ProfitCollector

ca.bakhourPublished by bakhour.caOfficial publisherv1.0.0Updated Oct 24, 2026

22 pay-per-call developer, security, network and data utilities using x402 on Base.

VerifiedStreamable HTTPWeb executableDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Lets an assistant run DNS, TLS, domain and repository security checks plus small developer utilities like JSON and hashing.

What you can do
Offers around thirty small tools: DNS lookups, TLS certificate and HTTP security header checks, domain due diligence, Git repository risk reports with dependency vulnerabilities and exposed-credential scans, and an x402 endpoint trust check. It also covers general utilities such as JSON repair, validation and formatting, Base64, SHA-256/512 hashing, UUIDs, subnet calculation and text statistics, plus Quebec invoice GST/QST calculation and compliance checks.
When to use it
Use it for quick, one-off developer or security checks, such as auditing an unfamiliar domain's DNS, mail security and TLS setup, or vetting an x402 endpoint before paying it. It also suits small format chores like JSON, Base64, hashing and text cleanup.
Requirements
Remote endpoint; nothing to install locally. Some tools need network access to query public domains, websites or Git repositories. No authentication, environment variables or headers are declared.
Before you install
The description says it uses pay-per-call x402 on Base, so usage may involve payment. Repository risk reports scan for exposed credentials but state that matched values are never returned. Domain and URL lookups are sent to third-party services. The Quebec invoice tools are arithmetic and text checks, not legal or tax advice.

Installation

In SourceWeft

  1. Open ProfitCollector in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/ca.bakhour%2Fprofitcollector/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "profitcollector": {
      "type": "http",
      "url": "https://mcp.bakhour.ca/mcp"
    }
  }
}

Tools

31

get_dns_lookup

Resolve ONE DNS record type for a domain. For all record types at once use /domain/intelligence; for a bundled DNS+TLS+headers audit use /web/audit or /security/posture; for mail-security plus a scored verdict use /domain/due-diligence.

Parametersdomainrequiredrecord_type

get_jwt_decode

Decode a JWT payload without signature verification.

Parameterstokenrequired

get_subnet_calculate

Calculate subnet information from CIDR notation.

Parameterscidrrequired

post_json_repair

Repair common malformed JSON formatting issues.

Parameterstextrequired

post_media_image_convert

Convert an image between common formats (e.g. PNG/JPEG/WebP) from a URL or base64 payload.

Takes no parameters.

post_security_repo_risk_report_standard

SBOM inventory plus real OSV.dev dependency-vulnerability matches and dependency-freshness signals for a public Git repository. One-shot alternative to a per-seat secret-scanning subscription.

Parametersrefrepo_urlrequired

post_security_repo_risk_report_deep

Everything in the standard report, plus a repo-wide secret/credential exposure scan (matched values are never returned).

Parametersrefrepo_urlrequired

post_security_repo_risk_report_due_diligence

Everything in the deep report, plus real OpenSSF Scorecard maintainer/governance signals and a prioritized recommendation. An automated baseline positioned against $5,000-$95,000 human technical due diligence.

Parametersrefrepo_urlrequired

post_x402_service_trust_report

Live, on-demand check of ONE x402-protected endpoint before you pay it: payment-requirements structure, TLS certificate, payTo on-chain balance, known-asset recognition, resource/host consistency, and discovery-manifest cross-check -- not a cached aggregate reputation score.

Parameterstarget_urlrequiredtarget_method

post_freshdep_scan

Flags pinned dependencies in a repository's requirements.txt, package-lock.json, or uv.lock published more recently than a freshness threshold -- a supply-chain-compromise tripwire. Free CLI (requirements.txt/package-lock.json only, uv.lock support pending there): github.com/sbakhour/freshdep.

Parametersrefrepo_urlrequiredthreshold_days

post_quebec_invoice_compliance_check

Verifies GST/QST were calculated correctly per Revenu Quebec's current (non-compounded) formula, and flags whether a French invoice version is present per Charter of the French Language s.57/89/91. Pure arithmetic + text check; not legal or tax advice.

Parameterssubtotalrequiredgst_amountrequiredqst_amountrequiredfrench_textenglish_text

post_quebec_invoice_generate

Assembles a bilingual (French/English) Quebec invoice document with GST/QST computed exactly per Revenu Quebec's current formula -- you supply both languages' line-item text, this does not translate. Not legal or tax advice.

Parametersline_itemsrequiredseller_namerequiredinvoice_numberrequiredseller_gst_numberseller_qst_number

post_json_validate

Validate JSON text and return parsing details.

Parameterstextrequired

post_json_pretty

Pretty-print valid JSON text.

Parameterstextrequired

post_json_minify

Minify valid JSON text.

Parameterstextrequired

post_base64_encode

Encode UTF-8 text using Base64.

Parameterstextrequired

post_base64_decode

Decode Base64 to UTF-8 text.

Parameterstextrequired

post_hash_sha256

Generate SHA-256 digest from text.

Parameterstextrequired

post_hash_sha512

Generate SHA-512 digest from text.

Parameterstextrequired

get_uuid_generate

Generate a random UUID version 4.

Parameterscount

get_url_parse

Parse a URL into structured components.

Parametersurlrequired

post_text_stats

Calculate character, word, line and byte statistics.

Parameterstextrequired

post_text_dedupe_lines

Remove duplicate lines while preserving original order.

Parameterstextrequired

get_timestamp_convert

Convert a Unix timestamp to UTC ISO-8601.

Parameterstimestamprequired

post_domain_due_diligence

The most comprehensive domain assessment: DNS + mail security (SPF/DKIM/DMARC) + TLS + HTTP headers, scored. The only endpoint in this group that adds mail-security analysis. Use for a one-shot decision-grade verdict on an unfamiliar domain; use /dns/lookup, /ssl/check, /security/headers, /web/audit or /security/posture instead for a single fact or a cheaper signal.

Parametersdomainrequired

get_domain_intelligence

Collect ALL common DNS record types (A/AAAA/MX/NS/TXT/CAA) for a domain in one call -- the multi-record bundle version of /dns/lookup.

Parametersdomainrequired

get_web_audit

Consolidated DNS, TLS and HTTP security audit for a public HTTPS website, returned as RAW findings (no score) -- the bundled version of /dns/lookup + /ssl/check + /security/headers. Use /security/posture instead for a 0-100 score/grade.

Parametersurlrequired

get_security_posture

Assess TLS and HTTP security posture for a public HTTPS website -- the SAME inspection as /web/audit, but returns a 0-100 score/grade and findings instead of raw fields.

Parametersurlrequired

post_data_transform

Normalize and transform common structured text automatically.

Parameterstextrequiredoperation

get_security_headers

Inspect HTTP security headers for ONE URL only. For headers combined with TLS and DNS, use /web/audit (raw) or /security/posture (scored).

Parametersurlrequired

get_ssl_check

Inspect the TLS certificate for ONE hostname only. For TLS combined with HTTP headers and DNS, use /web/audit (raw) or /security/posture (scored).

Parametershostnamerequired

Version history

1
  1. v1.0.0LatestSep 16, 2026

Score

72% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts

    Publish an icon in the registry entry.

  • Documentation15 pts

    Declare a GitHub repository with a README, or serve resource_documentation in the OAuth protected-resource metadata.

  • LicenseNot applicable

    A hosted service is used under its provider's terms, so no license is expected here. This check is left out of the percentage.