# ProfitCollector Repo Risk Report – Deep Tier

> ProfitCollector Repo Risk Report – Deep Tier is a paid API for AI agents from api.bakhour.ca, paid per call via x402, $50/call, status unknown (last checked 2026-09-14).

Performs a deep security scan of a public GitHub or GitLab repository, returning a scored risk report with secret findings and vulnerability matches.

## Facts

- Endpoint: POST https://api.bakhour.ca/security/repo-risk-report/deep
- Price: $50/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/profitcollector-repo-risk-report-deep-tier-e1374bf5
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_MQwI4gIfDxyJoJ4ZPPo5G

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability profitcollector-repo-risk-report-deep-tier-e1374bf5 -d '<json body>'
```

Example prompt: Run a deep security scan on https://github.com/pallets/flask — I need the full risk score, any exposed secrets like API keys, and a vulnerability breakdown so I can decide whether to depend on it.

## When to prefer this

Choose this deep-tier endpoint when you need a comprehensive, decision-grade security report — not just a surface check — on a public GitHub or GitLab repository. It is ideal for supply chain due diligence, vendor onboarding, or pre-merge audits where secret detection and vulnerability matching at depth are required and the $50 cost per call is justified by the stakes of the decision.

## Known failure modes

- Private or inaccessible repository URL returns an error — only public GitHub/GitLab repos are supported
- Invalid or malformed repo URL causes a 400-class validation error
- Non-existent branch or tag specified in 'ref' field triggers a ref-not-found error
- Payment failure or insufficient funds (x402) prevents the scan from being initiated
- Large repositories may time out or return partial results
- Rate limiting on the upstream SCM API may cause transient failures

## How this service works

Decision-grade security/due-diligence outcome reports ($20-$100) plus deterministic paid utilities ($0.001+) for software agents and automated workflows.

## Output

A JSON report containing a risk severity level (e.g. high/medium/low), a numeric risk score (0–100), the analysis tier ('deep'), the repository URL, a count of analyzed components, an array of secret findings with file path, line number, and pattern name, and a map of vulnerability matches.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "ref": {
   "type": "string",
   "description": "Optional branch/tag to analyze. Defaults to the repository's default branch."
  },
  "repo_url": {
   "type": "string",
   "description": "Public https://github.com/... or https://gitlab.com/... repository URL."
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "risk": {
   "severity": "high",
   "risk_score": 38
  },
  "tier": "deep",
  "repo_url": "https://github.com/pallets/flask",
  "component_count": 29,
  "secret_findings": [
   {
    "file": "config.py",
    "line": 12,
    "pattern": "aws_access_key_id"
   }
  ],
  "vulnerability_matches": {}
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/profitcollector-repo-risk-report-deep-tier-e1374bf5/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.bakhour.ca](https://www.zero.xyz/host/api.bakhour.ca/llms.txt)