# ProfitCollector Repo Risk Due Diligence Report

> ProfitCollector Repo Risk Due Diligence Report is a paid API for AI agents from api.bakhour.ca, paid per call via x402, $100/call, status unknown (last checked 2026-09-14).

Generates a comprehensive security and due-diligence report for a public GitHub or GitLab repository, including vulnerability findings, secret scanning, OpenSSF scorecard, and an overall recommendation.

## Facts

- Endpoint: POST https://api.bakhour.ca/security/repo-risk-report/due-diligence
- Price: $100/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/profitcollector-repo-risk-due-diligence-report-91340a2a
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_MGZ_MJJJ_biRiMcMR4uss

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability profitcollector-repo-risk-due-diligence-report-91340a2a -d '<json body>'
```

Example prompt: Can you run a full due diligence security report on https://github.com/pallets/flask — I need to know the risk score, any vulnerabilities, whether secrets were leaked, and whether I should proceed with using it?

## When to prefer this

Choose this endpoint when you need a comprehensive, decision-grade security report on a public repository — not just raw CVE data but a synthesized recommendation with secret scanning, OpenSSF scorecard, and prioritized findings. It is especially valuable for automated procurement, dependency onboarding pipelines, or vendor due diligence workflows where a single authoritative report per repo justifies the $100 cost. Prefer it over lighter-weight scanners when the output needs to be actionable for a go/no-go decision.

## Known failure modes

- Invalid or private repository URL returns an error — only public GitHub/GitLab repos are supported
- Inaccessible branch or tag reference causes analysis failure — defaults to the repo's default branch if omitted
- Payment not completed (HTTP 402) — the $100 USDC payment must be settled via x402 before results are returned
- Rate limits or upstream GitHub/GitLab API issues may cause timeouts or partial results
- Newly created or empty repositories may yield incomplete component counts or scorecard scores

## How this service works

Decision-grade security/due-diligence outcome reports ($20-$100) plus deterministic paid utilities ($0.001+) for software agents and automated workflows.

## Output

A JSON report containing: a risk object with severity level and numeric risk score (0–100), a tier label ('due_diligence'), the analyzed repo URL, a component count, a list of secret findings, an OpenSSF scorecard with overall score and per-check highlights, a due_diligence_summary with categorized findings (each with detail, category, and priority), an overall recommendation (e.g. 'proceed_with_caution'), and a vulnerability matches map.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "ref": {
   "type": "string",
   "description": "Optional branch/tag to analyze. Defaults to the repository's default branch."
  },
  "repo_url": {
   "type": "string",
   "description": "Public https://github.com/... or https://gitlab.com/... repository URL."
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "risk": {
   "severity": "high",
   "risk_score": 45
  },
  "tier": "due_diligence",
  "repo_url": "https://github.com/pallets/flask",
  "component_count": 29,
  "secret_findings": [],
  "openssf_scorecard": {
   "overall_score": 7.1,
   "highlighted_checks": {
    "Maintained": {
     "score": 10
    }
   }
  },
  "due_diligence_summary": {
   "findings": [
    {
     "detail": "...",
     "category": "vulnerabilities",
     "priority": "high"
    }
   ],
   "overall_recommendation": "proceed_with_caution"
  },
  "vulnerability_matches": {}
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/profitcollector-repo-risk-due-diligence-report-91340a2a/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.bakhour.ca](https://www.zero.xyz/host/api.bakhour.ca/llms.txt)