CodeRifts CLI

Detect breaking API changes between OpenAPI specs from the command line. Works locally or with the CodeRifts cloud API.

Installation

npm install -g coderifts

Or run without installing:

npx coderifts diff old-api.yaml new-api.yaml

Quick Start

# Compare two specs locally
coderifts diff old-api.yaml new-api.yaml

# Use cloud API for full governance report
coderifts login
coderifts diff old-api.yaml new-api.yaml --cloud

# CI mode — exit 1 if risk score exceeds threshold
coderifts diff old-api.yaml new-api.yaml --ci --threshold 50

Commands

coderifts diff <old-spec> <new-spec>

Compare two OpenAPI specs and report breaking changes.

| Flag | Description | Default | |------|-------------|---------| | -f, --format <format> | Output format: terminal, json, markdown | terminal | | --ci | CI mode — exit code 1 if breaking changes exceed threshold | false | | --threshold <number> | Risk score threshold for CI mode (0-100) | 50 | | --cloud | Use CodeRifts cloud API instead of local analysis | false | | -c, --config <path> | Path to .coderifts.yml config file | auto-detect |

Output formats:

• terminal — Colored tables and risk score box (default)
• json — Full structured report for programmatic use
• markdown — Markdown table for CI comments

A coderifts-report.json file is always saved to the current directory.

coderifts init

Interactive configuration generator. Creates a .coderifts.yml file with industry-specific presets:

• Default (recommended)
• Fintech / Payments
• Healthcare / HIPAA
• Platform / API-First
• E-commerce

coderifts login

Save your CodeRifts API key for cloud features. Get a free key at app.coderifts.com/api/signup.

CI/CD Integration

GitHub Actions

- name: Check API breaking changes
  run: npx coderifts diff old-api.yaml new-api.yaml --ci --format json

GitLab CI

api-check:
  script:
    - npx coderifts diff old-api.yaml new-api.yaml --ci --threshold 40

Jenkins

sh 'npx coderifts diff old-api.yaml new-api.yaml --ci'

Reproduce our accuracy corpus

We publish the accuracy claims as a runnable proof matrix. Reproduce it yourself with one command — no repo, no API key, no cloud:

npx coderifts corpus verify

This evaluates every trust vector (false-positive / false-negative cases, including MCP prompt-injection "poison" vectors) through the real engine and prints a per-vector PASS/FAIL table plus precision/recall. It exits 0 only when every evaluated vector passes (CI-friendly). Add --json for machine-readable output.

Two honest modes:

• MCP vectors (13) run on bundled pure-JS engines — always verified offline.

• OpenAPI vectors (9) need the oasdiff engine. The command auto-detects it: if present, all 22/22 are verified with the exact engine semantics our service uses; if absent, the 9 OpenAPI vectors are skipped (not failed) with a "13 of 22 verified" note. We do not substitute a weaker JS diff engine, because it would report different verdicts. To verify all 22 offline:

  brew install oasdiff            # macOS
  go install github.com/tufin/oasdiff@latest   # any platform with Go
  npx coderifts corpus verify

Environment Variables

| Variable | Description | |----------|-------------| | CODERIFTS_API_KEY | API key (alternative to coderifts login) | | CODERIFTS_OASDIFF_BIN | Explicit path to the oasdiff binary (overrides auto-detect) | | NO_COLOR | Disable colored output |

Exit Codes

| Code | Meaning | |------|---------| | 0 | No breaking changes (or below threshold) | | 1 | Breaking changes found (in CI mode) or analysis failed |

Links

• Website
• CLI Integration Page
• API Docs
• Get API Key
• GitHub
• npm