CodeRifts

Free plan APIWeb

What CodeRifts is

CodeRifts provides contract-change authorization and governance for AI agents and API teams. Its diff engine checks OpenAPI 3.0 and 3.1 schemas for breaking changes such as removed endpoints, newly required fields, response-type changes, authentication changes, and parameter modifications. It can find matching OpenAPI specifications in .yaml, .yml, and .json repository files. Security analysis flags weakened authentication, and schema scans flag newly added or changed fields such as SSNs, credit-card numbers, and passports with GDPR/CCPA warnings. Teams can define YAML policies in .coderifts.yml to block merges over limits, deprecation requirements, or authentication requirements. Documented options include a GitHub App, GitHub Actions, GitLab CI, Bitbucket Pipelines, REST API, CLI, and an MCP server with three tools. Specifications are processed in memory and discarded after analysis; derived verdicts and metadata are retained rather than schema bodies or source code. The Free plan costs nothing and includes 1,000 authorization cases/month. Team is $149 a month, billed free during beta.

Who it suits

CodeRifts suits API teams and organizations using AI agents that need policy checks before contract changes are merged. It is relevant to teams working with OpenAPI 3.0 or 3.1 schemas and repository-based CI workflows.

What it does well

Checks OpenAPI 3.0 and 3.1 for breaking changes.
Policies can block merges.
Flags weakened authentication and potential PII fields.
Offers GitHub, GitLab CI, Bitbucket Pipelines, REST API, and CLI.
Processes schemas in memory and discards them after analysis.

What to know first

No formal SLA is in place yet.
No SOC 2 report or third-party assessment is published.
Public beta support has no promised response time.
API requests are rate-limited.

Limits

The Free plan includes 1,000 authorization cases per month. Team provides 10,000 cases per month and lists a $15 per 1,000 overage, prorated; it is billed free during beta. Enterprise uses volume-commitment authorization cases.

Plans

Plan	Billed and limits	Price
Free	public provider-verifiable boundary · 1,000 authorization cases/month · verification always free	Free
Team	free during beta · private production boundary · 10,000 authorization cases/month · $15 per 1,000 overage, prorated	$149 a month
Enterprise	per month · private bespoke boundary · volume-commitment authorization cases · discounted overage · unlimited users, agents and repositories	$1,500 a month

As coderifts.com lists them, read 30 Sept 2026. The maker's own page has the final word.

Getting started

Open the CodeRifts website.
Choose the Free plan or a paid plan based on the required authorization boundary and case volume.
Connect a documented CI integration or use the REST API or CLI.
Add matching OpenAPI .yaml, .yml, or .json specifications to the repository.
Define applicable YAML policy rules in .coderifts.yml.

Verdict

CodeRifts focuses on authorization and governance for OpenAPI contract changes, with policy enforcement and several CI options. The free tier includes 1,000 authorization cases/month; paid plan terms vary, including Team being billed free during beta.

Questions

Does CodeRifts have a free plan?

Yes. The Free plan costs nothing and includes 1,000 authorization cases per month; verification is always free.

What do the paid plans cost?

Team is $149 a month, billed free during beta. Enterprise is $1,500 a month.

Which API formats does it govern?

It governs OpenAPI 3.0 and OpenAPI 3.1 schemas.

Which integrations are documented?

Options include the GitHub App, GitHub Actions, GitLab CI, Bitbucket Pipelines, REST API, and CLI. An MCP server exposes three tools for preflighting changes, verifying receipts, and retrieving decision details.

What data does CodeRifts retain?

It says specifications are processed in memory and discarded after analysis. It retains derived verdicts and metadata rather than schema bodies or source code.

Does CodeRifts have an SLA?

It has no formal SLA yet and targets 99.9% uptime. Public beta support is available by email, with no promised response time.

Facts from CodeRifts's own pages

API limits: The API documentation states a limit of 100 authenticated requests per API key per minute and 30 anonymous non-agent requests per IP per minute. · app.coderifts.com, 30 Sept 2026
Breaking detection: Its core diff engine detects breaking changes in OpenAPI 3.0 and 3.1 schemas, including endpoint removals, required-field additions, response-type changes, enum restrictions, authentication changes and parameter modifications. · coderifts.com, 30 Sept 2026
CI integrations: Documented integrations include GitHub App, GitHub Actions, GitLab CI, Bitbucket Pipelines, REST API and CLI. · coderifts.com, 30 Sept 2026
CLI support: The CLI command npx coderifts diff works anywhere Node.js runs. · coderifts.com, 30 Sept 2026
Compliance: The Trust Center states GDPR handling practices and says no SOC 2 report or third-party assessment is published. · coderifts.com, 30 Sept 2026
Data handling: CodeRifts processes API specifications in memory, discards them after analysis and persists derived verdicts and metadata rather than schema bodies or source code. · coderifts.com, 30 Sept 2026
GitHub permissions: The GitHub App requests pull-request read/write, contents read, checks write and metadata read permissions. · coderifts.com, 30 Sept 2026
MCP: The MCP server exposes three tools: preflight_change_set, verify_receipt and get_decision_details. · coderifts.com, 30 Sept 2026
PII detection: It scans new or modified schemas for fields such as SSNs, credit-card numbers and passports and flags them with GDPR/CCPA warnings. · coderifts.com, 30 Sept 2026
Policy controls: The policy engine evaluates YAML rules in .coderifts.yml and can block merges that violate limits, deprecation requirements or authentication requirements. · coderifts.com, 30 Sept 2026
Purpose: CodeRifts provides contract-change authorization and governance for AI agents and API teams. · coderifts.com, 30 Sept 2026
Security analysis: It detects authentication downgrades such as OAuth2 changes to API keys, removed bearer tokens and weakened security schemes. · coderifts.com, 30 Sept 2026
Service level: CodeRifts has no formal SLA yet and targets 99.9% uptime. · coderifts.com, 30 Sept 2026
Spec discovery: CodeRifts automatically finds OpenAPI specifications in .yaml, .yml and .json files matching its repository patterns. · coderifts.com, 30 Sept 2026
Support: Support is provided at [email protected], with no promised response time during public beta. · coderifts.com, 30 Sept 2026

Where CodeRifts stands on Freedom251

API Governance Software#10 of 25