Preflight Checks

Cheap, deterministic checks an agent runs before the irreversible step.

Before an agent installs a package, signs a transaction, or publishes a claim that cites EU law, it can ask one question: is this real, and what exactly is it? Preflight answers with facts and an official link — never with a verdict.

---

Checks

Endpoint	Price	Call it before…
POST /v1/deps/check	$0.05	installing packages a model suggested, to catch names it invented
POST /v1/btc/tx-inspect	$0.10	signing or broadcasting a Bitcoin transaction
POST /v1/btc/tx-context	$0.10	needing chain context for a Bitcoin transaction's inputs before signing
POST /v1/legal/cite-check	$0.10	publishing a claim that cites EU law
POST /v1/cve/check	$0.05	acting on a CVE identifier produced by a model
POST /v1/ai-act/obligations	$0.10	you need the AI Act articles that mention an obligation for a role

Free routes: GET /v1/coverage (this catalogue) and GET /v1/<endpoint>/schema (JSON Schema of each input).

---

How it works

This Actor runs in Standby mode: it is a plain HTTP server, always warm. You call an endpoint and get the result in the response body — there is no dataset or key-value store to read afterwards.

Authenticate with your Apify token, as with any Standby Actor:

curl -X POST "https://josedrobles--preflight-checks.apify.actor/v1/deps/check" \
  -H "Authorization: Bearer $APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"ecosystem":"npm","packages":["left-pad"]}'

---

Endpoints

POST /v1/deps/check — $0.05

Call before installing packages suggested by a language model. Returns, for each npm or PyPI package name, whether it actually exists in the registry, whether it is deprecated or yanked, and — when the name is not found — the closest real package names. Catches hallucinated dependencies (slopsquatting) before an agent installs them. Never inspects package contents and never returns a safety verdict.

curl -X POST "https://josedrobles--preflight-checks.apify.actor/v1/deps/check" \
  -H "Authorization: Bearer $APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"ecosystem":"npm","packages":["left-pad"]}'

Returns:

{
  "ecosystem": "npm",
  "checked_at": "2026-09-02T21:40:00Z",
  "results": [
    {
      "name": "jscodeshift-react",
      "exists": false,
      "verdict": "not_found",
      "official_url": "https://www.npmjs.com/package/jscodeshift-react"
    }
  ]
}

POST /v1/btc/tx-inspect — $0.10

Call before signing or broadcasting a Bitcoin transaction. Decodes a raw transaction hex or a PSBT and returns inputs, outputs, script types, addresses, vsize, fee rate when derivable, and objective signals such as RBF, dust outputs, non-standard sighash flags and unsigned inputs. Parses only the bytes you send: no network access. Describes the transaction; never advises whether to sign it.

curl -X POST "https://josedrobles--preflight-checks.apify.actor/v1/btc/tx-inspect" \
  -H "Authorization: Bearer $APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"raw":"0100000001c997a5e56e104102fa209c6a852dd90660a20b2d9c352423edce25857fcd3704000000004847304402204e45e16932b8af514961a1d3a1a25fdf3f4f7732e9d624c6c61548ab5fb8cd410220181522ec8eca07de4860a4acdd12909d831cc56cbbac4622082221a8768d1d0901ffffffff0200ca9a3b00000000434104ae1a62fe09c5f51b13905f07f06b99a2f7159b2225f374cd378d71302fa28414e7aab37397f554a7df5f142c21c1b7303b8a0626f1baded5c72a704f7e6cd84cac00286bee0000000043410411db93e1dcdb8a016b49840f8c53bc1eb68a382e97b1482ecad7b148a6909a5cb2e0eaddfb84ccf9744464f82e160bfa9b8b64f9d4c03f999b8643f656b412a3ac00000000"}'

Returns:

{
  "kind": "psbt",
  "txid": "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
  "version": 2,
  "locktime": 0,
  "vsize": 141,
  "weight": 561,
  "fee_sats": 1410,
  "fee_rate_sat_vb": 10,
  "inputs": [
    {
      "prev_txid": "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
      "prev_vout": 1,
      "sequence": 4294967293,
      "script_sig": "",
      "witness": [],
      "witness_utxo_value_sats": 50000,
      "address": "bc1qw508d6qejxtdg4y5r3zarvary0c5xw7kv8f3t4",
      "partial_sigs": 0,
      "has_final_script": false
    }
  ],
  "outputs": [
    {
      "value_sats": 12000,
      "script_pubkey": "0014751e76e8199196d454941c45d1b3a323f1433bd6",
      "script_type": "p2wpkh",
      "address": "bc1qw508d6qejxtdg4y5r3zarvary0c5xw7kv8f3t4"
    },
    {
      "value_sats": 330,
      "script_pubkey": "5120cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
      "script_type": "p2tr"
    }
  ],
  "signals": [
    "rbf_enabled",
    "dust_output",
    "unsigned_inputs"
  ],
  "thresholds": {
    "dust_output_sat": 546,
    "high_fee_rate_sat_vb": 100
  }
}

POST /v1/btc/tx-context — $0.10

Call before signing a Bitcoin transaction when you need chain context for its inputs: whether each prevout exists, whether it is already spent, its value in sats and its confirmations. Resolves up to 10 inputs against a public explorer at about one request per second, so a full batch can take over 20 seconds; figures reflect chain state at checked_at. Describes on-chain facts with source links; never advises whether to sign.

curl -X POST "https://josedrobles--preflight-checks.apify.actor/v1/btc/tx-context" \
  -H "Authorization: Bearer $APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"inputs":[{"txid":"4a5e1e4baab89f3a32518a88c31bc87f618f76673e2cc77ab2127b7afdeda33b","vout":0}]}'

Returns:

{
  "network": "mainnet",
  "checked_at": "2026-09-11T12:00:00Z",
  "source": "blockstream.info",
  "inputs": [
    {
      "txid": "4a5e1e4baab89f3a32518a88c31bc87f618f76673e2cc77ab2127b7afdeda33b",
      "vout": 0,
      "exists": true,
      "spent": false,
      "value_sats": 5000000000,
      "script_pubkey": "4104678afdb0fe5548271967f1a67130b7105cd6a828e03909a67962e0ea1f61deb649f6bc3f4cef38c4f35504e51ec112de5c384df7ba0b8d578a4c702b6bf11d5fac",
      "confirmations": 912345,
      "official_url": "https://blockstream.info/tx/4a5e1e4baab89f3a32518a88c31bc87f618f76673e2cc77ab2127b7afdeda33b?output:0"
    }
  ],
  "total_input_sats": 5000000000,
  "disclaimer": "Chain state at checked_at, from a third-party explorer. Not a recommendation to sign."
}

POST /v1/legal/cite-check — $0.10

Call before publishing a claim that cites EU law. Checks that the cited instrument exists in our pinned corpus, that the cited article exists within it, and whether your quoted text actually appears in that article. Covers the AI Act, GDPR, NIS2, DORA and the Cyber Resilience Act. Returns the official article text with a EUR-Lex link. Citation verification only: it never gives legal advice or classifies systems.

curl -X POST "https://josedrobles--preflight-checks.apify.actor/v1/legal/cite-check" \
  -H "Authorization: Bearer $APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"instrument":"CELEX:32024R1689","article":"Article 11"}'

Returns:

{
  "instrument_exists": true,
  "article_exists": true,
  "quote_match": "not_found",
  "official_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689",
  "corpus_version": "eurlex-2026-09-05",
  "attribution": "© European Union, https://eur-lex.europa.eu, CC BY 4.0",
  "disclaimer": "Citation verification, not legal advice."
}

POST /v1/cve/check — $0.05

Call before acting on CVE identifiers produced by a model. Returns whether each CVE record exists and its state (published or rejected), with severity and the official CVE record link. Catches fabricated advisory references. Does not tell you whether to patch.

curl -X POST "https://josedrobles--preflight-checks.apify.actor/v1/cve/check" \
  -H "Authorization: Bearer $APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"ids":["CVE-2021-44228"]}'

Returns:

{
  "checked_at": "2026-09-02T21:40:00Z",
  "results": [
    {
      "id": "CVE-2026-12345",
      "exists": true,
      "state": "published",
      "cvss_v3": 7.5,
      "official_url": "https://www.cve.org/CVERecord?id=CVE-2026-12345"
    }
  ]
}

POST /v1/ai-act/obligations — $0.10

Call when you need to know which articles of the EU AI Act mention a given obligation for a given role (provider, deployer, importer, distributor, authorised representative). Returns the matching articles with headings, excerpts and EUR-Lex links from a pinned corpus version. Retrieval over the official text: it does not classify your system or assess compliance.

curl -X POST "https://josedrobles--preflight-checks.apify.actor/v1/ai-act/obligations" \
  -H "Authorization: Bearer $APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"role":"provider","topic":"technical_documentation"}'

Returns:

{
  "corpus_version": "eurlex-2026-07-01",
  "articles": [
    {
      "article": "Article 11",
      "heading": "Technical documentation"
    }
  ],
  "disclaimer": "Retrieval over the official text, not legal advice."
}

---

Billing

One event is charged only when a check succeeds (HTTP 200). A malformed body (400), an input that cannot be processed (422), a body over the limit (413) or an unreachable upstream registry (502) are not charged.

---

What this Actor does not do

• No verdicts. It never answers safe, eligible or compliant, and never tells you whether to install, sign, patch or publish. It reports what the registry or the official text says, with a link, and you decide.
• No legal advice. The EU-law checks verify citations and retrieve article text. They do not classify your system or assess compliance.
• No language model in the critical path. Every check is deterministic: parsing, a public-registry lookup, or a search over a pinned corpus.
• No stored input. Request bodies are not persisted; logs keep a hash.

---

Sources

Source	Licence / policy
npm registry	API publica sin clave; no se redistribuye corpus
PyPI JSON API	API publica documentada
blockstream.info API	blockstream.com/terms v1.0 (2018): no prohibe uso comercial, sin clave ni atribucion; Esplora MIT
mempool.space API	Sin ToS restrictivo; software AGPL-3.0; no prohibe uso comercial ni exige clave
EUR-Lex textos consolidados	CC BY 4.0 (Decision 2011/833/UE) - reutilizacion comercial expresa
CVE Services API (cve.org)	Dominio público

EU legal texts are reproduced from EUR-Lex unmodified except for splitting by article, under CC BY 4.0 (Decision 2011/833/EU). Every response that quotes them carries the attribution © European Union, https://eur-lex.europa.eu, CC BY 4.0 and the pinned corpus_version.

/v1/btc/tx-inspect parse only the bytes you send: no network call to any node or explorer.

/v1/btc/tx-context do query public block explorers (blockstream.info API and mempool.space API) to resolve on-chain state, so their answers reflect what those explorers reported at checked_at.