# Base Mainnet Deploy Quote & Safety Report (`capi2/capi2-secure-deploy`) Actor

Generate a wallet-ready Base mainnet Solidity/EVM contract deployment gas quote with live L2/L1 fees, safety ceilings, integrity hashes, and unsigned transaction data. No wallet key or custody required.

- **URL**: https://apify.com/capi2/capi2-secure-deploy.md
- **Developed by:** [Dries Van Durme](https://apify.com/capi2) (community)
- **Categories:** Developer tools, Automation, AI
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $0.49 / base mainnet deploy quote

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

## Base Mainnet Deploy Quote & Safety Report

CAPI2 Secure Deploy sells wallet-ready Base mainnet Solidity/EVM deployment gas quotes through Apify PPE. Customers
can quote arbitrary contract creation code or use the bundled CAPI2 proof contract. Each report
combines live L2 execution gas, Base L1 data-fee bounds, recommended safety ceilings, tamper-evident
hashes, and unsigned contract-creation data. It never requests a wallet key and never broadcasts
the customer's transaction.

The free preflight lets customers validate their request before buying the `$0.49` report. Advanced
allowlisted GitHub security, Base Sepolia deployment, evidence, and owner-only Base mainnet tools
remain available without weakening the public quote's no-custody model.

### Buy one quote

The public form opens directly on **Custom Base contract deploy quote — $0.49**. Replace the two
prefilled examples with your public deployer address and compiled contract creation code, set the
run maximum to at least `$0.49005`, and start the Actor. A successful run returns exactly one
dataset item containing the live fee estimate, recommended ceiling, quote expiry, integrity hashes,
and wallet-ready unsigned transaction data.

The successful quote event costs `$0.49`. Apify's synthetic Actor-start event can add `$0.00005`,
so `$0.49005` is the exact maximum for a one-quote run. Invalid input and failed Base simulation do
not trigger the `$0.49` quote event, although the Actor-start event can still apply. No gas, wallet
signature, private key, GitHub credential, or transaction broadcast is required.

API customers can request the same paid result with a per-run spending cap:

```bash
curl -sS -X POST \
  -H "Authorization: Bearer $APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  --data '{
    "product": "base_deploy_quote",
    "deployerAddress": "0x1111111111111111111111111111111111111111",
    "contractCreationCode": "0x60006000f3"
  }' \
  "https://api.apify.com/v2/acts/capi2~capi2-secure-deploy/run-sync-get-dataset-items?build=latest&maxTotalChargeUsd=0.49005"
```

The Actor is also eligible for Apify agentic payments, so x402 or Skyfire buyers can discover and
pay for it without an Apify account. Their payment credential is handled by Apify; it is never sent
to the Actor as input.

### Actions

#### `preflight`

Free validation. No PPE service charge, GitHub write, or blockchain action.

#### `security_gate`

Optionally dispatches `capi2-foundry-ci.yml` and can wait for the result.

#### `deploy_base_sepolia`

Optionally dispatches the manually gated Base Sepolia workflow. Execution requires:

- `execute=true`
- `approval=YES_BASE_SEPOLIA`
- repository allowed by the server-side allowlist

The downstream GitHub workflow still performs its own compile/test/security/chain/governance
gates. Deployment and token `1` minting occur in the constructor as one transaction, so a
successful deployment cannot be left without its initial proof NFT.

The engine signs one transaction locally in the GitHub runner, derives its hash before broadcast,
and republishes only those identical signed bytes during a transient RPC failure. Repeated bytes
have the same nonce and transaction hash, preventing duplicate execution. Concurrent requests with
the same authority-context hash are serialized by GitHub Actions.

When `agentTask.id` is reused, the Actor finds and returns the existing matching workflow run before
charging or dispatching. GitHub GET requests use bounded exponential retry; workflow-dispatch POSTs
are never retried blindly.

#### `mainnet_estimate`

Quotes the bundled CAPI2 proof contract directly against Base mainnet with `eth_estimateGas`, the live gas price,
and Base's GasPriceOracle L1-fee upper bound. The paid result also returns a 20%-buffered gas limit,
a 50%-buffered total-fee ceiling, a two-minute quote window, the exact contract init code, and its
SHA-256 integrity binding. It has no private key or signing path and always returns
`broadcast=false`. No GitHub token or mainnet broadcast workflow is used.

This public action does not require the caller's repository to be allowlisted. Set `execute=false`
for the free plan or `execute=true` for the `$0.49` PPE report.

Minimal paid input:

```json
{
  "action": "mainnet_estimate",
  "execute": true,
  "mintRecipient": "0x1111111111111111111111111111111111111111",
  "tokenUri": "ipfs://your-metadata-cid"
}
```

#### `base_deploy_quote`

Quotes arbitrary contract creation code supplied by the customer. The Actor validates an exact
non-empty hex payload up to Base's 49,152-byte initcode limit, simulates it from the public deployer
address, and returns the same fee, safety, integrity, and unsigned-transaction package. The deployer
address is public input; private keys are rejected by design.

```json
{
  "action": "base_deploy_quote",
  "execute": true,
  "deployerAddress": "0x1111111111111111111111111111111111111111",
  "contractCreationCode": "0x60006000f3"
}
```

#### `deploy_base_mainnet`

Dispatches the Base mainnet workflow only when all of these independent gates pass:

- the run was started by an Apify user ID in the server-side owner allowlist;
- `ENABLE_MAINNET_BROADCAST=true` is configured server-side;
- the configured deployer address has at least the transaction-specific fee ceiling;
- `execute=true`, `approval=YES_BASE_MAINNET`, `performInitialMint=true`, a non-zero recipient,
  an `ipfs://` URI, and a 14–20 trillion wei total-fee ceiling are bound into the authority hash;
- the GitHub workflow independently revalidates the exact authority fields before loading the signer.

The public Store interface cannot spend the deployer wallet for other Apify users. The private key
exists only in GitHub Actions. The workflow checks chain ID 8453, the expected signer, live balance,
gas price, L1 data-fee upper bound, simulated gas, bytecode, owner, token owner, URI, and token count.
It signs once and only republishes identical raw transaction bytes during transient RPC failures.
Because this capability is publisher-only, it deliberately has no PPE charge; charging the
publisher's own Apify account would be cost rather than customer revenue.

#### `status`

Read-only GitHub workflow status retrieval by run ID.

### Actor secrets / environment

Required only for GitHub API execution:

- `GITHUB_TOKEN_CAPI2` — stored as an Actor secret/environment value, never accepted through Actor input.
- `ALLOWED_GITHUB_REPOSITORIES` — comma-separated server-side allowlist.
- `ENABLE_MAINNET_BROADCAST` — server-side capability switch; input cannot override it.
- `ALLOWED_MAINNET_APIFY_USER_IDS` — owner IDs permitted to request a mainnet workflow.
- `MAINNET_DEPLOYER_ADDRESS` — public address whose live Base mainnet balance is checked before dispatch.
- `ENABLE_PPE=false` — emergency kill switch; PPE charging is enabled by default after pricing is configured.

The GitHub token should have the minimum repository permissions necessary to read Actions and dispatch only the intended workflows.

### Billing

| Service | Event | Price |
|---|---|---:|
| Free validation | none | $0 |
| Base mainnet deploy quote | `mainnet-estimate` | $0.49 |
| Evidence verification | `evidence-result` | $0.19 |
| Allowlisted GitHub security gate | `security-gate` | $2.49 |
| Allowlisted Base Sepolia deployment | `deployment-request` | $4.99 |
| Owner-only Base mainnet broadcast | none | $0 |

The versioned price manifest is `.actor/pricing.json`. Paid output is withheld unless Apify confirms
that exactly one event was charged. Prices are experiments, not guaranteed revenue.

### Integration-ready / Actor-to-Actor

The input accepts an optional `payload` object because Apify Actor-to-Actor integrations pass
the triggering run/build payload to downstream Actors. The payload is correlation context only;
it is never treated as authorization.

### MCP / agents

When published, the Actor can be exposed through Apify's MCP tooling. Agents can call the same
input contract. `agentTask.id` is reused as the request/correlation ID where provided.

### A2A

Apify has native Actor-to-Actor integrations and MCP. A Google Agent2Agent protocol endpoint is
not implemented by this Actor itself. See `a2a/README.md` for the thin-adapter mapping.

### v21 release evidence

The GitHub security gate now prepares coverage, source digests, normalized release evidence, and a
Merkle root across evidence artifacts. The Actor may return the GitHub run status/evidence hash,
but it must not claim that an OCI image or policy is digitally signed until a real signing key and
verification step are configured.

### v24 signed authority integration

Every dispatch now includes an `authority_context_hash` derived from the Actor request. The Base
Sepolia GitHub workflow signs a Message Authority Artifact (MAA) only after Gate B succeeds. Gate C
verifies that signed artifact against a separately trusted public key and checks the exact source SHA,
Actor request ID, and authority-context hash before any simulation or broadcast.

The Actor itself does not receive the private evidence-signing key.

### v26 custody model

GitHub Gate B evidence is retained as an AES-256-GCM encrypted package rather than a plaintext
Actions artifact. Gate C decrypts it only inside the deployment job before offline verification.
Post-deployment evidence and the Gate D release receipt are likewise encrypted for retained
artifact storage.

The Actor never receives evidence private keys, release private keys, or AES evidence keys.

### v27 read-only evidence verification

`action=verify_evidence` lets an agent independently verify a completed Base Sepolia workflow run.

The Actor:

1. reads the GitHub run and artifacts;
2. downloads the encrypted Gate B evidence artifact;
3. decrypts it only in the Actor's ephemeral filesystem;
4. verifies AES-GCM custody, signed schema package, mandate/policy cross-hashes,
   release-evidence hashes, the path-bound Merkle tree, MAA source/context bindings,
   and the admission receipt;
5. optionally verifies encrypted Gate C post-deploy evidence and the Gate D release receipt.

The verification action has no signing key and no blockchain key. It cannot create authority,
dispatch a deployment, mint, or produce a release signature.

Server-side secrets required for full verification:

- `GITHUB_TOKEN_CAPI2`
- `CAPI2_EVIDENCE_AES_KEY_B64`
- `CAPI2_EVIDENCE_SIGNING_PUBLIC_KEY_B64`
- `CAPI2_RELEASE_SIGNING_PUBLIC_KEY_B64`

These are never accepted from Actor input.

# Actor input Schema

## `product` (type: `string`):

The custom Base quote costs $0.49 and returns one result. The preflight is free and validates only the request format.

## `deployerAddress` (type: `string`):

Used only as the sender for read-only Base simulation. Replace the example with your wallet address. Never enter a private key.

## `contractCreationCode` (type: `string`):

Compiled init code including encoded constructor arguments. Maximum 49,152 bytes. The short prefilled sample deploys empty runtime code; replace it for a quote on your own contract.

## `mintRecipient` (type: `string`):

Only for the CAPI2 proof NFT quote. Enter the public Base address that would receive token 1.

## `tokenUri` (type: `string`):

Only for the CAPI2 proof NFT quote. Must begin with ipfs:// and be at most 512 UTF-8 bytes.

## `action` (type: `string`):

API-only action override for allowlisted owner workflows.

## `execute` (type: `boolean`):

The public product selection executes one quote. API callers can use an explicit advanced action with execute=false for a dry run.

## `repository` (type: `string`):

owner/repository. GitHub actions are restricted by the Actor's server-side allowlist.

## `ref` (type: `string`):

Reviewed branch, tag, or SHA.

## `approval` (type: `string`):

Exact approval string required for Base Sepolia or Base mainnet deployment execution.

## `performTestMint` (type: `boolean`):

Required for owner-authorized Base Sepolia execution.

## `performInitialMint` (type: `boolean`):

Required for owner-authorized Base mainnet execution.

## `maxTotalGasWei` (type: `string`):

Owner-only transaction fee ceiling for Base mainnet deployment. Accepted range: 14000000000000–20000000000000 wei.

## `workflowRunId` (type: `integer`):

Required for status and verify\_evidence actions.

## `waitForCompletion` (type: `boolean`):

Wait until the dispatched or idempotently reused GitHub workflow completes.

## `maxWaitSeconds` (type: `integer`):

Maximum number of seconds to wait for a dispatched GitHub workflow.

## `payload` (type: `object`):

Optional integration context; never trusted as authorization.

## `agentTask` (type: `object`):

Optional A2A/MCP correlation metadata such as task id and requesting agent.

## `evidenceArtifactName` (type: `string`):

Optional exact Gate B artifact name. Defaults to capi2-authority-<workflowRunId>.

## `verifyPostDeploy` (type: `boolean`):

Opt in only for deployment runs with encrypted Gate C evidence and a Gate D release receipt.

## `expectedRequestId` (type: `string`):

Optional request ID to bind verification to the originating Actor/A2A request.

## `expectedAuthorityContextHash` (type: `string`):

Optional SHA-256 of the originating Actor authority context.

## Actor input object example

```json
{
  "product": "base_deploy_quote",
  "deployerAddress": "0x1111111111111111111111111111111111111111",
  "contractCreationCode": "0x60006000f3",
  "mintRecipient": "0x1111111111111111111111111111111111111111",
  "tokenUri": "ipfs://your-metadata-cid",
  "repository": "vandurmedries/apify-opportunity-engine",
  "ref": "bounty-ready",
  "approval": "NO",
  "performTestMint": true,
  "performInitialMint": false,
  "waitForCompletion": true,
  "maxWaitSeconds": 600,
  "verifyPostDeploy": false
}
```

# Actor output Schema

## `results` (type: `string`):

Structured policy, workflow, deployment, and evidence records.

## `output` (type: `string`):

The final structured Actor response stored under the OUTPUT key.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "deployerAddress": "0x1111111111111111111111111111111111111111",
    "contractCreationCode": "0x60006000f3"
};

// Run the Actor and wait for it to finish
const run = await client.actor("capi2/capi2-secure-deploy").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "deployerAddress": "0x1111111111111111111111111111111111111111",
    "contractCreationCode": "0x60006000f3",
}

# Run the Actor and wait for it to finish
run = client.actor("capi2/capi2-secure-deploy").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "deployerAddress": "0x1111111111111111111111111111111111111111",
  "contractCreationCode": "0x60006000f3"
}' |
apify call capi2/capi2-secure-deploy --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,capi2/capi2-secure-deploy"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/SocyDxkH2XgeXUQec/builds/JfRliQxgpH165GgKN/openapi.json