Preflight

Endpoints (8 live)

• POST /v1/btc/tx-context — Call before signing a Bitcoin transaction when you need chain context for its inputs: whether each prevout exists, whether it is already spent, its value in sats and its confirmations. Resolves up to 10 inputs against a public explorer at about one request per second, so a full batch can take over 20 seconds; figures reflect chain state at checked_at. Describes on-chain facts with source links; never advises whether to sign. (0.1 USDC on Base)
• POST /v1/btc/tx-inspect — Call before signing or broadcasting a Bitcoin transaction. Decodes a raw transaction hex or a PSBT and returns inputs, outputs, script types, addresses, vsize, fee rate when derivable, and objective signals such as RBF, dust outputs, non-standard sighash flags and unsigned inputs. Parses only the bytes you send: no network access. Describes the transaction; never advises whether to sign it. (0.1 USDC on Base)
• POST /v1/deps/check — Call before installing packages suggested by a language model. Returns, for each npm or PyPI package name, whether it actually exists in the registry, whether it is deprecated or yanked, and — when the name is not found — the closest real package names. Catches hallucinated dependencies (slopsquatting) before an agent installs them. Never inspects package contents and never returns a safety verdict. (0.05 USDC on Base)
• POST /v1/ai-act/obligations — Call when you need to know which articles of the EU AI Act mention a given obligation for a given role (provider, deployer, importer, distributor, authorised representative). Returns the matching articles with headings, excerpts and EUR-Lex links from a pinned corpus version. Retrieval over the official text: it does not classify your system or assess compliance. (0.1 USDC on Base)
• POST /v1/deps/version-check — Call before pinning or installing a specific package version in npm, PyPI or crates.io. Returns whether that exact version exists in the official registry, its publication timestamp, whether it is deprecated or yanked, its published artifact hashes, and whether an expected SRI/hex digest matches. Compares registry metadata only and never returns a safety verdict. (0.05 USDC on Base)
• POST /v1/legal/cite-check — Call before publishing a claim that cites EU law. Checks that the cited instrument exists in our pinned corpus, that the cited article exists within it, and whether your quoted text actually appears in that article. Covers the AI Act, GDPR, NIS2, DORA and the Cyber Resilience Act. Returns the official article text with a EUR-Lex link. Citation verification only: it never gives legal advice or classifies systems. (0.1 USDC on Base)
• POST /v1/cve/check — Call before acting on CVE identifiers produced by a model. Returns whether each CVE record exists and its state (published or rejected), with severity and the official CVE record link. Catches fabricated advisory references. Does not tell you whether to patch. (0.05 USDC on Base)
• POST /v1/evm/tx-inspect — Call before signing an Ethereum or Base transaction or calldata. Decodes raw transaction bytes or contract calldata against standard interfaces (ERC-20, ERC-721, ERC-1155, WETH, EIP-2612 Permit and Permit2) in memory. Returns the decoded method signature, typed parameters, value in wei and standard specification links. Mechanical byte decoding only: never simulates state or advises whether to sign. (0.1 USDC on Base)