{"name":"com.nittim/nittim","slug":"nittim","title":"nittim","description":"Production-safety audits for AI-generated code, with a fix for every finding.","url":"https://mcp.market/server/nittim","rating":null,"grade":"B","score":76,"certified":false,"status":"active","category":"other","tags":[],"presence":{"score":23,"stars":0,"forks":0,"downloads_week":null,"last_push_at":"2026-09-09T10:54:43.000Z","license":"MIT"},"uptime":{"percent":100,"checks":6,"ok":6,"last_checked_at":"2026-09-20T20:36:23.712Z","last_ok_at":"2026-09-20T20:36:23.712Z","latency_ms":402},"claimed":false,"transport":"remote","callable_via_gateway":true,"default_price_micros":0,"repository":"https://github.com/ilanwolberger/nittim-mcp","website":"https://nittim.com","version":"1.1.0","remotes":[{"type":"streamable-http","url":"https://nittim.com/api/mcp"}],"packages":[],"tools":[{"name":"audit_repo","description":"Paid nittim AI audit of a GitHub repository: one structured pass over the highest-signal source; the only tool here that returns scores and a verdict. Answers with the audit's id, not the report. `fullScan: true` buys the wider Full Audit tier. NEEDS A KEY: mint one at https://nittim.com/keys. COSTS MONEY in three calls: the first quotes a price and charges nothing; a second with `confirmedCost` set to that exact price returns a one-time link for the ACCOUNT OWNER to confirm — their yes, not the assistant's; a plain third call with the same arguments runs once at that price. A moved price is re-quoted, never charged.DELIVERED AS A BATCH: the report lands Usually within 15 minutes*. * Most reports land within 15 minutes. Worst case, 24 hours. ","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"repoUrl":{"type":"string","minLength":1,"description":"GitHub repository URL or owner/repo. A private repo needs a githubToken."},"githubToken":{"description":"Optional read-only GitHub token. Without one, only public repos are reachable.","type":"string"},"confirmedCost":{"description":"COST CONFIRMATION. Omit on the first call; then send back the exact quoted `cost`.","type":"object","properties":{"kind":{"type":"string","description":"The `kind` from the quoted cost, e.g. 'credits'."},"credits":{"type":"number","description":"The `credits` number from the quoted cost."},"centicredits":{"description":"The `centicredits` integer from the quoted cost, if it carried one.","type":"number"}},"required":["kind","credits"]},"authorization":{"description":"HUMAN CONFIRMATION. The `authorization` id from the confirm-link answer, once the account owner has pressed Confirm. Single-use, short TTL.","type":"string"},"fullScan":{"description":"True buys the wider Full Audit tier: every eligible source file, priced by pass count.","type":"boolean"},"payInstead":{"description":"True pays credits now instead of queuing for the daily free-audit budget to reopen, skipping the covered (Audit) entitlement even when it would otherwise be free.","type":"boolean"},"deployedUrl":{"description":"Optional URL of this repository's live deployment, for an origin the account owner actually operates. When set, the audit adds one bounded, READ-ONLY fetch pass against it and reports drift between the deployed artifact and the audited commit. Redirects are never followed; private addresses are refused.","type":"string"}},"required":["repoUrl"],"$schema":"http://json-schema.org/draft-07/schema#"}},{"name":"audit_source","description":"Paid nittim AI audit of source files you post, for a project with no GitHub remote. Send SOURCE files, not build output — no node_modules or dist. On nittim's own key this answers with the audit's id; the report lands Usually within 15 minutes*. * Most reports land within 15 minutes. Worst case, 24 hours. On your own key (BYOK Pro) the report comes back in this call instead. Costs 5.14 credits (a paid+subscribed org's included allowance, an unspent Audit, then prepaid credits), always saved as a PRIVATE report. `fullScan: true` buys the wider Full Audit tier. NEEDS A KEY: mint one at https://nittim.com/keys. COSTS MONEY in three calls: the first quotes a price and charges nothing; a second with `confirmedCost` set to that exact price returns a one-time link for the ACCOUNT OWNER to confirm — their yes, not the assistant's; a plain third call with the same arguments runs once at that price. A moved price is re-quoted, never charged.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":200,"description":"A display label for this project, e.g. 'my-abacus-app'. Sanitized before use."},"files":{"minItems":1,"maxItems":1000,"type":"array","items":{"type":"object","properties":{"path":{"type":"string","minLength":1,"description":"Relative path, e.g. 'src/index.ts'. No absolute paths, no '..', no backslashes."},"content":{"type":"string","description":"The file's full text."},"encoding":{"description":"Omit or 'utf8' for text files. Any other value (e.g. 'base64') is rejected — text only in v1.","type":"string"}},"required":["path","content"]},"description":"Source files as { path, content }[] — not build output. At most 1000; over the internal per-audit cap, the highest-priority ones win."},"uploadGrant":{"description":"Optional: the id of an upload approval the account owner already confirmed. A large post without one is answered with a confirmation covering the files and the price.","type":"string"},"confirmedCost":{"description":"COST CONFIRMATION. Omit on the first call; then send back the exact quoted `cost`.","type":"object","properties":{"kind":{"type":"string","description":"The `kind` from the quoted cost, e.g. 'credits'."},"credits":{"type":"number","description":"The `credits` number from the quoted cost."},"centicredits":{"description":"The `centicredits` integer from the quoted cost, if it carried one.","type":"number"}},"required":["kind","credits"]},"authorization":{"description":"HUMAN CONFIRMATION. The `authorization` id from the confirm-link answer, once the account owner has pressed Confirm. Single-use, short TTL.","type":"string"},"fullScan":{"description":"True buys the wider Full Audit tier over the files you post, priced by pass count.","type":"boolean"}},"required":["name","files"],"$schema":"http://json-schema.org/draft-07/schema#"}},{"name":"describe_protocol","description":"How this server works, in full: how a paid call quotes and charges, the two audit tiers, the Nittim Loop and its reward rules and caps, and dispute guidance. Free, no key, no charge, no side effects — it reads static text and calls no model. `section` picks one page; omitted, it returns all of them.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"section":{"description":"Which page: money, tiers, loop, disputes, or all (the default).","type":"string","enum":["money","tiers","loop","disputes","all"]}},"$schema":"http://json-schema.org/draft-07/schema#"}},{"name":"dispute_finding","description":"NEEDS A KEY: mint one at https://nittim.com/keys. Records that a finding from a prior audit is wrong (stance:'dispute') or genuinely real (stance:'confirm'), backed by evidence from the repo. Free. A SIGNAL for owner triage — it never changes the audit's scores, verdict or stored report on its own. The finding is identified by its findingKey (from the digest), or by its exact dimension and title.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"auditId":{"type":"string","format":"uuid","pattern":"^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$","description":"The audit UUID, from its report link."},"findingKey":{"description":"The finding's stable key from the digest, if you have it (preferred over dimension+title).","type":"string"},"dimension":{"description":"The finding's dimension, e.g. 'security' — required if findingKey is omitted.","type":"string"},"title":{"description":"The finding's exact title — required if findingKey is omitted.","type":"string"},"stance":{"type":"string","enum":["dispute","confirm"],"description":"'dispute' = this finding is wrong. 'confirm' = this finding is genuinely real."},"evidence":{"type":"object","properties":{"file":{"type":"string","minLength":1,"description":"The file path your evidence points to."},"lines":{"description":"Line range, e.g. '42-58'.","type":"string"},"snippet":{"description":"A short excerpt of the actual code supporting your stance.","type":"string"},"explanation":{"type":"string","minLength":1,"description":"Why this finding is wrong or confirmed real, in your own words."}},"required":["file","explanation"],"description":"What you can see in the repo that supports your stance."}},"required":["auditId","stance","evidence"],"$schema":"http://json-schema.org/draft-07/schema#"}},{"name":"estimate_audit","description":"Price an audit before buying one: give a GitHub repository URL, or a manifest of paths and byte sizes — no file content, nothing uploaded — and get the tier (Audit or Full Audit), the pass count and the exact price. No account or key is needed: it never charges, runs no audit, calls no model and stores nothing. Signed in it also returns your credit balance and whether an unspent Audit covers the run; a guest quote omits both. `fullScan: true` prices Full Audit.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"repoUrl":{"description":"GitHub repository URL or owner/repo. Mutually exclusive with `files` — send one.","type":"string","minLength":1},"githubToken":{"description":"Optional GitHub personal access token (read-only) for a private repo.","type":"string"},"files":{"description":"A manifest of paths and sizes only, in place of `repoUrl` — the same set you would post. Over the cap the answer names it and how to trim. Send one or the other.","minItems":1,"type":"array","items":{"type":"object","properties":{"path":{"type":"string","minLength":1,"description":"Relative path, e.g. 'src/index.ts'."},"bytes":{"type":"integer","minimum":0,"maximum":9007199254740991,"description":"The file's byte size. This shape has no `content` — nothing is uploaded."}},"required":["path","bytes"]}},"fullScan":{"description":"Price Full Audit (every eligible file, or a refusal with the reason when the selection is too large) instead of the default Audit.","type":"boolean"}},"$schema":"http://json-schema.org/draft-07/schema#"}},{"name":"get_audit","description":"Retrieve a nittim audit by its UUID, at any stage: the finished markdown digest (verdict, scores, top findings) plus its report link, or — no error, nothing charged — that it is still running, or why it failed and what happened to the charge. Free. Reading needs the key of the account that owns the audit.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"id":{"type":"string","format":"uuid","pattern":"^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$","description":"The UUID of the saved audit, from the /report/{id} URL."}},"required":["id"],"$schema":"http://json-schema.org/draft-07/schema#"}},{"name":"get_loop","description":"Returns the current text of nittim's free, tool-agnostic self-review checklist — the same content served at https://nittim.com/selfcheck.md. Reviews a codebase against the public shape of nittim's 13-category Priority Framework, plus a 14th on what the code gives away, and states the procedure for running it as a loop. No arguments. No key, no account and no charge — nothing here is sent anywhere.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{},"$schema":"http://json-schema.org/draft-07/schema#"}},{"name":"judge_output","description":"Run a cross-vendor judge model over any text you post: code, a document, another model's output, anything. Returns findings + rationale ONLY — never a score, never a pass/fail verdict. Costs 5.03 credits. The judge always comes from a different vendor family than whatever produced the content, and the answer says which one ran. `modelUnderTest` names that family. NEEDS A KEY: mint one at https://nittim.com/keys. COSTS MONEY in three calls: the first quotes a price and charges nothing; a second with `confirmedCost` set to that exact price returns a one-time link for the ACCOUNT OWNER to confirm — their yes, not the assistant's; a plain third call with the same arguments runs once at that price. A moved price is re-quoted, never charged.","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{"content":{"type":"string","minLength":1,"maxLength":100000,"description":"The text to judge — code, a document, another model's output. Up to ~100KB."},"criteria":{"description":"Optional — what to judge it against, e.g. 'correctness and security'.","type":"string"},"context":{"description":"Optional — background the judge should know, e.g. what this content is for.","type":"string"},"modelUnderTest":{"description":"Optional — which vendor family produced `content`, if it is itself a model's output. The judge that runs is always a different family than this names. Use 'unspecified' for anything that is not model output, or when the family is unknown.","type":"string","enum":["anthropic","openai","unspecified"]},"confirmedCost":{"description":"COST CONFIRMATION. Omit on the first call; then send back the exact quoted `cost`.","type":"object","properties":{"kind":{"type":"string","description":"The `kind` from the quoted cost, e.g. 'credits'."},"credits":{"type":"number","description":"The `credits` number from the quoted cost."},"centicredits":{"description":"The `centicredits` integer from the quoted cost, if it carried one.","type":"number"}},"required":["kind","credits"]},"authorization":{"description":"HUMAN CONFIRMATION. The `authorization` id from the confirm-link answer, once the account owner has pressed Confirm. Single-use, short TTL.","type":"string"}},"required":["content"],"$schema":"http://json-schema.org/draft-07/schema#"}},{"name":"list_modules","description":"List every audit module nittim can run: the two deterministic scanners (secret scan + OSV dependency CVE check) and the LLM-reasoned checks. Returns each module's key, tier, and a plain-English description of what it checks. Each module's key identifies it for running individually.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{},"$schema":"http://json-schema.org/draft-07/schema#"}},{"name":"mint_key","description":"For a client that cannot sign in over OAuth: a short, one-time link to https://nittim.com/keys/claim/<token>. Opening it, signed in, mints a real nittim API key and shows it once — the key itself is NEVER returned by this tool or by any other MCP result. The link expires in a few minutes and works exactly once. Free.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"keyName":{"description":"Optional display name for the key that will be minted, e.g. 'my-cursor-key'. Defaults to 'API key'.","type":"string","maxLength":80}},"$schema":"http://json-schema.org/draft-07/schema#"}},{"name":"preview_upload","description":"NEEDS A KEY: mint one at https://nittim.com/keys. Send the paths and sizes of the files you would post — no content leaves your machine to ask this — and get back the list, the byte count, and a link for the account owner to approve it. Free. The approval covers that file list and no other, and a paid audit's own confirmation already covers the file list beside the price, so approving ahead of time is optional.","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":200,"description":"A display label for this project, e.g. 'my-abacus-app'. Sanitized before use."},"files":{"minItems":1,"maxItems":1000,"type":"array","items":{"type":"object","properties":{"path":{"type":"string","minLength":1,"description":"Relative path, e.g. 'src/index.ts'."},"bytes":{"type":"integer","minimum":0,"maximum":9007199254740991,"description":"The file's size in bytes. No content."}},"required":["path","bytes"]},"description":"Paths and sizes only — the same set you would post. Never file content."}},"required":["name","files"],"$schema":"http://json-schema.org/draft-07/schema#"}},{"name":"report_loop","description":"NEEDS A KEY: mint one at https://nittim.com/keys. Records anonymised counts from a Nittim Loop the developer has finished and agreed to send: pass numbers, a findings-by-category tally, a fixed count, and whether each pass was clean. Counts only — never a title, file path or snippet. Nothing is charged, and an eligible report can earn a credit reward (rules and caps: see describe_protocol). Reporting the same repo again updates the existing record; the reply says which happened. Results appear at https://nittim.com/loop.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"repo_hash":{"type":"string","pattern":"^[0-9a-f]{64}$","description":"sha256 of the repository's canonical identity (the lowercased 'owner/repo', or a stable local fingerprint) — never the repo name itself. nittim never sees the name."},"client_name":{"description":"Your own name — omit to read it from the MCP connection instead.","type":"string","maxLength":64},"client_version":{"description":"Your own version string, if you have one.","type":"string","maxLength":64},"repo_size_bucket":{"type":"string","enum":["xs","s","m","l","xl"],"description":"A rough size bucket for the repo you looped over."},"convergence":{"description":"Optional: 'converged' (two consecutive clean passes) or 'cap_reached' (stopped for any other reason). Omit if unsure — the read from `passes` is derived either way.","type":"string","enum":["converged","cap_reached"]},"swept":{"description":"Optional: was the CLASS swept — a guard, lint rule or exhaustiveness check that makes a new instance loud — rather than only the instances a pass named? Never derived, never changes the reward. On a repeat report, omitting it keeps the last answer; `false` withdraws it.","type":"boolean"},"mode":{"description":"Optional: 'one_shot' (every lens sweeps the whole tree first, then one fix wave, then a short convergence loop) or 'serial' (one lens or area per pass, fixing between passes).","type":"string","enum":["one_shot","serial"]},"first_wave_lenses":{"description":"Optional, with mode 'one_shot' only: how many lenses ran in parallel on pass 1.","type":"integer","exclusiveMinimum":0,"maximum":100},"passes":{"minItems":1,"maxItems":100,"type":"array","items":{"type":"object","properties":{"n":{"type":"integer","exclusiveMinimum":0,"maximum":9007199254740991,"description":"This pass's number, starting at 1."},"findings":{"maxItems":13,"type":"array","items":{"type":"object","properties":{"category":{"type":"string","enum":["security","privacy","reliability","code_quality","ai_risk","performance","devops","data","business","devex","accessibility","observability","maintainability"]},"critical":{"default":0,"type":"integer","minimum":0,"maximum":9007199254740991},"high":{"default":0,"type":"integer","minimum":0,"maximum":9007199254740991},"medium":{"default":0,"type":"integer","minimum":0,"maximum":9007199254740991},"low":{"default":0,"type":"integer","minimum":0,"maximum":9007199254740991}},"required":["category"],"additionalProperties":false},"description":"Findings this pass named — one entry per category with something to report; omit a category that found nothing. Each count defaults to 0 when omitted."},"fixed":{"type":"integer","minimum":0,"maximum":9007199254740991,"description":"How many findings this pass fixed."},"clean":{"type":"boolean","description":"True iff this pass found nothing new."}},"required":["n","fixed","clean"],"additionalProperties":false},"description":"One entry per pass you actually ran, in order."}},"required":["repo_hash","repo_size_bucket","passes"],"$schema":"http://json-schema.org/draft-07/schema#"}},{"name":"run_module","description":"Run ONE nittim audit module against a GitHub repository, never producing scores or a verdict. The two deterministic modules (secret-scan, dependency-cve) return scanner evidence directly, free, with nothing to confirm. Deep-tier modules make one focused model call, cost 5.03 credits each and follow the protocol below. NEEDS A KEY: mint one at https://nittim.com/keys. COSTS MONEY in three calls: the first quotes a price and charges nothing; a second with `confirmedCost` set to that exact price returns a one-time link for the ACCOUNT OWNER to confirm — their yes, not the assistant's; a plain third call with the same arguments runs once at that price. A moved price is re-quoted, never charged.","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{"repoUrl":{"type":"string","minLength":1,"description":"GitHub repository URL or owner/repo. A private repo needs a githubToken."},"moduleKey":{"type":"string","minLength":1,"description":"The module's key, e.g. 'secret-scan', 'dependency-cve', 'security', 'privacy', 'gdpr'."},"githubToken":{"description":"Optional read-only GitHub token. Without one, only public repos are reachable.","type":"string"},"confirmedCost":{"description":"COST CONFIRMATION. Omit on the first call; then send back the exact quoted `cost`.","type":"object","properties":{"kind":{"type":"string","description":"The `kind` from the quoted cost, e.g. 'credits'."},"credits":{"type":"number","description":"The `credits` number from the quoted cost."},"centicredits":{"description":"The `centicredits` integer from the quoted cost, if it carried one.","type":"number"}},"required":["kind","credits"]},"authorization":{"description":"HUMAN CONFIRMATION. The `authorization` id from the confirm-link answer, once the account owner has pressed Confirm. Single-use, short TTL.","type":"string"}},"required":["repoUrl","moduleKey"],"$schema":"http://json-schema.org/draft-07/schema#"}},{"name":"scan_source","description":"Free nittim look: committed secrets and known CVEs over posted source files. No account, no key, no nittim credits. Hard evidence only: never scores, never a production verdict. Send SOURCE files, not build output (no node_modules, no dist, no binaries).","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":200,"description":"A display label for this project, e.g. 'my-abacus-app'. Sanitized before use."},"files":{"minItems":1,"maxItems":1000,"type":"array","items":{"type":"object","properties":{"path":{"type":"string","minLength":1,"description":"Relative path, e.g. 'src/index.ts'. No absolute paths, no '..', no backslashes."},"content":{"type":"string","description":"The file's full text."},"encoding":{"description":"Omit or 'utf8' for text files. Any other value (e.g. 'base64') is rejected — text only in v1.","type":"string"}},"required":["path","content"]},"description":"Source files as { path, content }[] — not build output. At most 1000; over the internal per-audit cap, the highest-priority ones win."},"uploadGrant":{"description":"Optional: the id of an upload approval the account owner already confirmed. A large post without one is answered with a confirmation covering the files and the price.","type":"string"}},"required":["name","files"],"$schema":"http://json-schema.org/draft-07/schema#"}},{"name":"verify_fix","description":"NEEDS A KEY: mint one at https://nittim.com/keys. Re-checks ONE finding from a finished audit against the repository's current code, or a commit named in the call, and answers fixed, still present, or undetermined — with the reason. It reads only the file that finding cites. Free, capped per day, and it moves no score or verdict: the report keeps recording what was true of the commit it ran on.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"auditId":{"type":"string","format":"uuid","pattern":"^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$","description":"The audit UUID, from its report link."},"findingKey":{"type":"string","minLength":1,"description":"The finding's stable key, as printed beside it in the report's findings list."},"ref":{"description":"A commit SHA or branch to check instead of the repository's current HEAD. Must be the audited commit or newer.","type":"string"}},"required":["auditId","findingKey"],"$schema":"http://json-schema.org/draft-07/schema#"}}],"scan":{"score":76,"grade":"B","scanned_at":"2026-09-20T00:25:00.091Z","report":{"scannerVersion":"0.1.9","scannedAt":"2026-09-20T00:25:00.077Z","components":{"code":{"score":-1,"max":25,"notes":["remote-only server, no package to scan"]},"reliability":{"score":17,"max":20,"notes":["remote reachable in 2231ms"]},"poisoning":{"score":15,"max":15,"notes":["15 tool descriptions checked"]},"auth":{"score":3,"max":15,"notes":["open endpoint exposes 3 write-action tools with no auth"]},"maintenance":{"score":15,"max":15,"notes":["last push 11 days ago"]},"identity":{"score":7,"max":10,"notes":["namespace and repository owner differ","GitHub account older than a year","website matches verified namespace"]}},"findings":[{"id":"auth.open-write","severity":"high","component":"auth","title":"Write-action tools reachable without authentication"}],"inputs":{"probes":[{"url":"https://nittim.com/api/mcp","reachable":true,"authRequired":false,"latencyMs":2231,"serverInfo":{"name":"nittim","version":"0.2.0+93bf872"}}],"packages":[],"repo":{"found":true,"owner":"ilanwolberger","repo":"nittim-mcp","archived":false,"pushedAt":"2026-09-09T10:54:43Z","stars":0,"forks":0,"openIssues":0,"ownerType":"User","ownerAvatarUrl":"https://avatars.githubusercontent.com/u/72649841?v=4","ownerCreatedAt":"2020-10-10T09:16:18Z","license":"MIT"},"icon":{"url":"https://nittim.com/icon.svg?icon.28bzgpf_70mrf.svg","source":"site"},"presence":{"stars":0,"forks":0,"downloadsWeek":null,"license":"MIT","lastPushAt":"2026-09-09T10:54:43.000Z","score":23}}}},"grade_history":[],"reviews":[]}