CodeRifts — contract-change authorization

Only a granted change can proceed. Before a contract change merges, deploys or registers, CodeRifts decides whether it is authorized — and the check is red without a grant.

One grant binds three things: the authorization, its single use, and the target state the change moves to. The decision is signed, and the receipt verifies offline — you do not have to trust our database to check what was authorized.

Every decision also names what it does not prove.

• Hosted MCP server: https://app.coderifts.com/mcp
• Manifest: https://coderifts.com/mcp.json — the canonical published document. The mcp.json at the root of this repository is a pointer to it, not a second copy.
• Official MCP Registry: io.github.coderifts/api-governance
• Website: https://coderifts.com
• Live demo PR: https://github.com/coderifts/demo/pull/4

Install

# Claude Code
/plugin marketplace add coderifts/api-governance
/plugin install api-governance@coderifts

# Any MCP client (Streamable HTTP) — add to its MCP config
{ "mcpServers": { "coderifts": { "url": "https://app.coderifts.com/mcp",
  "headers": { "Authorization": "Bearer <YOUR_CODERIFTS_API_KEY>" } } } }

# SDKs
npm install @coderifts/sdk
pip install coderifts-sdk

GitHub Copilot reads the same server under three different root keys — servers in .vscode/mcp.json, mcpServers in the cloud agent's MCP settings, and mcp-servers in a custom agent's frontmatter — and npx coderifts copilot-setup writes all three (details below).

A key is needed only to authorize; get one at https://app.coderifts.com/api/signup.

Claude Code plugin

Install the CodeRifts marketplace, then the api-governance plugin (MCP server + skill). Requires CODERIFTS_API_KEY for tool calls.

/plugin marketplace add coderifts/api-governance
/plugin install api-governance@coderifts

Local checkout (after clone):

/plugin marketplace add .
/plugin install api-governance@coderifts

The plugin wires the hosted MCP at https://app.coderifts.com/mcp and the api-governance skill. Tools exposed: preflight_change_set, verify_receipt, get_decision_details only.

Cursor plugin

Cursor Plugin package (measured Cursor layout: .cursor-plugin/plugin.json + skills/ + rules/ + mcp.json + hooks/hooks.json). Same hosted MCP and the same three tools as the Claude plugin — no fourth tool. Deterministic / signed / fail-closed — not an AI compatibility scan.

Validate:

npm run validate:cursor

The generated-rule check is LIVE when CODERIFTS_APP_ROOT (default ~/coderifts-app) has generated/agent-host/.cursor/rules/coderifts.mdc, and RECORDED against fixtures/recorded/app-generator when it does not (weaker, named). A missing or corrupt snapshot still exits 1 — no silent skip.

OpenAI / Codex package

Codex plugin package (meas

... View full README on GitHub