Give your agent an authorization path for contract changes

What is the Model Context Protocol?

MCP is an open standard that lets AI agents discover and call tools from external services. Instead of hardcoding API calls, agents read a manifest file (mcp.json) that describes available tools, their input schemas, and endpoints. The agent then calls whichever tools it needs to complete a task. At runtime the authoritative discovery is the protocol’s own tools/list call against the server; mcp.json is a static advertisement clients use to find and configure the server, not the live tool list.

Five hint flips on one published server and one hint flip on a second, dated 2026-10-10 and re-derived from the app's fixtures on 2026-10-16, are on the annotation-flips page.

The drift digest dated 2026-10-10 is on the MCP drift digest.

Measured 2026-10-05. Glama lists connector io.github.coderifts/api-governance as TDQS A (4.8/5.0, 3 tools, scored 2026-09-26 18:02) and Healthy, 99.5% uptime over 49 days. The transport line reads Streamable HTTP · MCP 2025-06-18. Last tested 2026-10-05 05:58. This is a third-party score of tool-definition quality and of availability. It does not say that anyone uses the server.

MCP Tools

Every tool is callable via any MCP-compatible client. Pass your API key as an Authorization: Bearer header.

Only the three tools above are exposed through MCP. The endpoints below are REST integrations for callers without an MCP client — the agent-relevant surface, not the full product API.

Agent-relevant REST endpoints

Direct HTTP without an MCP client. This is the agent-relevant surface — not the full product API. Auth: Authorization: Bearer unless a route is documented as keyless.

Test Your MCP Manifest

Paste your complete mcp.json URL. The result is the finding list. The score is a detail, not the decision.

A manifest is recognised as MCP by its schema_version or authentication field. Paste the whole document, not just the tool list a tools/list call returns — without one of those fields the manifest is read as an OpenAPI spec and scored against OpenAPI signals, which produces a number that does not describe your manifest. Measured 2026-09-14.

Plans & Limits

Measured in the server on 2026-09-30. A self-serve key is the free tier. There is no Team key, so this table has no unlimited request row.

No Pro tier is sold. During the public beta every organization gets Team features at $0 with a self-serve key, public and private repositories alike, no separate Team key to request, and each key allows 1,000 requests a month: after that, /preflight authorize returns BETA_LIMIT_REACHED while its analysis keeps working; other API routes return 429. A self-serve key is 1,000 requests per month; above that, /preflight authorize returns BETA_LIMIT_REACHED while its analysis keeps working, and other API routes return 429. Any API key is limited to 100 requests per minute (API_KEY_MINUTE_LIMIT). The authorization-case counter is a label, and it is not the live 1,000-request cap. The keyless agent bucket, including POST /api/v1/preflight, answers x-ratelimit-limit: 60. Other keyless public calls are 30 per minute and 50 per day.

Quickstart

Add CodeRifts to your MCP client in under 60 seconds. Choose your client below.

{
  "mcpServers": {
    "coderifts": {
      "url": "https://app.coderifts.com/mcp",
      "headers": { "Authorization": "Bearer ${CODERIFTS_API_KEY}" }
    }
  }
}

{
  "mcpServers": {
    "coderifts": {
      "url": "https://app.coderifts.com/mcp",
      "headers": { "Authorization": "Bearer ${CODERIFTS_API_KEY}" }
    }
  }
}

- name: CodeRifts contract gate
  run: npx coderifts diff base.yaml head.yaml --ci --threshold 50

{
  "mcpServers": {
    "coderifts": {
      "url": "https://app.coderifts.com/mcp",
      "headers": { "Authorization": "Bearer ${CODERIFTS_API_KEY}" }
    }
  }
}

{
  "mcpServers": {
    "coderifts": {
      "url": "https://app.coderifts.com/mcp",
      "headers": { "Authorization": "Bearer ${CODERIFTS_API_KEY}" }
    }
  }
}

curl -s https://coderifts.com/mcp.json | jq '.tools[].name'

curl -X POST https://app.coderifts.com/api/v1/preflight \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -d '{
    "preflight_mode": "authorize",
    "context": { "operation": "merge" },
    "artifacts": [{
      "id": "api",
      "type": "openapi",
      "before": "openapi: 3.0.0\ninfo: {title: t, version: \"1.0.0\"}\npaths: {}\n",
      "after": "openapi: 3.0.0\ninfo: {title: t, version: \"1.0.1\"}\npaths: {}\n"
    }]
  }'
# Branch on execution_action when preflight_mode is authorize.
# Analyze (risk only): preflight_mode "analyze" → analysis_outcome + may_execute:false
# Full contract: https://coderifts.com/decision-spec/

Compatible Clients

CodeRifts works with any client that supports the Model Context Protocol.

How It Works

The MCP integration adds a discovery layer on top of the existing CodeRifts API. No new infrastructure required.