53 governance features. One PR comment.
Free tier — 9 features, no credit card required#
Breaking Change Detection
Core diff engine for OpenAPI 3.0/3.1: endpoint removals, required field additions, response type changes, enum restrictions, auth changes, parameter modifications
Auto-Discovery
Scans your repo for .yaml/.yml/.json files matching OpenAPI patterns, no configuration needed
Semver Suggestion — Reads your current version and suggests the correct next version based on breaking changes detected
Lifecycle Labels — Tags each change: new-endpoint, field-removed, deprecated, and more
API Surface Stats — Endpoint, field, and schema counts in every PR
Commit Consistency Check — Warns when breaking changes are detected but the PR title doesn't include a version bump like
feat!:Breaking Changes Table — Every change gets its own row with endpoint, risk level, action type, and a link to the diff
"REST in Peace" — A dedicated memorial section for removed endpoints
Web UI, CLI & REST API — Browser, terminal, or API — three ways to use CodeRifts
Risk & scoring#
- 4D Risk Score — Composite 0–100 score across severity, surface, auth, and stability, with a color-coded gauge.
- Confidence Score — 0–100 rating factoring in spec completeness, change specificity, and engine agreement. Low confidence triggers a warning.
- Stability Grade — A+ to F grade based on breaking change history over the last 30 days, with a trend arrow.
- Change Intent Classifier — Tags each change as Structural, Behavioral, or Security.
Security (Pro)#
- Auth Downgrade Detection — Flags when endpoints lose authentication requirements: OAuth2 downgraded to API key, bearer tokens removed, security schemes weakened.
- Scope & Permission Tracker — Detects OAuth scope changes and permission model shifts.
AI & generator awareness (Pro)#
- AI-Generated Spec Safety — Identifies patterns typical of LLM-generated OpenAPI specs: hallucinated endpoints, inconsistent naming, missing security schemes, overly generic descriptions.
- Generator-Aware Risk — Adjusts risk scoring based on the spec generator used (Swagger Codegen, OpenAPI Generator, etc.) and known generator quirks.
Insights & reporting (Pro)#
- API Design Lint — 8 lint rules: naming conventions, pagination, error response consistency.
- Auto-Changelog — Structured changelog grouped by breaking, added, changed, deprecated.
- Deprecation Lifecycle Tracker — Monitors
x-deprecatedandx-sunsetheaders; warns when deprecated endpoints are removed before the sunset period completes. - Documentation Coverage Score — A–F grade for spec completeness: descriptions, examples, schemas.
- Docs Drift Detection — Warns when schema changes happen without documentation updates.
Structural & governance (Team)#
- Heritage Mode — Versioning suggestions for heavily modified endpoints.
- CODEOWNERS Suggestion — Auto-generates CODEOWNERS based on domain ownership config.
- Versioning Strategy Advisor — Detects your versioning approach and flags inconsistencies.
- PII Detection — Scans new fields for personally identifiable information (ssn, credit_card, passport) with GDPR/CCPA compliance warnings.
- Breaking Change Density Score — Measures breaking changes relative to API size (0–100). Critical density triggers automatic block.
- Compatibility Mode Suggestions — Suggests backward-compatible alternatives to detected breaking changes.
See the full tier breakdown and pricing on Pricing.