{
  "markdown": "# CodeRifts — Gemini CLI extension\n\nAPI governance for agents. Preflight a base→head contract change set before merge, deploy, or\npublish; verify signed receipts; look up past decisions.\n\n## Install\n\n```bash\ngemini extensions install https://github.com/coderifts/gemini-cli-extension\n```\n\nInstalls to `~/.gemini/extensions/coderifts`. The manifest `name` (`coderifts`) matches that\ndirectory, as the CLI expects.\n\n## What you get\n\n| Component | Path | Effect |\n|---|---|---|\n| Remote MCP server | `gemini-extension.json` → `mcpServers.coderifts.httpUrl` | 3 tools over Streamable HTTP |\n| Session context | `GEMINI.md` | the 4-step act protocol, loaded every session |\n| Agent skill | `skills/api-governance/SKILL.md` | auto-activates on contract changes |\n| `/coderifts:preflight` | `commands/coderifts/preflight.toml` | preflight the current diff, authorize mode |\n| `/coderifts:verify` | `commands/coderifts/verify.toml` | verify a held receipt against intended context |\n\n### The three tools\n\n- **`preflight_change_set`** — preflight a complete base→head change set (OpenAPI/Swagger, GraphQL\n  SDL, gRPC/protobuf, AsyncAPI, MCP manifest, agent tool schemas). `preflight_mode: \"authorize\"`\n  returns a decision, an `execution_action`, and may mint a signed chain receipt;\n  `preflight_mode: \"analyze\"` returns informational risk only (`may_execute: false`, no decision, no\n  receipt).\n- **`verify_receipt`** — verify a receipt you already hold: signature authenticity, body binding,\n  and whether it is currently authorized for a stated operation/target. Branch on\n  `currently_authorized`.\n- **`get_decision_details`** — retrieve a past decision by `decision_id` or `fingerprint`.\n\nThat is the entire tool surface. It matches the live `tools/list` exactly.\n\n## Authentication\n\nDiscovery works with **no key**: `initialize` and `tools/list` are open, so installation, skill\nloading, and `/help` all work immediately. **Running a tool needs a key**, sent as\n`Authorization: Bearer <key>`. Get one at <https://coderifts.com>.\n\nThe manifest declares a `CODERIFTS_API_KEY` setting, so the CLI will prompt for it at install and\nstore it (marked `sensitive`) in the extension's `.env`.\n\n**Be aware of a gap:** environment-variable expansion in Gemini CLI is documented only for the\n`env` block of an MCP server config — and a remote `httpUrl` server has no such block, because\nthere is no local process to give an environment to. There is no documented expansion inside\n`headers`. So this extension deliberately **does not** ship\n`\"Authorization\": \"Bearer ${CODERIFTS_API_KEY}\"`: if the placeholder did not expand, the server\nwould receive that literal string and reject every call with a confusing 401. Shipping a header\nthat might silently be wrong is worse than shipping none.\n\nUntil header expansion is confirmed in your CLI build, set the header yourself in\n`~/.gemini/settings.json`:\n\n```json\n{\n  \"mcpServers\": {\n    \"coderifts\": {\n      \"httpUrl\": \"https://app.coderifts.com/mcp\",\n      \"headers\": { \"Authorization\": \"Bearer cr_live_your_key_here\" }\n    }\n  }\n}\n```\n\nIf a later CLI version does expand `headers`, move the key back into the extension setting and\ndelete the override.\n\n## Honest boundaries\n\n- **CodeRifts does not block merges.** It returns a decision and an `execution_action`. Blocking\n  requires repository configuration you set separately (required status checks). Installing this\n  extension changes what your agent *knows*, not what your repo *permits*.\n- **Analyze is not permission.** Only the authorize path yields `execution_action` and a receipt.\n- **A receipt is operation-scoped.** A merge receipt never authorizes a deploy or publish.\n- **`currently_authorized: null` means \"not evaluated\", not \"authorized\"** — it is what you get when\n  no intended context was supplied.\n- **`CONTINUE_WITH_MONITORING` presumes a wired monitoring sink.** It is not \"proceed with caution\".\n- **The extension cannot see calls your agent makes outside its tool table.** Reachability is a host\n  property, not a guarantee from this package.\n- **The slash commands register and execute, but MCP tools are not currently in scope for the\n  sub-agent they delegate to.** Measured on gemini-cli 0.56.0: `/coderifts:preflight` and\n  `/coderifts:verify` both resolve and run, and no shell policy blocks them — but the\n  skill-to-sub-agent delegation reports `verify_receipt` and `mcp_coderifts_verify_receipt` as\n  unavailable to that agent, so an end-to-end command run needs an approval mode that keeps the MCP\n  tools in scope. Installing the extension and calling the tools directly is unaffected:\n  `gemini mcp list` reports the server `Connected`, and the model sees exactly the three canonical\n  tools. We are tracking this.\n\n## Release (repository steps for the maintainer)\n\nDirect install by URL works from any public repo. **Gallery listing needs one extra step that can\nonly be done in the GitHub web UI:**\n\n1. **Add the `gemini-cli-extension` topic** to the repository's *About* section. The gallery crawler\n   uses that topic to find new extensions; it runs daily. Without it the extension is installable\n   but never auto-indexed.\n2. Keep `gemini-extension.json` at the **absolute repo root** (it is).\n3. Keep the manifest `version` in sync with the GitHub release tag, or the UI shows a mismatched\n   version. Cutting a GitHub Release also makes installs faster than a plain branch checkout.\n4. Users can pin with `--ref <branch|tag|commit>`, and `--pre-release` opts into pre-releases.\n\nSources: <https://geminicli.com/docs/extensions/releasing/>,\n<https://geminicli.com/docs/extensions/reference/>\n\n## License\n\nMIT — see [LICENSE](LICENSE).\n",
  "bytes": 5664,
  "sha": "dcfc416f966c8794971d52b94b15b6869f40769c203d975bb99e12b861424342",
  "repo_slug": "coderifts/gemini-cli-extension",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/plg_coderifts_gemini_cli_extension_5172f0f0/readme"
}