Preflight
The call before you install, connect or pay
Preflight is one free HTTP read that answers go, caution, no or unknown for a GitHub repository, an npm package, an https endpoint or an ERC-8004 agent — and returns every reading it decided on, the field each came from, and the date that field was written.
A verdict is a description of evidence
A Preflight verdict names what was checked and when, from Sato Hub's own records and probes. It is not a security review, a quality judgment, or a statement about returns. Unknown means we hold no record — not that anything is wrong.
Try it
This form calls the same endpoint an agent calls, and prints what came back — nothing is added or softened in between.
The four verdicts
The listing is active, scores in the High Sato Score tier, and carries at least one earned check: a reproduced install, a fresh successful daily probe, or 95%+ observed success over at least 14 days of our checks.
Not a security review, and not a statement that it will work for you.
Something resolved or answered, but it did not clear the go bar — the default once we hold a record at all.
Not an accusation. Most of the index sits here, because most projects have not been independently checked.
A retired listing, a probed endpoint that did not answer, an ERC-8004 id that is not registered, or an observed record that is mostly failure attributed to the host over at least the minimum window.
Not a fraud finding and not a security judgment. It names one reading that failed, on a date.
Nothing resolved and nothing was probed. Sato Hub holds no record of this target.
Not a warning. Absence of a record is absence of a record.
Four lanes, and what each can honestly say
- repo?repo=coinbase/agentkit
- Exact match against the directory's own repository field — no fuzzy matching, so a fork never answers for the original. A retired listing answers 410: we knew this and it is gone.
- package?package=solana-agent-kit
- The same exact resolver over the install lanes of every deploy spec, so an npm name maps to the listing that publishes it.
- endpoint?endpoint=https://mcp.example.com/v1
- A listed endpoint resolves to its record. An unlisted one gets one live MCP handshake capped at 8 seconds — a single handshake is not a record, so this lane never returns go.
- agent?agent=base:42
- An ERC-8004 id against the Identity Registry: ownerOf confirms the id exists, the tokenURI document is read, and only a DECLARED MCP service is probed. A2A and x402 declarations are reported as declared and unprobed — we do not call them.
- token?token=0x…&chain=base
- An ERC-20 address on Base, Ethereum or Arbitrum, read keyless from public RPC: bytecode present, the four ERC-20 views, a Clanker v4 deployment record if one exists, Uniswap v3 pools against wrapped native and who holds the LP position. Holder concentration and Uniswap v4 depth are reported as not checked, never guessed. Solana answers unknown.
The token lane reads only what public RPC answers. A pool existing is not depth, a deployer is unknown without an explorer key, and no holder table is scraped — every one of those is written as not checked rather than filled in.
Call it
HTTP
curl -s "https://satohub.ai/api/preflight?repo=coinbase/agentkit"
Exactly one of ?repo=, ?package=, ?endpoint=, ?agent=. Contract: OpenAPI.
MCP
{
"mcpServers": {
"satohub": { "url": "https://satohub.ai/api/mcp" }
}
}The same verdict engine answers in an agent’s tool loop. Full tool list on /mcp.
Questions
What is Preflight?
One HTTP call an agent makes before it installs a tool, connects to an endpoint or pays one. It returns one of four verdicts — go, caution, no, unknown — with every reading it decided on, the field each reading came from, and the date that field was written.
Does a "go" verdict mean something is safe?
No. A verdict names what was checked and when. "go" means the listing is active, scores in the High Sato Score tier, and carries at least one earned check such as an install Sato Hub reproduced in a container. It is not a security review, a code audit, or a statement about returns.
What does "unknown" mean?
That Sato Hub holds no record of that target and nothing was probed. It is an honest absence, not a warning, and it is returned rather than a low-confidence guess.
What can Preflight check?
Five lanes: a GitHub repository, an npm package, an https endpoint, an ERC-8004 agent reference in <chain>:<id> form, and an ERC-20 token address with a chain. Exactly one target per call.
Is Preflight free, and can an agent call it?
Yes to both. GET https://satohub.ai/api/preflight is open, CORS-enabled and documented in the OpenAPI contract, and the same engine answers over MCP so an agent can call it mid-task without leaving its tool loop.
Where do the readings come from?
Sato Hub's own records: the daily liveness refresh, the Sato Score, the reproduced-install flag, the observed record of our daily checks, and the daily live probe — plus, for the endpoint and agent lanes, one live check run at request time. The verdict engine itself is pure, so the HTTP lane and the MCP lane cannot disagree.
Preflight reports readings Sato Hub holds or took. It is not a security audit, a code review or financial advice. Related: Sato Score · Reliability · Sato Route