Skip to main content
Glama
Sign In
Preflight

Preflight

by dainidude
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Remote

Preflight — x402-paid smart-contract pre-flight security API

Pay-per-call security scans and transaction simulations for AI agents. POST Solidity source or a transaction, receive a severity-scored, EIP-712-attested verdict: looks_ok | review | block. Payments over the x402 protocol (HTTP 402 + real USDC on Base mainnet).

Built from the product plan in dud3-vault/LLM/2026-11-08 - x402 Product Plans.md by hermes + omp + crush + opencode in a 4-pane Herdr session.

Try it

# no wallet needed (server DEV_MODE=1):
uv run uvicorn preflight.api.app:app --port 8000 &
uv run python client/pay_client.py --dev

# real x402 payment (funded burner, $0.01):
uv run python client/pay_client.py

# the handshake, by hand:
curl -i -X POST http://127.0.0.1:8000/v1/scan -H 'Content-Type: application/json' \
  -d '{"source":"contract A {}"}'
# → 402, PAYMENT-REQUIRED header (base64 JSON requirements)
# → retry with PAYMENT-SIGNATURE header → verdict + PAYMENT-RESPONSE

Related MCP server: BlueAgent x402 Services

Endpoints & prices

Route

Price

POST /v1/scan — single-file security scan (solc+Slither + 5 custom DeFi detectors)

$0.01

POST /v1/sim — transaction pre-flight simulation (RPC eth_call, revert decode)

$0.05

POST /v1/scan/project — multi-file project scan

$0.10

POST /v1/address-risk — address risk heuristics

$0.005

GET / GET /health GET /metrics GET /llms.txt GET /.well-known/x402.json

free

First 10 scans/day per client are free (funnel). 10 req/min per payer.

Architecture

client/pay_client.py        paying demo agent (402 → x402.client pay → retry)
src/preflight/
  core/    pipeline (solc+Slither), custom detectors, scoring,
           simulation (RPC eth_call + revert decoding)
  api/     FastAPI app, real x402 middleware (x402 pkg, x402.org facilitator),
           cache (source-hash LRU), ratelimit, metrics
  mcp/     MCP server: preflight_check, preflight_sim, preflight_pricing
public/    llms.txt + .well-known/x402.json (discovery)

  • Payments: x402 package v2 — exact scheme, USDC, Base mainnet (CDP facilitator with KYT/OFAC); facilitator verifies + settles; server never holds custody.

  • Attestations: EIP-712 over (source_sha256, verdict, findings_root) — buyers can prove what we said.

  • Determinism: static analysis + eth_call simulation; verdicts are reproducible.

Listing

Docs

  • AGENTS.md — ownership map & interface contract

  • docs/LAUNCH.md — launch checklist, tunnel, mainnet flip, operating notes

  • docs/STATUS_*.md — per-area build reports

Test

uv run pytest tests/ -m "not network"   # offline suite
uv run pytest tests/ -m network          # live-RPC + real paid flows (spends test USDC)

Available Tools

4 tools
preflight_checkAInspect

Scan Solidity source and return a security verdict. This is a paid call ($0.01 USDC on Base mainnet) that flows through x402; in dev mode (DEV_MODE=1) no payment is required.

Inputs: source (required), contract_name. Returns: result

preflight_pricingAInspect

Return the Preflight service info and price list (free).

Inputs: no named parameters. Returns: result

preflight_simAInspect

Simulate a transaction against a contract and return revert reason, gas used, balance deltas, and severity-scored findings. mode='quick' costs $0.05 (eth_call); mode='deep' costs $0.25 (anvil local fork with gas, balance_delta_wei, and internal_calls). Paid in USDC on Base mainnet via x402; DEV_MODE=1 skips payment.

Inputs: to (required), data, mode, value_wei. Returns: result

preflight_token_riskAInspect

Check a token contract before trading it. Returns a honeypot transfer verdict, transfer tax percentage, and owner privileges as a severity-scored ScanReport. Paid call ($0.05 USDC on Base mainnet) via x402; DEV_MODE=1 skips payment.

Inputs: address (required). Returns: result

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

    Deploy Server
    One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

    TDQS

    A3.9/5.0

    Scored across 4 tools

    Disambiguation4/5

    Each tool has a distinct primary target: source-code security scan, transaction simulation, token risk assessment, and pricing info. preflight_check and preflight_token_risk both return security-related reports, so an agent might occasionally need the descriptions to choose correctly, but the boundary is reasonably clear.

    Naming Consistency5/5

    All four tools use a consistent preflight_ snake_case prefix followed by a clear action or resource noun. There are no mixed casing or verb-style inconsistencies.

    Tool Count5/5

    Four tools is a well-scoped surface for a focused smart-contract preflight service. Each tool corresponds to a meaningful operation or necessary service-discovery endpoint.

    Completeness4/5

    The set covers the core workflows: source scanning, transaction simulation with quick/deep modes, token risk checking, and pricing discovery. Minor gaps exist around retrieving past reports, batch operations, or status/history, but the essential lifecycle is represented.

    Maintenance

    ActivityMaintained
    ResponsivenessNo recent community issues

    Resources

    Related MCP Connectors

    Related MCP Servers