# Pre-flight check

The pre-flight check reads the files of your repository before a deploy and says whether Astris can run it. Your coding agent calls the MCP tool `preflight`. With the CLI, run:

```
astris preflight [dir]
```

## The verdicts

The answer has one verdict and one row for each check:

```
{"verdict":"pass"|"fixable"|"refuse","checks":[{"name":"<check id>","result":"pass"|"fixable"|"refuse"|"did not run","reason":"<text>"}]}
```

- `pass`: no check found a problem.
- `fixable`: a check found something to change before the deploy. The `reason` says what to change.
- `refuse`: a check found something Astris will not deploy. Fix it before you deploy.

A check that did not run does not count toward the verdict. The CLI prints `Verdict: <verdict>` and one line for each check. It exits 0 on `pass` or `fixable` and 1 on `refuse`.

The checks are, in order: `Secrets`, `Binds`, `Runtime`, `Lockfile`, `Start`, `Environment variables` and `Standalone`.

## Refused: a secret key in your files

```
Found a <rule> in <path>; Found a <rule> in <path>. Revoke it in the service that issued it, remove it from your files and your git history, and set the new key as an environment variable.
```

`<rule>` names the kind of key it found, for example a `Supabase service_role key` or a `private key`. Revoke the key in the service that issued it, remove it from your files and your git history, and set the new key as an environment variable on the app.

## Refused: a backend locked to its builder

```
builder-locked backend (<marker>); it has no export path
```

The app uses a backend that runs only inside the tool that built it, so it cannot move to Astris as it is. Replace that backend, for example with a [database](/docs/databases) on Astris, then check again.

## Fixable results

Each fixable row says what to change in its `reason`, for example:

- `package.json binds localhost; change the host to 0.0.0.0`
- `package.json pins a port; read PORT`
- `no lockfile`
- `package.json has no production start; add a start script that reads PORT and binds 0.0.0.0`

Make the change, then run the check again.

## Limits

The check reads at most 64 files. A file can be 32 KiB, a lockfile at the root 320 KiB, and the whole request 512 KiB. A request over these limits is refused with [bad_request](/docs/errors/bad_request).