Check an API change before you depend on it

MCP tools report; they do not prevent a call by themselves — see What Each Path Does.

Endpoint#


URL	`https://app.coderifts.com/mcp`
Transport	Streamable HTTP (protocol 2025-06-18)
Auth	Bearer API key — `Authorization: Bearer <key>` (from coderifts.com)
Manifest	`coderifts.com/mcp.json`
Registry	`io.github.coderifts/api-governance`

Connect#

{
  "mcpServers": {
    "coderifts": {
      "url": "https://app.coderifts.com/mcp",
      "headers": { "Authorization": "Bearer <YOUR_CODERIFTS_API_KEY>" }
    }
  }
}

Works with Claude Desktop, Claude Code, Cursor, Windsurf, or your own agent.

MCP tools#

Tool	Call it when…
`preflight_change_set`	Before modifying contract artifacts in one change set. Requires `preflight_mode`: `analyze` (risk only — not permission) or `authorize` (needs `context.operation`; may mint a receipt). Mode-less requests return 400.
`verify_receipt`	To confirm a CodeRifts chain receipt you hold is authentic and unaltered. Not for deciding whether a change is safe — run `preflight_change_set` for that.
`get_decision_details`	To look up a past decision by `decision_id` or `fingerprint`. Read-only — not for making new safety decisions.

Only these three tools are exposed through MCP. Agent-relevant REST endpoints mirror the same calling path for agents without an MCP client:

Endpoint	Description
`POST /api/v1/preflight`	Same job as `preflight_change_set`. Authorize may return a signed receipt; analyze never does.
`POST /api/v1/verify-receipt`	Verify a CodeRifts receipt.
`POST /api/v1/decisions/lookup` · `GET /api/v1/decisions/:id`	Retrieve a previously issued decision.
`POST /api/v1/agent-readiness-score`	Static 0–100 readiness score for one OpenAPI/MCP document (advanced; not a change-set preflight).

Verify the endpoint is live#

curl -sS https://app.coderifts.com/mcp \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"curl","version":"1.0"}}}'

Response contract (Decision Spec v2)#

preflight_change_set is a mode-discriminated union on preflight_mode. Analyze is not permission.

ANALYZE (informational — branch on may_execute / analysis_outcome; no execution_action / decision / safe_for_agent):

{
  "preflight_mode": "analyze",
  "decision_spec_version": "2.0",
  "analysis_outcome": "BREAKS_DETECTED",
  "authorization_effect": "NONE",
  "may_execute": false,
  "receipt_kind": "NONE",
  "risk_score": 57,
  "breaking_changes": 1,
  "patterns": ["..."]
}

AUTHORIZE (operation-bound — requires context.operation; branch on execution_action; gates verify receipt conjunctively):

{
  "preflight_mode": "authorize",
  "decision_spec_version": "2.0",
  "receipt_kind": "operation_authorization",
  "decision": "BLOCK",
  "execution_action": "STOP",
  "safe_for_agent": false,
  "risk_score": 57,
  "chain_receipt": "...",
  "breaking_changes": 1,
  "patterns": ["..."]
}

Mode-less request returns 400. Optional 30-day legacy pin: decision_spec_version: "1.0" (sunset 2026-09-07T00:00:00Z) restores the pre-v2 shape with Deprecation headers. Permission still requires authorize + verified receipt (receipt AND currently_authorized AND operation AND fingerprint AND execution_action) — never analyze alone.

Test your MCP manifest#

Paste any mcp.json URL or content into the tester at coderifts.com/mcp and get an instant agent readiness score out of 100.

Plans & limits#

Tier	Requests / month	Requests / minute	Price
Free	1,000	100	$0
Pro	Unlimited	100	$49/mo
Team	Unlimited	100	$79/mo
Enterprise	Unlimited	Custom	Custom

Free tier is permanent. No credit card required. Rate limit is 100 requests per minute per key on every tier.

See the full field contract on Decision Spec v2 and the runtime guard walkthrough on Agent Quickstart.

Updated Aug 15, 2026