Preflight

Call before installing packages suggested by a language model. Returns, for each npm or PyPI package name, whether it actually exists in the registry, whether it is deprecated or yanked, and — when the name is not found — the closest real package names. Catches hallucinated dependencies (slopsquatting) before an agent installs them. Never inspects package contents and never returns a safety verdic

Call before publishing a claim that cites EU law. Checks that the cited instrument exists in our pinned corpus, that the cited article exists within it, and whether your quoted text actually appears in that article. Covers the AI Act, GDPR, NIS2, DORA and the Cyber Resilience Act. Returns the official article text with a EUR-Lex link. Citation verification only: it never gives legal advice or clas

Call before signing an Ethereum or Base transaction or calldata. Decodes raw transaction bytes or contract calldata against standard interfaces (ERC-20, ERC-721, ERC-1155, WETH, EIP-2612 Permit and Permit2) in memory. Returns the decoded method signature, typed parameters, value in wei and standard specification links. Mechanical byte decoding only: never simulates state or advises whether to sign

Call before acting on CVE identifiers produced by a model. Returns whether each CVE record exists and its state (published or rejected), with severity and the official CVE record link. Catches fabricated advisory references. Does not tell you whether to patch.