ProfitCollector

by bakhour.ca · remote · no sign-in to list tools · v1.0.0 · published by ca.bakhour

22 pay-per-call developer, security, network and data utilities using x402 on Base.

Deletes · 1Changes · 21

Compare Registry entry

31 tools: 1 can delete or cancel things, 21 change things and 9 only read.

Scanned Oct 21, 2026

Deletes or cancels1Claude Code: deny: see these tools
Can't be undone0Claude Code: ask
Changes things21Claude Code: ask: see these tools
Only reads9Claude Code: allow: see these tools

1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http profitcollector https://mcp.bakhour.ca/mcp

Findings

Matches of fixed checks, with the text they matched.

1 info

Infopost_security_repo_risk_report_deep
The description mentions "credential".
Matched text
description: "...tandard report, plus a repo-wide secret/credential exposure scan (matched values are never..."
What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

31 tools

Deletes or cancels 1Removes, cancels or revokes something.Claude Code: deny

post_text_dedupe_linesRemove duplicate lines while preserving original order.No findings
Why it is in this group
- The name "post_text_dedupe_lines" says "post": a word for a change.
- The description's first verb is "remove": a word for removing or ending something.
Description, as the server wrote it
Remove duplicate lines while preserving original order.

Changes things 21Creates or changes something that can be changed back.Claude Code: ask

get_timestamp_convertConvert a Unix timestamp to UTC ISO-8601.No findings
Why it is in this group
- The name "get_timestamp_convert" says "get": a word for reading.
- The description's first verb is "convert": a word for a change.
Description, as the server wrote it
Convert a Unix timestamp to UTC ISO-8601.
get_uuid_generateGenerate a random UUID version 4.No findings
Why it is in this group
- The name "get_uuid_generate" says "get": a word for reading.
- The description's first verb is "generate": a word for a change.
Description, as the server wrote it
Generate a random UUID version 4.
post_base64_decodeDecode Base64 to UTF-8 text.No findings
Why it is in this group
- The name "post_base64_decode" says "post": a word for a change.
Description, as the server wrote it
Decode Base64 to UTF-8 text.
post_base64_encodeEncode UTF-8 text using Base64.No findings
Why it is in this group
- The name "post_base64_encode" says "post": a word for a change.
Description, as the server wrote it
Encode UTF-8 text using Base64.
post_data_transformNormalize and transform common structured text automatically.No findings
Why it is in this group
- The name "post_data_transform" says "post": a word for a change.
Description, as the server wrote it
Normalize and transform common structured text automatically.
post_domain_due_diligenceThe most comprehensive domain assessment: DNS + mail security (SPF/DKIM/DMARC) + TLS + HTTP headers, scored.No findings
Why it is in this group
- The name "post_domain_due_diligence" says "post": a word for a change.
Description, as the server wrote it
The most comprehensive domain assessment: DNS + mail security (SPF/DKIM/DMARC) + TLS + HTTP headers, scored. The only endpoint in this group that adds mail-security analysis. Use for a one-shot decision-grade verdict on an unfamiliar domain; use /dns/lookup, /ssl/check, /security/headers, /web/audit or /security/posture instead for a single fact or a cheaper signal.
post_freshdep_scanFlags pinned dependencies in a repository's requirements.txt, package-lock.json, or uv.lock published more recently than a freshness threshold -- a supply-chain-compromise tripwire…No findings
Why it is in this group
- The name "post_freshdep_scan" says "post": a word for a change.
Description, as the server wrote it
Flags pinned dependencies in a repository's requirements.txt, package-lock.json, or uv.lock published more recently than a freshness threshold -- a supply-chain-compromise tripwire. Free CLI (requirements.txt/package-lock.json only, uv.lock support pending there): github.com/sbakhour/freshdep.
post_hash_sha256Generate SHA-256 digest from text.No findings
Why it is in this group
- The name "post_hash_sha256" says "post": a word for a change.
Description, as the server wrote it
Generate SHA-256 digest from text.
post_hash_sha512Generate SHA-512 digest from text.No findings
Why it is in this group
- The name "post_hash_sha512" says "post": a word for a change.
Description, as the server wrote it
Generate SHA-512 digest from text.
post_json_minifyMinify valid JSON text.No findings
Why it is in this group
- The name "post_json_minify" says "post": a word for a change.
Description, as the server wrote it
Minify valid JSON text.
post_json_prettyPretty-print valid JSON text.No findings
Why it is in this group
- The name "post_json_pretty" says "post": a word for a change.
Description, as the server wrote it
Pretty-print valid JSON text.
post_json_repairRepair common malformed JSON formatting issues.No findings
Why it is in this group
- The name "post_json_repair" says "post": a word for a change.
Description, as the server wrote it
Repair common malformed JSON formatting issues.
post_json_validateValidate JSON text and return parsing details.No findings
Why it is in this group
- The name "post_json_validate" says "post": a word for a change.
Description, as the server wrote it
Validate JSON text and return parsing details.
post_media_image_convertConvert an image between common formats (e.g.No findings
Why it is in this group
- The name "post_media_image_convert" says "post": a word for a change.
Description, as the server wrote it
Convert an image between common formats (e.g. PNG/JPEG/WebP) from a URL or base64 payload.
post_quebec_invoice_compliance_checkVerifies GST/QST were calculated correctly per Revenu Quebec's current (non-compounded) formula, and flags whether a French invoice version is present per Charter of the French Lan…No findings
Why it is in this group
- The name "post_quebec_invoice_compliance_check" says "post": a word for a change.
Description, as the server wrote it
Verifies GST/QST were calculated correctly per Revenu Quebec's current (non-compounded) formula, and flags whether a French invoice version is present per Charter of the French Language s.57/89/91. Pure arithmetic + text check; not legal or tax advice.
post_quebec_invoice_generateAssembles a bilingual (French/English) Quebec invoice document with GST/QST computed exactly per Revenu Quebec's current formula -- you supply both languages' line-item text, this …No findings
Why it is in this group
- The name "post_quebec_invoice_generate" says "post": a word for a change.
Description, as the server wrote it
Assembles a bilingual (French/English) Quebec invoice document with GST/QST computed exactly per Revenu Quebec's current formula -- you supply both languages' line-item text, this does not translate. Not legal or tax advice.
post_security_repo_risk_report_deepEverything in the standard report, plus a repo-wide secret/credential exposure scan (matched values are never returned).1 finding
Why it is in this group
- The name "post_security_repo_risk_report_deep" says "post": a word for a change.
Findings
- Info
  The description mentions "credential".
  Matched text
  description: "...tandard report, plus a repo-wide secret/credential exposure scan (matched values are never..."
  What this check looks for
Description, as the server wrote it
Everything in the standard report, plus a repo-wide secret/credential exposure scan (matched values are never returned).
post_security_repo_risk_report_due_diligenceEverything in the deep report, plus real OpenSSF Scorecard maintainer/governance signals and a prioritized recommendation.No findings
Why it is in this group
- The name "post_security_repo_risk_report_due_diligence" says "post": a word for a change.
Description, as the server wrote it
Everything in the deep report, plus real OpenSSF Scorecard maintainer/governance signals and a prioritized recommendation. An automated baseline positioned against $5,000-$95,000 human technical due diligence.
post_security_repo_risk_report_standardSBOM inventory plus real OSV.dev dependency-vulnerability matches and dependency-freshness signals for a public Git repository.No findings
Why it is in this group
- The name "post_security_repo_risk_report_standard" says "post": a word for a change.
Description, as the server wrote it
SBOM inventory plus real OSV.dev dependency-vulnerability matches and dependency-freshness signals for a public Git repository. One-shot alternative to a per-seat secret-scanning subscription.
post_text_statsCalculate character, word, line and byte statistics.No findings
Why it is in this group
- The name "post_text_stats" says "post": a word for a change.
Description, as the server wrote it
Calculate character, word, line and byte statistics.
post_x402_service_trust_reportLive, on-demand check of ONE x402-protected endpoint before you pay it: payment-requirements structure, TLS certificate, payTo on-chain balance, known-asset recognition, resource/h…No findings
Why it is in this group
- The name "post_x402_service_trust_report" says "post": a word for a change.
Description, as the server wrote it
Live, on-demand check of ONE x402-protected endpoint before you pay it: payment-requirements structure, TLS certificate, payTo on-chain balance, known-asset recognition, resource/host consistency, and discovery-manifest cross-check -- not a cached aggregate reputation score.

Only reads 9Looks things up and changes nothing.Claude Code: allow

get_dns_lookupResolve ONE DNS record type for a domain.No findings
Why it is in this group
- The name "get_dns_lookup" says "get": a word for reading.
Description, as the server wrote it
Resolve ONE DNS record type for a domain. For all record types at once use /domain/intelligence; for a bundled DNS+TLS+headers audit use /web/audit or /security/posture; for mail-security plus a scored verdict use /domain/due-diligence.
get_domain_intelligenceCollect ALL common DNS record types (A/AAAA/MX/NS/TXT/CAA) for a domain in one call -- the multi-record bundle version of /dns/lookup.No findings
Why it is in this group
- The name "get_domain_intelligence" says "get": a word for reading.
Description, as the server wrote it
Collect ALL common DNS record types (A/AAAA/MX/NS/TXT/CAA) for a domain in one call -- the multi-record bundle version of /dns/lookup.
get_jwt_decodeDecode a JWT payload without signature verification.No findings
Why it is in this group
- The name "get_jwt_decode" says "get": a word for reading.
Description, as the server wrote it
Decode a JWT payload without signature verification.
get_security_headersInspect HTTP security headers for ONE URL only.No findings
Why it is in this group
- The name "get_security_headers" says "get": a word for reading.
Description, as the server wrote it
Inspect HTTP security headers for ONE URL only. For headers combined with TLS and DNS, use /web/audit (raw) or /security/posture (scored).
get_security_postureAssess TLS and HTTP security posture for a public HTTPS website -- the SAME inspection as /web/audit, but returns a 0-100 score/grade and findings instead of raw fields.No findings
Why it is in this group
- The name "get_security_posture" says "get": a word for reading.
Description, as the server wrote it
Assess TLS and HTTP security posture for a public HTTPS website -- the SAME inspection as /web/audit, but returns a 0-100 score/grade and findings instead of raw fields.
get_ssl_checkInspect the TLS certificate for ONE hostname only.No findings
Why it is in this group
- The name "get_ssl_check" says "get": a word for reading.
Description, as the server wrote it
Inspect the TLS certificate for ONE hostname only. For TLS combined with HTTP headers and DNS, use /web/audit (raw) or /security/posture (scored).
get_subnet_calculateCalculate subnet information from CIDR notation.No findings
Why it is in this group
- The name "get_subnet_calculate" says "get": a word for reading.
Description, as the server wrote it
Calculate subnet information from CIDR notation.
get_url_parseParse a URL into structured components.No findings
Why it is in this group
- The name "get_url_parse" says "get": a word for reading.
Description, as the server wrote it
Parse a URL into structured components.
get_web_auditConsolidated DNS, TLS and HTTP security audit for a public HTTPS website, returned as RAW findings (no score) -- the bundled version of /dns/lookup + /ssl/check + /security/headers…No findings
Why it is in this group
- The name "get_web_audit" says "get": a word for reading.
Description, as the server wrote it
Consolidated DNS, TLS and HTTP security audit for a public HTTPS website, returned as RAW findings (no score) -- the bundled version of /dns/lookup + /ssl/check + /security/headers. Use /security/posture instead for a 0-100 score/grade.

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http profitcollector https://mcp.bakhour.ca/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__profitcollector__get_dns_lookup",
      "mcp__profitcollector__get_jwt_decode",
      "mcp__profitcollector__get_subnet_calculate",
      "mcp__profitcollector__get_url_parse",
      "mcp__profitcollector__get_domain_intelligence",
      "mcp__profitcollector__get_web_audit",
      "mcp__profitcollector__get_security_posture",
      "mcp__profitcollector__get_security_headers",
      "mcp__profitcollector__get_ssl_check"
    ],
    "ask": [
      "mcp__profitcollector__post_json_repair",
      "mcp__profitcollector__post_media_image_convert",
      "mcp__profitcollector__post_security_repo_risk_report_standard",
      "mcp__profitcollector__post_security_repo_risk_report_deep",
      "mcp__profitcollector__post_security_repo_risk_report_due_diligence",
      "mcp__profitcollector__post_x402_service_trust_report",
      "mcp__profitcollector__post_freshdep_scan",
      "mcp__profitcollector__post_quebec_invoice_compliance_check",
      "mcp__profitcollector__post_quebec_invoice_generate",
      "mcp__profitcollector__post_json_validate",
      "mcp__profitcollector__post_json_pretty",
      "mcp__profitcollector__post_json_minify",
      "mcp__profitcollector__post_base64_encode",
      "mcp__profitcollector__post_base64_decode",
      "mcp__profitcollector__post_hash_sha256",
      "mcp__profitcollector__post_hash_sha512",
      "mcp__profitcollector__get_uuid_generate",
      "mcp__profitcollector__post_text_stats",
      "mcp__profitcollector__get_timestamp_convert",
      "mcp__profitcollector__post_domain_due_diligence",
      "mcp__profitcollector__post_data_transform"
    ],
    "deny": [
      "mcp__profitcollector__post_text_dedupe_lines"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as profitcollector. Review it before you use it.

Keep track

Get told when this server's tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/ca.bakhour/profitcollector/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Anlyon alternative

22 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Compare with other servers for the same product.

Source: MCP Registry. Synced Oct 21, 2026, 17:46 UTC.

For agents: Markdown · JSON · report this listing