coderifts
API governance for agents. Preflight a base→head contract change set before merge/deploy/publish, verify signed receipts, and look up past d
Open source Open in the app JSON README (API)
About
API governance for agents. Preflight a base→head contract change set before merge/deploy/publish, verify signed receipts, and look up past decisions.
Details
- Kind
- Plugins
- Topic
- Cloud & DevOps
- Publisher
- coderifts
- Origin
- gemini
- Category
- ferramentas
- Version
- 1.0.0
- Last push
- 2026-08-25T20:35:09Z
- Repository state
- ativo
- License
- MIT
- Added
- 2026-08-30 14:13:39
- Updated
- 2026-08-30 14:13:39
- Origin id
coderifts/gemini-cli-extension
README
# CodeRifts — Gemini CLI extension
API governance for agents. Preflight a base→head contract change set before merge, deploy, or
publish; verify signed receipts; look up past decisions.
## Install
```bash
gemini extensions install https://github.com/coderifts/gemini-cli-extension
```
Installs to `~/.gemini/extensions/coderifts`. The manifest `name` (`coderifts`) matches that
directory, as the CLI expects.
## What you get
| Component | Path | Effect |
|---|---|---|
| Remote MCP server | `gemini-extension.json` → `mcpServers.coderifts.httpUrl` | 3 tools over Streamable HTTP |
| Session context | `GEMINI.md` | the 4-step act protocol, loaded every session |
| Agent skill | `skills/api-governance/SKILL.md` | auto-activates on contract changes |
| `/coderifts:preflight` | `commands/coderifts/preflight.toml` | preflight the current diff, authorize mode |
| `/coderifts:verify` | `commands/coderifts/verify.toml` | verify a held receipt against intended context |
### The three tools
- **`preflight_change_set`** — preflight a complete base→head change set (OpenAPI/Swagger, GraphQL
SDL, gRPC/protobuf, AsyncAPI, MCP manifest, agent tool schemas). `preflight_mode: "authorize"`
returns a decision, an `execution_action`, and may mint a signed chain receipt;
`preflight_mode: "analyze"` returns informational risk only (`may_execute: false`, no decision, no
receipt).
- **`verify_receipt`** — verify a receipt you already hold: signature authenticity, body binding,
and whether it is currently authorized for a stated operation/target. Branch on
`currently_authorized`.
- **`get_decision_details`** — retrieve a past decision by `decision_id` or `fingerprint`.
That is the entire tool surface. It matches the live `tools/list` exactly.
## Authentication
Discovery works with **no key**: `initialize` and `tools/list` are open, so installation, skill
loading, and `/help` all work immediately. **Running a tool needs a key**, sent as
`Authorization: Bearer <key>`. Get one at <https://coderifts.com>.
The manifest declares a `CODERIFTS_API_KEY` setting, so the CLI will prompt for it at install and
store it (marked `sensitive`) in the extension's `.env`.
**Be aware of a gap:** environment-variable expansion in Gemini CLI is documented only for the
`env` block of an MCP server config — and a remote `httpUrl` server has no such block, because
there is no local process to give an environment to. There is no documented expansion inside
`headers`. So this extension deliberately **does not** ship
`"Authorization": "Bearer ${CODERIFTS_API_KEY}"`: if the placeholder did not expand, the server
would receive that literal string and reject every call with a confusing 401. Shipping a header
that might silently be wrong is worse than shipping none.
Until header expansion is confirmed in your CLI build, set the header yourself in
`~/.gemini/settings.json`:
```json
{
"mcpServers": {
"coderifts": {
"httpUrl": "https://app.coderifts.com/mcp",
"headers": { "Authorization": "Bearer cr_live_your_key_here" }
}
}
}
```
If a later CLI version does expand `headers`, move the key back into the extension setting and
delete the override.
## Honest boundaries
- **CodeRifts does not block merges.** It returns a decision and an `execution_action`. Blocking
requires repository configuration you set separately (required status checks). Installing this
extension changes what your agent *knows*, not what your repo *permits*.
- **Analyze is not permission.** Only the authorize path yields `execution_action` and a receipt.
- **A receipt is operation-scoped.** A merge receipt never authorizes a deploy or publish.
- **`currently_authorized: null` means "not evaluated", not "authorized"** — it is what you get when
no intended context was supplied.
- **`CONTINUE_WITH_MONITORING` presumes a wired monitoring sink.** It is not "proceed with caution".
- **The extension cannot see calls your agent makes outside its tool table.** Reachability is a host
property, not a guarantee from this package.
- **The slash commands register and execute, but MCP tools are not currently in scope for the
sub-agent they delegate to.** Measured on gemini-cli 0.56.0: `/coderifts:preflight` and
`/coderifts:verify` both resolve and run, and no shell policy blocks them — but the
skill-to-sub-agent delegation reports `verify_receipt` and `mcp_coderifts_verify_receipt` as
unavailable to that agent, so an end-to-end command run needs an approval mode that keeps the MCP
tools in scope. Installing the extension and calling the tools directly is unaffected:
`gemini mcp list` reports the server `Connected`, and the model sees exactly the three canonical
tools. We are tracking this.
## Release (repository steps for the maintainer)
Direct install by URL works from any public repo. **Gallery listing needs one extra step that can
only be done in the GitHub web UI:**
1. **Add the `gemini-cli-extension` topic** to the repository's *About* section. The gallery crawler
uses that topic to find new extensions; it runs daily. Without it the extension is installable
but never auto-indexed.
2. Keep `gemini-extension.json` at the **absolute repo root** (it is).
3. Keep the manifest `version` in sync with the GitHub release tag, or the UI shows a mismatched
version. Cutting a GitHub Release also makes installs faster than a plain branch checkout.
4. Users can pin with `--ref <branch|tag|commit>`, and `--pre-release` opts into pre-releases.
Sources: <https://geminicli.com/docs/extensions/releasing/>,
<https://geminicli.com/docs/extensions/reference/>
## License
MIT — see [LICENSE](LICENSE).