Base Mainnet Deploy Quote & Safety Report

CAPI2 Secure Deploy sells wallet-ready Base mainnet Solidity/EVM deployment gas quotes through Apify PPE. Customers can quote arbitrary contract creation code or use the bundled CAPI2 proof contract. Each report combines live L2 execution gas, Base L1 data-fee bounds, recommended safety ceilings, tamper-evident hashes, and unsigned contract-creation data. It never requests a wallet key and never broadcasts the customer's transaction.

The free preflight lets customers validate their request before buying the $0.49 report. Advanced allowlisted GitHub security, Base Sepolia deployment, evidence, and owner-only Base mainnet tools remain available without weakening the public quote's no-custody model.

Buy one quote

The public form opens directly on Custom Base contract deploy quote — $0.49. Replace the two prefilled examples with your public deployer address and compiled contract creation code, set the run maximum to at least $0.49005, and start the Actor. A successful run returns exactly one dataset item containing the live fee estimate, recommended ceiling, quote expiry, integrity hashes, and wallet-ready unsigned transaction data.

The successful quote event costs $0.49. Apify's synthetic Actor-start event can add $0.00005, so $0.49005 is the exact maximum for a one-quote run. Invalid input and failed Base simulation do not trigger the $0.49 quote event, although the Actor-start event can still apply. No gas, wallet signature, private key, GitHub credential, or transaction broadcast is required.

API customers can request the same paid result with a per-run spending cap:

curl -sS -X POST \
  -H "Authorization: Bearer $APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  --data '{
    "product": "base_deploy_quote",
    "deployerAddress": "0x1111111111111111111111111111111111111111",
    "contractCreationCode": "0x60006000f3"
  }' \
  "https://api.apify.com/v2/acts/capi2~capi2-secure-deploy/run-sync-get-dataset-items?build=latest&maxTotalChargeUsd=0.49005"

The Actor is also eligible for Apify agentic payments, so x402 or Skyfire buyers can discover and pay for it without an Apify account. Their payment credential is handled by Apify; it is never sent to the Actor as input.

Actions

preflight

Free validation. No PPE service charge, GitHub write, or blockchain action.

security_gate

Optionally dispatches capi2-foundry-ci.yml and can wait for the result.

deploy_base_sepolia

Optionally dispatches the manually gated Base Sepolia workflow. Execution requires:

• execute=true
• approval=YES_BASE_SEPOLIA
• repository allowed by the server-side allowlist

The downstream GitHub workflow still performs its own compile/test/security/chain/governance gates. Deployment and token 1 minting occur in the constructor as one transaction, so a successful deployment cannot be left without its initial proof NFT.

The engine signs one transaction locally in the GitHub runner, derives its hash before broadcast, and republishes only those identical signed bytes during a transient RPC failure. Repeated bytes have the same nonce and transaction hash, preventing duplicate execution. Concurrent requests with the same authority-context hash are serialized by GitHub Actions.

When agentTask.id is reused, the Actor finds and returns the existing matching workflow run before charging or dispatching. GitHub GET requests use bounded exponential retry; workflow-dispatch POSTs are never retried blindly.

mainnet_estimate

Quotes the bundled CAPI2 proof contract directly against Base mainnet with eth_estimateGas, the live gas price, and Base's GasPriceOracle L1-fee upper bound. The paid result also returns a 20%-buffered gas limit, a 50%-buffered total-fee ceiling, a two-minute quote window, the exact contract init code, and its SHA-256 integrity binding. It has no private key or signing path and always returns broadcast=false. No GitHub token or mainnet broadcast workflow is used.

This public action does not require the caller's repository to be allowlisted. Set execute=false for the free plan or execute=true for the $0.49 PPE report.

Minimal paid input:

{
  "action": "mainnet_estimate",
  "execute": true,
  "mintRecipient": "0x1111111111111111111111111111111111111111",
  "tokenUri": "ipfs://your-metadata-cid"
}

base_deploy_quote

Quotes arbitrary contract creation code supplied by the customer. The Actor validates an exact non-empty hex payload up to Base's 49,152-byte initcode limit, simulates it from the public deployer address, and returns the same fee, safety, integrity, and unsigned-transaction package. The deployer address is public input; private keys are rejected by design.

{
  "action": "base_deploy_quote",
  "execute": true,
  "deployerAddress": "0x1111111111111111111111111111111111111111",
  "contractCreationCode": "0x60006000f3"
}

deploy_base_mainnet

Dispatches the Base mainnet workflow only when all of these independent gates pass:

• the run was started by an Apify user ID in the server-side owner allowlist;
• ENABLE_MAINNET_BROADCAST=true is configured server-side;
• the configured deployer address has at least the transaction-specific fee ceiling;
• execute=true, approval=YES_BASE_MAINNET, performInitialMint=true, a non-zero recipient, an ipfs:// URI, and a 14–20 trillion wei total-fee ceiling are bound into the authority hash;
• the GitHub workflow independently revalidates the exact authority fields before loading the signer.

The public Store interface cannot spend the deployer wallet for other Apify users. The private key exists only in GitHub Actions. The workflow checks chain ID 8453, the expected signer, live balance, gas price, L1 data-fee upper bound, simulated gas, bytecode, owner, token owner, URI, and token count. It signs once and only republishes identical raw transaction bytes during transient RPC failures. Because this capability is publisher-only, it deliberately has no PPE charge; charging the publisher's own Apify account would be cost rather than customer revenue.

status

Read-only GitHub workflow status retrieval by run ID.

Actor secrets / environment

Required only for GitHub API execution:

• GITHUB_TOKEN_CAPI2 — stored as an Actor secret/environment value, never accepted through Actor input.
• ALLOWED_GITHUB_REPOSITORIES — comma-separated server-side allowlist.
• ENABLE_MAINNET_BROADCAST — server-side capability switch; input cannot override it.
• ALLOWED_MAINNET_APIFY_USER_IDS — owner IDs permitted to request a mainnet workflow.
• MAINNET_DEPLOYER_ADDRESS — public address whose live Base mainnet balance is checked before dispatch.
• ENABLE_PPE=false — emergency kill switch; PPE charging is enabled by default after pricing is configured.

The GitHub token should have the minimum repository permissions necessary to read Actions and dispatch only the intended workflows.

Billing

Service	Event	Price
Free validation	none	$0
Base mainnet deploy quote	mainnet-estimate	$0.49
Evidence verification	evidence-result	$0.19
Allowlisted GitHub security gate	security-gate	$2.49
Allowlisted Base Sepolia deployment	deployment-request	$4.99
Owner-only Base mainnet broadcast	none	$0

The versioned price manifest is .actor/pricing.json. Paid output is withheld unless Apify confirms that exactly one event was charged. Prices are experiments, not guaranteed revenue.

Integration-ready / Actor-to-Actor

The input accepts an optional payload object because Apify Actor-to-Actor integrations pass the triggering run/build payload to downstream Actors. The payload is correlation context only; it is never treated as authorization.

MCP / agents

When published, the Actor can be exposed through Apify's MCP tooling. Agents can call the same input contract. agentTask.id is reused as the request/correlation ID where provided.

A2A

Apify has native Actor-to-Actor integrations and MCP. A Google Agent2Agent protocol endpoint is not implemented by this Actor itself. See a2a/README.md for the thin-adapter mapping.

v21 release evidence

The GitHub security gate now prepares coverage, source digests, normalized release evidence, and a Merkle root across evidence artifacts. The Actor may return the GitHub run status/evidence hash, but it must not claim that an OCI image or policy is digitally signed until a real signing key and verification step are configured.

v24 signed authority integration

Every dispatch now includes an authority_context_hash derived from the Actor request. The Base Sepolia GitHub workflow signs a Message Authority Artifact (MAA) only after Gate B succeeds. Gate C verifies that signed artifact against a separately trusted public key and checks the exact source SHA, Actor request ID, and authority-context hash before any simulation or broadcast.

The Actor itself does not receive the private evidence-signing key.

v26 custody model

GitHub Gate B evidence is retained as an AES-256-GCM encrypted package rather than a plaintext Actions artifact. Gate C decrypts it only inside the deployment job before offline verification. Post-deployment evidence and the Gate D release receipt are likewise encrypted for retained artifact storage.

The Actor never receives evidence private keys, release private keys, or AES evidence keys.

v27 read-only evidence verification

action=verify_evidence lets an agent independently verify a completed Base Sepolia workflow run.

The Actor:

1. reads the GitHub run and artifacts;
2. downloads the encrypted Gate B evidence artifact;
3. decrypts it only in the Actor's ephemeral filesystem;
4. verifies AES-GCM custody, signed schema package, mandate/policy cross-hashes, release-evidence hashes, the path-bound Merkle tree, MAA source/context bindings, and the admission receipt;
5. optionally verifies encrypted Gate C post-deploy evidence and the Gate D release receipt.

The verification action has no signing key and no blockchain key. It cannot create authority, dispatch a deployment, mint, or produce a release signature.

Server-side secrets required for full verification:

• GITHUB_TOKEN_CAPI2
• CAPI2_EVIDENCE_AES_KEY_B64
• CAPI2_EVIDENCE_SIGNING_PUBLIC_KEY_B64
• CAPI2_RELEASE_SIGNING_PUBLIC_KEY_B64

These are never accepted from Actor input.