MCP server (stdio transport) exposing the paid preflight-x402 verification endpoints as agent tools. For Claude Desktop, Cursor, Pi, or any MCP client.

Tools

Tool	Backend	Price
`preflight_check_deps`	`POST /v1/deps/check`	$0.05
`preflight_inspect_btc`	`POST /v1/btc/tx-inspect`	$0.10
`preflight_btc_tx_context`	`POST /v1/btc/tx-context`	$0.10
`preflight_check_legal_citation`	`POST /v1/legal/cite-check`	$0.10
`preflight_check_cve`	`POST /v1/cve/check`	$0.05
`preflight_ai_act_obligations`	`POST /v1/ai-act/obligations`	$0.10
`preflight_inspect_evm`	`POST /v1/evm/tx-inspect`	$0.10
`preflight_check_deps_version`	`POST /v1/deps/version-check`	$0.05

Argument notes:

preflight_check_cve takes cve_id (single) or ids (up to 20). vendor / product / version are accepted alongside an id for context but cannot be resolved on their own — the backend checks CVE identifiers.
preflight_ai_act_obligations takes backend-style role / topic / risk_tier, or the aliases system_type / domain / autonomy_level (e.g. system_type: "developer" → role: "provider").

Payment (dual transport)

One credential, and it is required.

# x402 pay-per-call: EVM key with USDC on Base. The 402 challenge is
# resolved automatically (EIP-712 signature via @x402/fetch + viem).
export PREFLIGHT_BUYER_PRIVATE_KEY=0x...

# Optional: point at a local/dev server (default https://preflight402.com).
export PREFLIGHT_BASE_URL=http://localhost:8787

Without it, tools return a setup message instead of calling the API.

There is no subscription / API-key mode. Earlier versions of this README advertised PREFLIGHT_API_KEY. The backend never implemented it: a request carrying Authorization: Bearer <key> gets the same 402 challenge as one with no credential at all. It was removed rather than left as a promise.

Run

npm run build
node ./bin/preflight-mcp.js          # stdio; wire into your MCP client

Claude Desktop (claude_desktop_config.json):

{ "mcpServers": { "preflight": {
  "command": "node",
  "args": ["/path/to/packages/mcp-server/bin/preflight-mcp.js"],
  "env": { "PREFLIGHT_BUYER_PRIVATE_KEY": "0x..." }
} } }

Registries (Smithery.ai / Glama.ai)

This package ships both registry manifests:

smithery.yaml — stdio start command for Smithery.ai. Config keys: buyerPrivateKey → PREFLIGHT_BUYER_PRIVATE_KEY, baseUrl → PREFLIGHT_BASE_URL (default https://preflight402.com). Launch equivalent: npx -y @joserobles/preflight-mcp.
glama.json — Glama.ai server spec (transport stdio, same env vars and tool list). Any Glama-compatible MCP client can also use this snippet:

{ "mcpServers": { "preflight": {
  "command": "npx",
  "args": ["-y", "@joserobles/preflight-mcp"],
  "env": {
    "PREFLIGHT_BUYER_PRIVATE_KEY": "0x...",
    "PREFLIGHT_BASE_URL": "https://preflight402.com"
  }
} } }

Design notes

Thin paid client only: no dataset, no cache, no LLM, no verdicts. If you empty every credential the tools refuse to call — they never invent answers.
Backend paths mirror src/registry.ts (PATHS in src/client.ts).