Which integrations are available for this server?

Backstage plugin for API governance, providing risk scorecards and breaking change detection directly in Backstage. CrewAI integration enabling pre-flight governance checks on API changes before tool calls, with blast radius and agent impact analysis. GitHub App that posts a risk scorecard on every pull request, allowing API governance at PR time. LangGraph integration enabling pre-flight governance checks on API changes before tool calls, with blast radius and agent impact analysis.

CodeRifts — API Governance

Risk-aware API compatibility governance for AI agents and CI. Before a change merges, CodeRifts predicts whether it will cause a real production problem, who breaks, by what pattern, at what business cost, and whether blocking is justified.

The market shows you what changed. CodeRifts tells you how dangerous it is, who it affects, when deployment should be blocked, and how much it will cost.

Hosted MCP server: https://app.coderifts.com/mcp
Manifest: https://coderifts.com/mcp.json
Official MCP Registry: io.github.coderifts/api-governance
Website: https://coderifts.com
Live demo PR: https://github.com/coderifts/demo/pull/4

MCP server

CodeRifts runs as a hosted Streamable HTTP MCP server. Any MCP-compatible agent (Claude Desktop, Cursor, LangGraph, AutoGen, custom) can connect and run governance checks before tool calls or merges.

Endpoint: https://app.coderifts.com/mcp
Transport: Streamable HTTP (protocol version 2025-06-18)
Server: CodeRifts API Governance v1.0.0
Auth: Bearer API key from coderifts.com — Authorization: Bearer <key>

Connect

{
  "mcpServers": {
    "coderifts": {
      "url": "https://app.coderifts.com/mcp",
      "headers": {
        "Authorization": "Bearer <YOUR_CODERIFTS_API_KEY>"
      }
    }
  }
}

Verify the connection

curl -sS https://app.coderifts.com/mcp \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"curl","version":"1.0"}}}'

Expected: a JSON-RPC result with serverInfo and capabilities.tools.

Related MCP server: Bastion

Tools

Tool	What it does
`preflight_check`	Analyze an API spec diff before merge. Returns risk score, break probability, blast radius, agent impact, economic cost, and a merge decision (ALLOW / WARN / REQUIRE_APPROVAL / BLOCK).
`agent_tool_check`	Detect whether an API change breaks AI agent tool calling (TOOL_RESULT_SHAPE_DRIFT, AGENT_PROTOCOL_DRIFT, and more). Returns an agent-impact score and per-pattern mitigation templates.
`agent_readiness_score`	Score an OpenAPI spec or MCP manifest for AI agent readiness (0–100) across nine signals, with band and breakdown.
`registry_validate`	Validate an MCP tool registry or OpenAPI spec collection for governance health (schema consistency, auth coverage, deprecation, breaking-change density).
`agent_preflight`	Pre-flight governance check for agent workflows. Given tool schemas before/after, returns which tools break, which workflows are affected, blast radius across the agent graph, and a deploy decision.
`traffic_analyze`	Infer API spec drift from HTTP traffic samples — runtime behavioral drift detection without requiring spec changes.
`mcp_diff`	Compare two MCP manifests and detect breaking changes in tool schemas, input/output contracts, auth requirements, and tool availability.
`governance_health`	Governance health score for an API spec: A–F grade (0–100), policy violations, deprecation status, documentation coverage, and security findings.

Every tool returns the same Decision Spec v1.0 envelope (decision, risk_score, safe_for_agent, breaking_changes, patterns, requires_migration, evidence_quality, coderifts_version, timestamp) so agent runtimes can branch on a stable contract.

How agents use it

Before merging an API change (or before an agent calls a tool), send the before/after spec to preflight_check.
Read decision: ALLOW proceeds, WARN flags, REQUIRE_APPROVAL pauses for a human, BLOCK stops the merge / aborts the agent step.
On BLOCK, the response explains the patterns, blast radius, and estimated incident cost, and provides mitigation templates.

Decision logic is deterministic: a single breaking change is never silently allowed. Tests can pass and still ship a broken contract — CodeRifts checks the contract itself at PR time.

Also available

GitHub App (zero-config, one-click install) on the GitHub Marketplace — posts a risk scorecard on every pull request.
SDKs: @coderifts/sdk (TypeScript / npm), coderifts-sdk (Python / PyPI).
CLI: coderifts (npm) with a pre-push hook.
Integrations: Backstage plugin, VS Code extension, LangGraph / AutoGen / CrewAI.