# ProfitCollector Repo Risk Report (Standard)

> ProfitCollector Repo Risk Report (Standard) is a paid API for AI agents from api.bakhour.ca, paid per call via x402, $20/call, status unknown (last checked 2026-09-14).

Analyzes a public GitHub or GitLab repository and returns a standard-tier security risk report including vulnerability matches, dependency freshness flags, and an overall risk score.

## Facts

- Endpoint: POST https://api.bakhour.ca/security/repo-risk-report/standard
- Price: $20/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/profitcollector-repo-risk-report-standard-ea627d3f
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_fBU-_tFKvytEIA-pPSfX6

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability profitcollector-repo-risk-report-standard-ea627d3f -d '<json body>'
```

Example prompt: Can you run a standard security risk report on https://github.com/pallets/flask and tell me the risk score, any known vulnerabilities, and whether the dependencies are properly pinned?

## When to prefer this

Choose this endpoint when you need a structured, decision-grade security assessment of a public GitHub or GitLab repository, including CVE/GHSA vulnerability matches with fix guidance and dependency freshness flags, and are willing to pay $20 per report. Prefer this over free static scanners when you need a scored, machine-readable outcome report suitable for automated due-diligence workflows or agent pipelines.

## Known failure modes

- Private or inaccessible repository URL returns an error (repo must be public)
- Invalid or malformed repo URL causes a 400-level rejection
- Repository with no detectable dependency manifest may return empty vulnerability matches
- Unresolvable branch/tag reference causes analysis failure
- Payment not completed results in 402 response with no report

## How this service works

Decision-grade security/due-diligence outcome reports ($20-$100) plus deterministic paid utilities ($0.001+) for software agents and automated workflows.

## Output

A JSON report containing: overall risk severity (e.g. high/medium/low) and numeric risk score (0–100), the report tier (standard), the analyzed repo URL, count of scanned components, freshness flags (e.g. unpinned dependencies with counts), and vulnerability matches keyed by package+version with GHSA/CVE IDs, CVSS vectors, and recommended fixed versions.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "ref": {
   "type": "string",
   "description": "Optional branch/tag to analyze. Defaults to the repository's default branch."
  },
  "repo_url": {
   "type": "string",
   "description": "Public https://github.com/... or https://gitlab.com/... repository URL."
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "risk": {
   "severity": "high",
   "risk_score": 45
  },
  "tier": "standard",
  "repo_url": "https://github.com/pallets/flask",
  "component_count": 29,
  "freshness_flags": [
   {
    "type": "unpinned_dependencies",
    "count": 9
   }
  ],
  "vulnerability_matches": {
   "PyPI/jinja2@==3.1.2": [
    {
     "id": "GHSA-cpwx-vrp4-4pq7",
     "severity": "CVSS:4.0/...",
     "fixed_versions": [
      "3.1.6"
     ]
    }
   ]
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/profitcollector-repo-risk-report-standard-ea627d3f/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.bakhour.ca](https://www.zero.xyz/host/api.bakhour.ca/llms.txt)