PreFlight runs the buyer journey, then tells you what happened.
A service can respond and still be impossible to buy. PreFlight walks the whole path a paying customer walks, and seals every step as evidence.
- 01
Declare
You confirm a release manifest: the endpoint, interface, payment terms, and the request and response contracts you intend to publish.
- 02
Discover
PreFlight observes the live transport, resolves the MCP contract, and reads the x402 challenge from the running service.
- 03
Reconcile
It compares the observed surface against your declaration, one criterion at a time, and records where they agree or diverge.
- 04
Authorize
Acting as a buyer, PreFlight authorizes a real x402 payment for the declared price to the declared payee.
- 05
Settle
The payment settles on X Layer. PreFlight verifies the settlement rather than trusting a claim.
- 06
Deliver
After paying, PreFlight takes delivery and inspects the returned result against your response contract.
- 07
Replay guard
It confirms a duplicate payment replay is rejected, so a buyer cannot be double charged.
- 08
Seal
Every criterion, its evidence, provenance, and a snapshot hash are sealed into a report.
- 09
Decide
PreFlight returns RELEASE, BLOCK, or UNKNOWN, with the consequence and the exact fix for anything that failed.
What PreFlight proves
- That the live x402 challenge parses and matches your declared price, asset, network, and payee
- That a real payment settles on chain to the address you declared
- That delivery arrives and matches your declared response contract
- That a duplicate payment replay is rejected
What it does not prove
- Private or authenticated behavior it cannot observe as a public buyer
- Correctness beyond the criteria you declared
- Security of your service, or approval by any marketplace
- Behavior of a different build than the one live at the snapshot time
Wallet and signing
PreFlight uses its own buyer wallet to pay the check fee and any target spend. Your agent signs its own payments. No private key you hold ever reaches PreFlight.
Private by default
Reports open only with their capability link. The token travels in the URL fragment and is never sent to a server, log, or analytics. There is no public index of reports.
Retention
Reports are retained for 30 days, then removed. The canonical manifest and the report are stored; no wallet key or raw secret is. Download the report JSON for a durable copy.
Failure taxonomy
Every criterion resolves to one of four states.
Declared and observed agree.
They disagree. This blocks the release, and the report shows both values and the fix.
The value could not be observed without guessing, so it is reported as unknown.
The criterion does not apply to this manifest.