Agent Dev Preflight API
Use the API from any HTTP client that supports x402 v2 exact EVM payments on Base Mainnet. Free discovery endpoints require no wallet or API key.
Payment flow
1. POST normally
Send the JSON request to a paid endpoint. Exact installed versions are required.
2. Handle HTTP 402
Read the x402 v2 PAYMENT-REQUIRED challenge. Production payments use Base Mainnet native USDC.
3. Authorize and retry
Your x402 client signs the bounded payment authorization and retries with PAYMENT-SIGNATURE. A successful settlement returns HTTP 200 plus the API result.
Example request
POST https://agent-dev-preflight-api.bonkoturyu.workers.dev/v1/package/risk
content-type: application/json
{
"package": {
"ecosystem": "npm",
"name": "express",
"version": "4.18.2"
}
}
Batch request
POST https://agent-dev-preflight-api.bonkoturyu.workers.dev/v1/dependencies/preflight
content-type: application/json
{
"packages": [
{"ecosystem":"npm","name":"express","version":"4.18.2"},
{"ecosystem":"PyPI","name":"requests","version":"2.32.0"}
]
}
Batch endpoints accept 1–20 exact package versions. Version ranges such as ^4.18.2 are rejected.
Endpoints and prices
| Endpoint | Price / request | Purpose |
|---|---|---|
POST /v1/package/risk |
0.03 USDC | Deterministic package risk preflight for AI coding agents using OSV and npm/PyPI registry metadata. |
POST /v1/dependencies/vulnerabilities |
0.05 USDC | Batch OSV vulnerability lookup for exact installed npm/PyPI dependency versions before code changes or releases. |
POST /v1/dependencies/preflight |
0.10 USDC | Full dependency security preflight for AI coding agents: vulnerabilities, upgrade gap, license metadata, provenance and risk. |
POST /v1/package/provenance |
0.03 USDC | Software supply-chain package provenance, registry and integrity metadata for autonomous developer workflows. |
POST /v1/dependencies/licenses |
0.03 USDC | Batch npm/PyPI license metadata triage for autonomous dependency review workflows. |
POST /v1/package/upgrade |
0.03 USDC | Dependency upgrade-gap check comparing an exact installed package version with the registry latest version. |
Machine-readable discovery
GET https://agent-dev-preflight-api.bonkoturyu.workers.dev/v1/catalog GET https://agent-dev-preflight-api.bonkoturyu.workers.dev/v1/discovery-manifest GET https://agent-dev-preflight-api.bonkoturyu.workers.dev/llms.txt GET https://agent-dev-preflight-api.bonkoturyu.workers.dev/health
The service returns structured source URLs with successful responses and uses public npm, PyPI, OSV and SPDX data. Risk and license outputs are triage metadata, not a substitute for security or legal review.