Api Governance

coderifts/api-governance

This connects Claude to a self-hosted CodeRifts instance for API governance during development. It monitors API calls your agent makes, detects breaking changes in real time, and can block requests that exceed safety thresholds. You'd reach for this when your AI workflows interact with production APIs and you need a safety layer that scores blast radius before changes go through. The self-hosted setup runs via Docker Compose with PostgreSQL and Redis, so you keep governance policies and API traffic logs on your own infrastructure. Useful if you're building agent workflows that modify or deploy APIs and need audit trails or rollback protection.

tools: 3
auth: Secret needed
transport: HTTP
last updated: Sep 20, 2026

View on GitHub

Install

From registry metadata

$ npx add-mcp https://app.coderifts.com/mcp --name api-governance --header 'Authorization: Bearer ${API_TOKEN}'

Run in your terminal. add-mcp asks which agents to add it to, then asks for each value it needs. Add -g to install it for every project.

Review the command, arguments and environment values before installing. MCP servers run with your local permissions.

Other ways

Claude Code

$ claude mcp add --transport http api-governance https://app.coderifts.com/mcp --header 'Authorization: YOUR_AUTHORIZATION'

Run in your terminal. Add --scope user to make it available in every project.

Tools

Verified live · 3 tools

Verified live against the running server on Nov 6, 2026.

preflight_change_setUse this when: a contract artifact (OpenAPI, GraphQL, protobuf, AsyncAPI, MCP manifests, or agent tool schemas) changes before merge, deploy, publish, or tool registration; AND any agent-executed operation with no supported contract type — send type agent_operation. Do not cal...9 params

Use this when: a contract artifact (OpenAPI, GraphQL, protobuf, AsyncAPI, MCP manifests, or agent tool schemas) changes before merge, deploy, publish, or tool registration; AND any agent-executed operation with no supported contract type — send type agent_operation. Do not cal...

Parameters* required

artifactsarray

1–20 contract documents analyzed together. Each item is {id, type, before, after} where before/after are the FULL document strings (YAML/JSON/proto text), not URLs or file paths. Omit this array en...

contextobject

Optional apply-site context folded into the bundle fingerprint. operation distinguishes merge vs deploy vs publish (and other labels); the server accepts any non-empty string; conventional values:...

decision_spec_versionstring

Optional. Omit or '2.0' = current contract. '1.0' retired (INVALID_INPUT); do not pin 1.0.one of 2.0

derivationstring

"server" = the server derives artifacts[] from GitHub Compare via the App installation. Allowed only when context.repository, context.base and context.head are all present and the tenant has a prov...one of server

execution_grant_requestobject

Authorize + include_execution_grant only: the execution-grant request fields. Analyze ignores them. Flat root-level spellings are also accepted; the same field sent both ways with different values...

idempotency_keystring

Optional client key; in authorize mode, a repeat with the same key + body replays the original decision (24h). Analyze responses are not replayed.

preflight_mode*string

REQUIRED. "analyze" = informational risk only (no decision/execution_action/safe_for_agent; analysis_outcome + may_execute:false). "authorize" = operation-bound path; may mint a receipt (requires c...one of analyze · authorize

previous_receiptstring

Optional prior chain token to LINK this call into a receipt chain: base64url(body).base64url(signature). Linking is not verification — a linked token is not re-checked here; use verify_receipt.

response_detailstring

How much of the response to return. control = the fields an agent branches on; standard = control + the human report and labelled break rows (the MCP default); full = everything (the REST default)....one of control · standard · full

verify_receiptVerify a CodeRifts signed chain-receipt you ALREADY HOLD: cryptographic authenticity (signature + key id), body binding, and — when lifecycle indices are available — whether it is currently valid authorization (not expired, superseded, or revoked) for a stated operation/target...12 params

Verify a CodeRifts signed chain-receipt you ALREADY HOLD: cryptographic authenticity (signature + key id), body binding, and — when lifecycle indices are available — whether it is currently valid authorization (not expired, superseded, or revoked) for a stated operation/target...

Parameters* required

audiencestring

Intended audience — must match the receipt

basestring

Intended base commit/ref SHA the receipt must match (signed-wins vs envelope.base)

branchstring

Intended branch the receipt must bind (place binding; optional)

decision_resultobject

The body_hash-bound decision envelope (carries operation/target/decision). Required for a meaningful AUTHORIZATION evaluation of scope; without it, intended context alone fails closed on authorizat...

environmentstring

Intended environment (e.g. production) — must match the receipt

fingerprintstring

Intended change fingerprint — must equal the receipt fp

headstring

Intended head commit/ref SHA the receipt must match (signed-wins vs envelope.head)

operationstring

Intended operation the receipt must authorize (conventional: merge|deploy|tool_call|publish). Triggers authorization evaluation when non-empty; supply decision_result for full scope binding.

pull_requestvalue

Intended pull-request id the receipt must bind (place binding; optional)

repositorystring

Intended repository the receipt must bind (place binding; optional)

target_idstring

REQUIRED to authorize under a held receipt. Set it to decision_result.artifact_digest — the digest of the artifact the receipt was issued for, which you already hold in the decision_result you are...

token*string

The chain receipt token (base64url(body).base64url(signature))

get_decision_detailsRetrieve a PAST CodeRifts decision by exactly one identifier (case_id | decision_id | fingerprint): full report, breaking changes, scores, and linked receipt metadata if stored. Use this when: - You have a decision_id (or fingerprint) from a previous preflight, PR comment, or...3 params

Retrieve a PAST CodeRifts decision by exactly one identifier (case_id | decision_id | fingerprint): full report, breaking changes, scores, and linked receipt metadata if stored. Use this when: - You have a decision_id (or fingerprint) from a previous preflight, PR comment, or...

Parameters* required

case_idstring

A case identifier. Lookup never opens a case. Until the case store exists this returns CASE_NOT_FOUND.

decision_idstring

The decision_id from a prior decision_result envelope. Provide exactly one identifier.

fingerprintstring

A verdict fingerprint (sha256:...); returns the latest matching decision you own. Provide exactly one identifier.

Readme

CodeRifts — contract-change authorization

Only a granted change can proceed. Before a contract change merges, deploys or registers, CodeRifts decides whether it is authorized — and the check is red without a grant.

One grant binds three things: the authorization, its single use, and the target state the change moves to. The decision is signed, and the receipt verifies offline — you do not have to trust our database to check what was authorized.

Every decision also names what it does not prove.

Hosted MCP server: https://app.coderifts.com/mcp
Manifest: https://coderifts.com/mcp.json — the canonical published document. The mcp.json at the root of this repository is a pointer to it, not a second copy.
Official MCP Registry: io.github.coderifts/api-governance
Website: https://coderifts.com
Live demo PR: https://github.com/coderifts/demo/pull/4

Install

# Claude Code
/plugin marketplace add coderifts/api-governance
/plugin install api-governance@coderifts

View the full README on GitHub

Details

Repository: github.com/coderifts/api-governance
Website: coderifts.com
Category: Security & Pentesting
Transport: HTTP
Auth: Required
Registry: MCP registry, active
Tools verified: Nov 6, 2026

Related Security & Pentesting MCP servers

View all

Preflightdainidude/preflight-x402Pay-per-call smart-contract security: scans, tx simulation, and token risk via x402 (USDC on Base).0stars

Easysendeasysend-co/easysend-mcpEasySend file sharing MCP server - upload, download and share files. No authentication required.0stars

Aegis Policyio.github.evozim/aegis-policyGovernance firewall and safety guardrails oracle for AI swarms.0stars

X402 Apifernsugi/x402-api-mcp-serverEight paid DeFi tools: prices, gas, swaps, token security, holders, yields, funding and wallets0stars

Contract Security Scannerfino-oss/contract-scanner-mcpScans Base L2 smart contracts for security risks. Risk score 0-100, detects backdoors & proxies.0stars

Garita MCPgaritalab5/garita-mcp-server30 security tools + the Vigia agent to audit MCP servers before you connect.0stars