Log inSubmit server
API Governance logo

API Governance

Authorizes contract changes with risk analysis, governance decisions, and signed receipts that can be verified offline.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install API Governance

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "api-governance-2": {
      "command": "npx",
      "args": [
        "-y",
        "coderifts"
      ],
      "env": {
        "CODERIFTS_API_KEY": "YOUR_VALUE_HERE"
      }
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

Values are written into the snippet above so you can paste it as is. They never leave your browser.

We couldn’t confirm it starts correctly

The install command installed and started the server, which then stopped for configuration (such as an API key) that our sandbox does not have — expected for servers that connect to your account.

npx -y coderifts

No response to initialize.

This is an experimental automated check and can have false negatives — missing environment variables, a slow cold install, etc. It doesn’t necessarily mean something’s wrong. Last checked 22d ago.

Overview

The api-governance MCP server evaluates contract-artifact changes before they merge, deploy, or register. Its preflight tool compares a complete base-to-head change set, reports risk and breaking changes, and can return an authorization decision when given operation context. Signed chain-receipts bind the decision to a target state and can be checked offline. Use it when an automated workflow needs an explicit ALLOW, WARN, REQUIRE_APPROVAL, or BLOCK outcome for contract changes.

Use cases

  • Preflight contract changes before merging or deploying
  • Require an authorization decision for contract registration
  • Verify signed change receipts without querying the database
  • Retrieve prior governance reports by decision ID

Key features

  • Base-to-head contract change analysis
  • Breaking-change detection and risk scoring
  • ALLOW, WARN, REQUIRE_APPROVAL, and BLOCK decisions
  • Signed chain-receipts
  • Offline receipt verification
  • Historical decision lookup

Tools3

What API Governance lets your agent do. Expand a tool for its parameters.

Self-reported~198 tokens of context

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked 1d ago

Recent health check succeeded.

9/9 checks healthy over the last 44d

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 14d ago via OSV.dev · coderifts (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

npm downloads1kPackage downloads in the last 30 days.
Last commit5d agoMost recent push to the default branch.
Install checkRunsOur sandbox started it; it then asked for an API key or config.
Tools exposed3Callable tools this server registers over MCP.
Directory activity3 viewsConfig copies, upvotes, and views on AllMCPs.

How API Governance works

What the api-governance MCP server does

The api-governance MCP server governs changes to contract artifacts. It accepts a complete base-to-head change set and produces a report containing risk scoring and breaking-change analysis. When invoked in authorization mode with an operation in the context, it can turn that analysis into one of four outcomes: ALLOW, WARN, REQUIRE_APPROVAL, or BLOCK.

An authorization may include a signed chain-receipt. The receipt connects the authorization, its single use, and the target state reached by the change. Its signature and body binding can be checked without relying on the service database. The decision also identifies what the authorization does not establish, which is relevant when interpreting a granted change.

How it works

Call preflight_change_set with the full change set rather than asking the service to analyze only an isolated file or edit. A normal preflight returns the analysis. Passing preflight_mode: "authorize" and supplying context.operation requests a governance decision and may mint a receipt.

Use verify_receipt after receiving a receipt. The tool checks the signature and whether the receipt body matches its signed content. If lifecycle indices are available, it can also determine whether the receipt is currently authorized for the stated operation and target. Verification does not re-diff specifications, so it is not a replacement for a new preflight.

get_decision_details retrieves a previous result using decision_id, preferably, or fingerprint. It returns the stored report, breaking-change data, scores, and related receipt metadata when present. It is intended for looking up an existing decision, not for analyzing a newly changed set.

Setup and configuration

The hosted Streamable HTTP endpoint is https://app.coderifts.com/mcp. Configure an MCP client with that URL and an Authorization: Bearer <YOUR_CODERIFTS_API_KEY> header. The key is needed for authorization and can be obtained from the service signup endpoint at https://app.coderifts.com/api/signup.

Claude Code users can install the marketplace plugin, which wires the hosted endpoint and exposes the three tools. Cursor and Codex packages use the same hosted MCP and tool set. For VS Code and GitHub Copilot, the repository provides generated configuration paths for the relevant Copilot surfaces; npx coderifts copilot-setup writes the setup, while npx coderifts agent-setup writes agent-host instructions.

The repository also documents JavaScript and Python SDK installation through @coderifts/sdk and coderifts-sdk. Its published MCP manifest is available at https://coderifts.com/mcp.json, and the official registry identifier is io.github.coderifts/api-governance.

Tools and capabilities

  • preflight_change_set: analyzes a complete contract-artifact change set and, in authorization mode, returns a decision and possibly a signed receipt.
  • verify_receipt: validates a held receipt's signature and body binding, with optional current-authorization checks from lifecycle indices.
  • get_decision_details: retrieves stored decision reports and associated receipt information by decision ID or fingerprint.

The api-governance MCP server is designed for fail-closed change gates: downstream automation can require a grant before allowing a contract change to proceed. Its receipts provide an offline-verifiable record of what was authorized, while the decision report supplies the risk and breaking-change context behind that result.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about API Governance

api-governance is an MCP server that connects AI agents to CodeRifts’ hosted contract-change authorization service. Its main tools preflight complete contract change sets, verify signed chain-receipts, and retrieve past decisions. It reports breaking changes and risk, then can return ALLOW, WARN, REQUIRE_APPROVAL, or BLOCK decisions.

Install it by configuring an MCP client for `https://app.coderifts.com/mcp` with a Bearer API key, or use the documented Claude Code, Cursor, Codex, or Copilot package setup. Claude Code can install the `api-governance` plugin from the CodeRifts marketplace.

Use `verify_receipt` with the receipt’s `token`. It checks signature authenticity and body binding, and can check current authorization for an operation and target when lifecycle indices are available. It does not perform a new specification diff.

Yes. Call `get_decision_details` with the prior `decision_id`, or use its `fingerprint` lookup when a decision ID is unavailable. The response includes the stored report, breaking changes, scores, and linked receipt metadata when present.

Related MCP servers

All in Agreements & Coordination All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewAPI Governance AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/api-governance-2?style=directory)](https://allmcps.com/mcp/api-governance-2)
HTML Embed
<a href="https://allmcps.com/mcp/api-governance-2"><img src="https://allmcps.com/api/badge/api-governance-2?style=directory" alt="API Governance on AllMCPs" /></a>