom / curl tab). decision (ALLOW / WARN / REQUIRE_APPROVAL / BLOCK) is explanation, not the branch key. The threshold gate above is a risk cutoff, not that decision. See the Decision Spec.

Cursor

Open Settings → MCP and add a new server:

.cursor/mcp.json

{
  "mcpServers": {
    "coderifts": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://app.coderifts.com/mcp", "--header", "Authorization: Bearer ${CODERIFTS_API_KEY}"],
      "env": { "CODERIFTS_API_KEY": "YOUR_API_KEY" }
    }
  }
}

Cursor will auto-discover all three MCP tools. Use them in chat with @coderifts.

Windsurf

Open Settings → Cascade → MCP and add:

~/.windsurf/mcp.json

{
  "mcpServers": {
    "coderifts": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://app.coderifts.com/mcp", "--header", "Authorization: Bearer ${CODERIFTS_API_KEY}"],
      "env": { "CODERIFTS_API_KEY": "YOUR_API_KEY" }
    }
  }
}

Restart Windsurf. CodeRifts tools will appear in Cascade's tool list.

Custom Agent / curl

Fetch the manifest, then call any tool endpoint directly:

Step 1: Discover tools

curl -s https://coderifts.com/mcp.json | jq '.tools[].name'

Step 2: Call a tool

curl -X POST https://app.coderifts.com/api/v1/preflight \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -d '{
    "preflight_mode": "authorize",
    "context": { "operation": "merge" },
    "artifacts": [{
      "id": "api",
      "type": "openapi",
      "before": "openapi: 3.0.0\ninfo: {title: t, version: \"1.0.0\"}\npaths: {}\n",
      "after": "openapi: 3.0.0\ninfo: {title: t, version: \"1.0.1\"}\npaths: {}\n"
    }]
  }'
# Branch on execution_action when preflight_mode is authorize.
# Analyze (risk only): preflight_mode "analyze" → analysis_outcome + may_execute:false
# Full contract: https://coderifts.com/decision-spec/

Compatible Clients

CodeRifts works with any client that supports the Model Context Protocol.

💬

Claude Desktop

Anthropic's desktop client with native MCP support

Supported

⌨️

Cursor

AI-first code editor with MCP tool integration

Supported

🌊

Windsurf

Codeium's IDE with Cascade MCP support

Supported

🤖

Custom Agents

Any agent that reads mcp.json and calls HTTP endpoints

Supported

How It Works

The MCP integration adds a discovery layer on top of the existing CodeRifts API. No new infrastructure required.

1

Agent discovers tools

The agent fetches https://coderifts.com/mcp.json and reads the three MCP tools with their input schemas and endpoint URLs.

2

Agent calls a tool

The agent constructs a JSON payload matching the tool's input_schema and sends a POST request to the endpoint with your API key.

3

CodeRifts runs the analysis

The full analysis pipeline runs: dual-engine diff, behavioral drift detection, agent pattern scoring, and the V3 scoring engine with 11 components and reflex rules.

4

Agent receives structured results

The agent gets a JSON response with risk score, breaking changes, detected patterns, and mitigation templates. In analyze mode the body is informational only (analysis_outcome, may_execute: false) and cannot authorize execution. In authorize mode the agent branches on execution_action together with a verified, currently authorized receipt (operation, fingerprint and required context match) — merge, deploy and tool-call gates verify the same receipt independently.

Available now · v1.0.1

Agent Governance SDK

A typed JavaScript/TypeScript SDK for programmatic access to every CodeRifts tool. Run preflight checks, explain decisions, and get unblock guidance — all from your agent code.

@coderifts/sdk

import { CodeRifts } from '@coderifts/sdk'

const cr = new CodeRifts({ apiKey: 'cr_live_...' })

// Diff two OpenAPI specs before merge
const diff = await cr.diff({
  old_spec: oldOpenApiYaml,
  new_spec: newOpenApiYaml
})

if (diff.breaking_changes_count > 0) {
  // diff.risk_level drives the gate: block, require approval, or warn
}

// Score an MCP manifest for agent readiness
const score = await cr.agentReadinessScore({
  spec: mcpManifest,
  spec_type: 'mcp'
})
// score.score, score.band  e.g. 100 STRONG

Install now

npm install @coderifts/sdk pip3 install coderifts-sdk

Python and TypeScript SDKs are published and versioned. See the agent frameworks guide for full examples.

Connect AI Agents to
API Contract Governance

What is the Model Context Protocol?

Discover

Call

Act

Surface anchor

MCP Tools

Agent-relevant REST endpoints

Test Your MCP Manifest

Plans & Limits

Quickstart

Claude Desktop

Claude Code

Gate contract changes in CI

Cursor

Windsurf

Custom Agent / curl

Compatible Clients

Claude Desktop

Cursor

Windsurf

Custom Agents

How It Works

Agent discovers tools

Agent calls a tool

CodeRifts runs the analysis

Agent receives structured results

Agent Governance SDK

Get Your API Key

Connect AI Agents toAPI Contract Governance

What is the Model Context Protocol?

Discover

Call

Act

Surface anchor

MCP Tools

Agent-relevant REST endpoints

Test Your MCP Manifest

Plans & Limits

Quickstart

Claude Desktop

Claude Code

Gate contract changes in CI

Cursor

Windsurf

Custom Agent / curl

Compatible Clients

Claude Desktop

Cursor

Windsurf

Custom Agents

How It Works

Agent discovers tools

Agent calls a tool

CodeRifts runs the analysis

Agent receives structured results

Agent Governance SDK

Get Your API Key

Connect AI Agents to
API Contract Governance