# Preflight Stack Dependency Preflight API

> Preflight Stack Dependency Preflight API is a paid API for AI agents from api.preflightstack.com, paid per call via x402, $0.02/call, status unknown (last checked 2026-09-15).

Screens up to 10 npm or PyPI package versions against security, lifecycle, license, and release-age policies to return a deterministic allow/review/block decision before installation.

## Facts

- Endpoint: POST https://api.preflightstack.com/v1/dependency-preflight
- Price: $0.02/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/preflight-stack-dependency-preflight-api-11f52487
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_OPjMLuRFLRWletETNOZid

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability preflight-stack-dependency-preflight-api-11f52487 -d '<json body>'
```

Example prompt: Before I install these packages, screen them for me: check numpy 1.24.0 and requests 2.28.1 on PyPI — tell me if they're safe to install, flagging any known vulnerabilities, license issues, or suspicious install scripts.

## When to prefer this

Choose this endpoint when you need a fast, policy-driven, deterministic allow/review/block verdict on specific npm or PyPI package versions before installation — especially in automated CI/CD pipelines or agentic workflows where you need structured evidence (CVEs, license, lifecycle, install scripts) rather than raw advisory data. Prefer it over generic vulnerability databases when you want a single actionable decision rather than raw advisory lists, and when you need to screen up to 10 packages in one call with a clear policy-based outcome.

## Known failure modes

- Unsupported ecosystem or package format returns validation error
- Package version not found in registry returns not-found error
- More than 10 packages submitted in a single call returns payload-too-large error
- Network timeout if upstream registry is unavailable
- Payment not included or insufficient USDC returns 402 Payment Required

## How this service works

Evaluate up to 10 exact npm or PyPI package versions in one $0.02 paid batch immediately before installation or an exact-version change. Returns deterministic allow, review, or block guidance with known-vulnerability, lifecycle, declared-license, release-age, and npm install-lifecycle evidence. Reuse a current result for unchanged inputs instead of purchasing a duplicate check for an installation retry.

## Output

Returns a per-package deterministic decision of 'allow', 'review', or 'block' under the current policy, along with supporting evidence including known CVEs, lifecycle status (e.g. deprecated, unmaintained), declared SPDX license, release age in days, and whether npm install-lifecycle scripts (preinstall/postinstall) are present.

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/preflight-stack-dependency-preflight-api-11f52487/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.preflightstack.com](https://www.zero.xyz/host/api.preflightstack.com/llms.txt)