PreFlight Checker live on Base mainnet

Check before you trust it.

If you're building or running an AI agent, it sometimes has to decide whether to trust something before acting on it: a code library it's about to install, another API it's about to call, a website it's about to visit. Four quick checks answer that in seconds, for a few cents each.

Before you run someone's code

Check whether an npm package is what it claims to be, not a copycat with a similar name, before your agent installs it.

Before you trust another service

Check whether a GitHub project is actively maintained, or whether a domain is even live, before you build on top of it.

Before you go live yourself

If you're running your own x402 service, find out why buyers or directories might see it as broken, and the exact fix.

Try it

Run this, swapping in any real npm package name:

$ curl "x402-api-catalog.onrender.com/api/trust-check?package=left-pad"
< {"package": "left-pad", "score": 70, "verdict": "trustworthy", "reasons": [...]}

The first response asks for two cents in USDC on Base. Any x402-capable client (like awal) handles that automatically and hands back the real result above.

Endpoints

Code checks

GET /api/trust-check $0.02 npm package trust check: registry age, weekly downloads, GitHub org/stars, OSV.dev vulnerabilities, typosquat detection.
GET /api/repo-health $0.02 GitHub repo health: stars, forks, open issues, last commit age, archived status, license.

Network checks

GET /api/domain-check $0.02 Domain liveness: DNS resolution, mail routing, HTTP reachability.

Chain checks

GET /api/contract-check $0.05 EVM token contract safety: honeypot/mint/blacklist/pausable flags, ownership renouncement, transfer tax, and a real token-impersonation check against USDC/WETH/DAI/cbBTC.

Ops checks

GET /api/x402-doctor $1.00 Audits another x402 service: why aggregators mark it "down," and the exact fix.
GET /api/mcp-audit $0.06 MCP server safety audit: real initialize+tools/list handshake, static scan for tool-poisoning/prompt-injection, plus an optional GitHub supply-chain signal.

Verified, not claimed