API contract governance for the agent era
"Flags matched exactly as described, including the 0–100 scores and agent impact notes. Zero false positives." — @grok, xAI, after reviewing registry validator architecture
"Catching breaks at the PR, before they cascade into agent workflows, is the right enforcement point. Solid pattern." — @grok, xAI, on the live demo PR: risk 57 · ~$45k · BLOCK · June 2026 (configurable heuristic estimate: engineer rate × migration hours)
The problem: agents depend on stable contracts#
AI agents are the fastest-growing API consumers. And they are the most fragile.
- Agents call APIs via MCP, A2A, and function calling. AI agents depend on stable API schemas to function. When a field is renamed, a type changes, or an endpoint is removed, agents built on that schema silently break.
- No tool catches this before deployment. Observability tools like Datadog and Arize alert after the break. By then, autonomous workflows have already failed, data has been lost, and users are affected.
- Enterprise platforms are pivoting away. MuleSoft, Boomi, and Gravitee are building agent frameworks. They are leaving API contract governance behind — the very foundation agents depend on.
- Breaking changes are invisible until production. A field rename in one service can cascade through dozens of agent integrations. Without contract enforcement at the PR level, these breaks ship undetected.
What CodeRifts does for agent-dependent APIs#
Six capabilities purpose-built for the agent era:
- AI-generated spec safety — Detects AI-generated schemas and flags quality risks across 7 signals: hallucinated endpoints, inconsistent naming, missing constraints, and more.
- Generator-aware risk scoring — Applies a 1.5x risk multiplier when specs are auto-generated. AI-produced schemas carry higher inherent risk.
- SDK surface coverage — Shows how many downstream consumers, including agent integrations, a breaking change affects. Know the blast radius before you merge.
- Policy engine — Freeze windows, breaking budgets, and approval gates protect agent-critical endpoints.
- PR-native enforcement — Catches breaks before merge, not after agent failures in production. Every pull request gets a full risk report, zero configuration required.
- Agent tool schema registry — Register your agent tool schemas, then check every new version against the registered production schema. CodeRifts blocks breaking drift before redeploy, logs it as an incident, and can fire a webhook alert — so a renamed or removed field never silently breaks your agents.
Verdicts you can prove#
Every CodeRifts verdict returns an Ed25519-signed chain receipt. The public key is published; any external party can verify any receipt without an account. Broken chain plus a destructive action escalates to REQUIRE_APPROVAL, fail closed. Determinism survives the crypto: the receipt lives outside the hashed verdict body, so the same input still yields a byte-identical fingerprint. See Portable Verification.
Query the docs, don't just crawl them#
CodeRifts documentation is a live MCP endpoint. Agents can query it in natural language and get answers grounded in the actual docs, with source links — no scraping, no guessing.
MCP server https://91e8f0b5-daeb-4ba7-9114-69956d8d3f96.search.ai.cloudflare.com/mcp
search https://91e8f0b5-daeb-4ba7-9114-69956d8d3f96.search.ai.cloudflare.com/search
chat https://91e8f0b5-daeb-4ba7-9114-69956d8d3f96.search.ai.cloudflare.com/chat/completions
Every tool tells you what broke — this is the only one that prevents it#
| Alerts after the break | Detects agent failure | Prevents the break | |
|---|---|---|---|
| Observability (Datadog, New Relic, Grafana) | ✓ | ||
| Agent monitoring (Arize, LangSmith, W&B) | ✓ | ||
| CodeRifts | ✓ at the pull request, before merge |
CodeRifts is the only PR-native governance layer with deterministic, independently verifiable signed verdicts — at the pull request.
Agent governance roadmap#
Purpose-built contract enforcement for every agent protocol:
- MCP Server Contract Enforcement (Q3 2026) — Validate Model Context Protocol server schemas against breaking changes before deployment.
- A2A Protocol Governance (Q2–Q3 2026) — Agent-to-Agent protocol contract validation; ensure inter-agent communication schemas remain stable.
- Multi-Provider LLM Spec Governance (Q3 2026) — Govern API specifications across multiple LLM providers; detect schema drift between provider versions.
Try the agent readiness score#
Score any OpenAPI spec for agent-readiness across 9 signals. Returns a 0–100 score with per-signal diagnostics.
POST /api/v1/agent-readiness-score (requires a beta API token — see REST API)