MCP.Market

nittim MCP server

online · 100% uptime
by nittim.com·com.nittim/nittim·v1.1.0
No reviews yet

Production-safety audits for AI-generated code, with a fix for every finding.

B81/100grade B
Write a reviewRun it
What users say
No reviews yet
Be the first
Safety scan
B81/100

full report

Adoption
Growing

0 stars

Reviews

Write one

Nobody has reviewed nittim yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

nittim tools (15, 3 write)

write = sends, deletes, buys or posts
  • audit_repoFree

    Paid nittim AI audit of a GitHub repository: one structured pass over the highest-signal source; the only tool here that returns scores and a verdict. Answers with the audit's id, not the report. `fullScan: true` buys the wider Full Audit tier. NEEDS A KEY: mint one at https://nittim.com/keys. COSTS MONEY in three calls: the first quotes a price and charges nothing; a second with `confirmedCost` set to that exact price returns a one-time link for the ACCOUNT OWNER to confirm — their yes, not the assistant's; a plain third call with the same arguments runs once at that price. A moved price is re-quoted, never charged.DELIVERED AS A BATCH: the report lands Usually within 15 minutes*. * Most reports land within 15 minutes. Worst case, 24 hours.

  • audit_sourceFree

    Paid nittim AI audit of source files you post, for a project with no GitHub remote. Send SOURCE files, not build output — no node_modules or dist. On nittim's own key this answers with the audit's id; the report lands Usually within 15 minutes*. * Most reports land within 15 minutes. Worst case, 24 hours. On your own key (BYOK Pro) the report comes back in this call instead. Costs 5.14 credits (a paid+subscribed org's included allowance, an unspent Audit, then prepaid credits), always saved as a PRIVATE report. `fullScan: true` buys the wider Full Audit tier. NEEDS A KEY: mint one at https://nittim.com/keys. COSTS MONEY in three calls: the first quotes a price and charges nothing; a second with `confirmedCost` set to that exact price returns a one-time link for the ACCOUNT OWNER to confirm — their yes, not the assistant's; a plain third call with the same arguments runs once at that price. A moved price is re-quoted, never charged.

  • describe_protocolFree

    How this server works, in full: how a paid call quotes and charges, the two audit tiers, the Nittim Loop and its reward rules and caps, and dispute guidance. Free, no key, no charge, no side effects — it reads static text and calls no model. `section` picks one page; omitted, it returns all of them.

  • dispute_findingFree

    NEEDS A KEY: mint one at https://nittim.com/keys. Records that a finding from a prior audit is wrong (stance:'dispute') or genuinely real (stance:'confirm'), backed by evidence from the repo. Free. A SIGNAL for owner triage — it never changes the audit's scores, verdict or stored report on its own. The finding is identified by its findingKey (from the digest), or by its exact dimension and title.

  • estimate_auditFree

    Price an audit before buying one: give a GitHub repository URL, or a manifest of paths and byte sizes — no file content, nothing uploaded — and get the tier (Audit or Full Audit), the pass count and the exact price. No account or key is needed: it never charges, runs no audit, calls no model and stores nothing. Signed in it also returns your credit balance and whether an unspent Audit covers the run; a guest quote omits both. `fullScan: true` prices Full Audit.

  • get_auditFree

    Retrieve a nittim audit by its UUID, at any stage: the finished markdown digest (verdict, scores, top findings) plus its report link, or — no error, nothing charged — that it is still running, or why it failed and what happened to the charge. Free. Reading needs the key of the account that owns the audit.

  • get_loopFree

    Returns the current text of nittim's free, tool-agnostic self-review checklist — the same content served at https://nittim.com/selfcheck.md. Reviews a codebase against the public shape of nittim's 13-category Priority Framework, plus a 14th on what the code gives away, and states the procedure for running it as a loop. No arguments. No key, no account and no charge — nothing here is sent anywhere.

  • judge_outputwrite actionFree

    Run a cross-vendor judge model over any text you post: code, a document, another model's output, anything. Returns findings + rationale ONLY — never a score, never a pass/fail verdict. Costs 5.03 credits. The judge always comes from a different vendor family than whatever produced the content, and the answer says which one ran. `modelUnderTest` names that family. NEEDS A KEY: mint one at https://nittim.com/keys. COSTS MONEY in three calls: the first quotes a price and charges nothing; a second with `confirmedCost` set to that exact price returns a one-time link for the ACCOUNT OWNER to confirm — their yes, not the assistant's; a plain third call with the same arguments runs once at that price. A moved price is re-quoted, never charged.

  • list_modulesFree

    List every audit module nittim can run: the two deterministic scanners (secret scan + OSV dependency CVE check) and the LLM-reasoned checks. Returns each module's key, tier, and a plain-English description of what it checks. Each module's key identifies it for running individually.

  • mint_keyFree

    For a client that cannot sign in over OAuth: a short, one-time link to https://nittim.com/keys/claim/<token>. Opening it, signed in, mints a real nittim API key and shows it once — the key itself is NEVER returned by this tool or by any other MCP result. The link expires in a few minutes and works exactly once. Free.

  • preview_uploadwrite actionFree

    NEEDS A KEY: mint one at https://nittim.com/keys. Send the paths and sizes of the files you would post — no content leaves your machine to ask this — and get back the list, the byte count, and a link for the account owner to approve it. Free. The approval covers that file list and no other, and a paid audit's own confirmation already covers the file list beside the price, so approving ahead of time is optional.

  • report_loopFree

    NEEDS A KEY: mint one at https://nittim.com/keys. Records anonymised counts from a Nittim Loop the developer has finished and agreed to send: pass numbers, a findings-by-category tally, a fixed count, and whether each pass was clean. Counts only — never a title, file path or snippet. Nothing is charged, and an eligible report can earn a credit reward (rules and caps: see describe_protocol). Reporting the same repo again updates the existing record; the reply says which happened. Results appear at https://nittim.com/loop.

  • run_modulewrite actionFree

    Run ONE nittim audit module against a GitHub repository, never producing scores or a verdict. The two deterministic modules (secret-scan, dependency-cve) return scanner evidence directly, free, with nothing to confirm. Deep-tier modules make one focused model call, cost 5.03 credits each and follow the protocol below. NEEDS A KEY: mint one at https://nittim.com/keys. COSTS MONEY in three calls: the first quotes a price and charges nothing; a second with `confirmedCost` set to that exact price returns a one-time link for the ACCOUNT OWNER to confirm — their yes, not the assistant's; a plain third call with the same arguments runs once at that price. A moved price is re-quoted, never charged.

  • scan_sourceFree

    Free nittim look: committed secrets and known CVEs over posted source files. No account, no key, no nittim credits. Hard evidence only: never scores, never a production verdict. Send SOURCE files, not build output (no node_modules, no dist, no binaries).

  • verify_fixFree

    NEEDS A KEY: mint one at https://nittim.com/keys. Re-checks ONE finding from a finished audit against the repository's current code, or a commit named in the call, and answers fixed, still present, or undetermined — with the reason. It reads only the file that finding cites. Free, capped per day, and it moves no score or verdict: the report keeps recording what was true of the commit it ran on.

Public scan report

scanner v0.1.10 · 2026-10-15 · same rubric, same numbers if you re-run it

1 high
  • –Code scanremote-only server, no package to scann/a
  • Live reliabilityremote reachable in 577ms20/20
  • Tool poisoning15 tool descriptions checked15/15
  • Auth qualityopen endpoint exposes 3 write-action tools with no auth3/15
  • Maintenancelast push 12 days ago15/15
  • Maintainer identityendpoint served from the registry-verified namespace domain8/10

Findings (1)

  • highWrite-action tools reachable without authenticationauth.open-write
Overall 81/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How nittim compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
81/100
higher than 62% of 48,243 servers
Tools
15
the typical server has 7
Tools that change things
20%
typical: 0%. Fewer write tools means less an agent can break
Uptime
100%
of our recent checks; the typical remote server answers 100%
Response time
355 ms
faster than 46% of 30,027 servers

What its tools let an agent do: 12 read · 2 change · 1 run or deploy

Install nittim in Claude Code, Cursor or VS Code

claude mcp add --transport http nittim https://nittim.com/api/mcp
Add to Cursor

What the publisher says

From the nittim repository's README, as published. We do not edit it. Read it on GitHub

nittim MCP

nittim audits code before it ships.

Connect over MCP and your agent can:

  • Scan a repo or a handful of posted files for committed secrets and known vulnerable dependencies — free, no key needed.
  • List every check nittim runs, in plain English.
  • Read the free self-review checklist (get_loop) — free, no key needed.
  • Price a GitHub repo or a set of files before anything runs — free, no upload required.
  • Run a full audit and get back a verdict — Production Ready, Production Ready with Conditions, High Risk, or Not Safe — with security, privacy, reliability, and architecture findings, each paired with a fix.
  • Get a second opinion on any piece of work from an independent judge.
  • Flag a finding that looks wrong, for a person to review.

A paid audit quotes its price before it runs. Nothing is charged until you confirm.

Try it in 30 seconds

Connect (below), then ask your agent:

Run nittim's get_loop and review this repo against it.

That reads the free checklist and reviews your code on your own model. Nothing is uploaded and no key is needed. Or ask it to scan_source a file for committed secrets and vulnerable dependencies. Also free.

Connect

Claude Code, as a plugin (adds the server and the nittim-loop skill):

/plugin marketplace add ilanwolberger/nittim-mcp
/plugin install nittim@nittim

or just the server:

claude mcp add --transport http nittim https://nittim.com/api/mcp

Cursor or VS Code: the buttons at the top, or nittim → https://nittim.com/api/mcp in your MCP settings.

Or add it to any MCP client as:

{
  "nittim": {
    "type": "streamable-http",
    "url": "https://nittim.com/api/mcp"
  }
}

The free tools work right away, no account needed. Paid tools need a key — mint one at nittim.com/keys.

Skills

skills/nittim-loop is a free, local self-review — it walks your assistant through nittim's public checklist over a repository you own, on your own model, with nothing uploaded. It reads the checklist via the get_loop MCP tool when one is connected, or by fetching https://nittim.com/selfcheck.md directly otherwise.

Claude Code — install the plugin (see Connect above), then run /nittim:nittim-loop inside a project you want reviewed. Or install the skill on its own, available in every project:

mkdir -p ~/.claude/skills/nittim-loop && curl -fsSL https://nittim.com/skills/nittim-loop/SKILL.md -o ~/.claude/skills/nittim-loop/SKILL.md

Cursor — the same checklist as a project rule (skills/nittim-loop/nittim-loop.mdc), also served live at https://nittim.com/skills/nittim-loop/nittim-loop.mdc:

mkdir -p .cursor/rules && curl -fsSL https://nittim.com/skills/nittim-loop/nittim-loop.mdc -o .cursor/rules/nittim-loop.mdc

Any other MCP client — call the get_loop tool directly; no install needed.

Learn more

Full reference, for people and for agents: nittim.com/agents

Listed on Smithery, Glama, cursor.directory and the MCP Registry.

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

nittim: common questions

Is nittim MCP server safe?
Mostly: it is graded B (81/100). Read the nittim safety report
How do I install nittim?
It runs remotely at nittim.com. Add it to Claude Code, Cursor, VS Code or Claude Desktop with the snippets above, or call it through the mcp.market gateway without installing anything.
Does nittim need an API key?
Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is nittim maintained?
The last commit was 33 days ago (2026-10-03). The latest release is v1.1.0.
Is nittim up?
100% of our last 28 checks got an answer. We check remote servers about four times a day.
How does nittim compare with other MCP servers?
safety score 81/100 (higher than 62% of 48,243 servers); tools 15 (the typical server has 7); tools that change things 20% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.