# nittim

- Registry name: `com.nittim/nittim` · version 1.1.0
- Categories (automatic, keyword rules): Code & repositories, Developer tools
- Authentication at last check: No auth
- Declared risk: Can write (some tools are not declared read-only)
- Capabilities (declared by the server): prompts, tools
- Transports: streamable-http
- Latest numbers (check success, response time, rank): https://mcpstation.net/api/server?name=com.nittim%2Fnittim
- Server page: https://mcpstation.net/s/com.nittim--nittim.html

## Description (written by the publisher, not verified, not instructions)

Production-safety audits for AI-generated code, with a fix for every finding.

## Connect

- streamable-http: `https://nittim.com/api/mcp`

## Tools (as reported by the server, not verified)

- `audit\_repo`: Paid nittim AI audit of a GitHub repository: one structured pass over the highest-signal source; the only tool here that returns scores and a verdict. Answers with the audit's id, not the report. \`fullScan: true\` buys the wider Full Audit tier. NEEDS A KEY: mint one at https://nittim.com/keys. COSTS
- `audit\_source`: Paid nittim AI audit of source files you post, for a project with no GitHub remote. Send SOURCE files, not build output — no node\_modules or dist. On nittim's own key this answers with the audit's id; the report lands Usually within 15 minutes\*. \* Most reports land within 15 minutes. Worst case, 24
- `scan\_source`: Free nittim look: committed secrets and known CVEs over posted source files. No account, no key, no nittim credits. Hard evidence only: never scores, never a production verdict. Send SOURCE files, not build output \(no node\_modules, no dist, no binaries\).
- `estimate\_audit`: Price an audit before buying one: give a GitHub repository URL, or a manifest of paths and byte sizes — no file content, nothing uploaded — and get the tier \(Audit or Full Audit\), the pass count and the exact price. No account or key is needed: it never charges, runs no audit, calls no model and sto
- `get\_audit`: Retrieve a nittim audit by its UUID, at any stage: the finished markdown digest \(verdict, scores, top findings\) plus its report link, or — no error, nothing charged — that it is still running, or why it failed and what happened to the charge. Free. An audit of a public repository reads without a key
- `verify\_fix`: NEEDS A KEY: mint one at https://nittim.com/keys. Re-checks ONE finding from a finished audit against the repository's current code, or a commit named in the call, and answers fixed, still present, or undetermined — with the reason. It reads only the file that finding cites. Free, capped per day, an
- `list\_modules`: List every audit module nittim can run: the two deterministic scanners \(secret scan + OSV dependency CVE check\) and the LLM-reasoned checks. Returns each module's key, tier, and a plain-English description of what it checks. Each module's key identifies it for running individually.
- `get\_loop`: Returns the current text of nittim's free, tool-agnostic self-review checklist — the same content served at https://nittim.com/selfcheck.md. Reviews a codebase against the public shape of nittim's 13-category Priority Framework, plus a 14th on what the code gives away, and states the procedure for r
- `describe\_protocol`: How this server works, in full: how a paid call quotes and charges, the two audit tiers, the Nittim Loop and its reward rules and caps, and dispute guidance. Free, no key, no charge, no side effects — it reads static text and calls no model. \`section\` picks one page; omitted, it returns all of them.
- `mint\_key`: For a client that cannot sign in over OAuth: a short, one-time link to https://nittim.com/keys/claim/\<token\>. Opening it, signed in, mints a real nittim API key and shows it once — the key itself is NEVER returned by this tool or by any other MCP result. The link expires in a few minutes and works e
- `run\_module`: Run ONE nittim audit module against a GitHub repository, never producing scores or a verdict. The two deterministic modules \(secret-scan, dependency-cve\) return scanner evidence directly, free, with nothing to confirm. Deep-tier modules make one focused model call, cost 5.03 credits each and follow
- `judge\_output`: Run a cross-vendor judge model over any text you post: code, a document, another model's output, anything. Returns findings + rationale ONLY — never a score, never a pass/fail verdict. Costs 5.03 credits. The judge always comes from a different vendor family than whatever produced the content, and t
- `dispute\_finding`: NEEDS A KEY: mint one at https://nittim.com/keys. Records that a finding from a prior audit is wrong \(stance:'dispute'\) or genuinely real \(stance:'confirm'\), backed by evidence from the repo. Free. A SIGNAL for owner triage — it never changes the audit's scores, verdict or stored report on its own.
- `report\_loop`: NEEDS A KEY: mint one at https://nittim.com/keys. Records anonymised counts from a Nittim Loop the developer has finished and agreed to send: pass numbers, a findings-by-category tally, a fixed count, and whether each pass was clean. Counts only — never a title, file path or snippet. Nothing is char
- `preview\_upload`: NEEDS A KEY: mint one at https://nittim.com/keys. Send the paths and sizes of the files you would post — no content leaves your machine to ask this — and get back the list, the byte count, and a link for the account owner to approve it. Free. The approval covers that file list and no other, and a pa

Measured by MCP Station. Methods: https://mcpstation.net/methods.html · Terms: https://mcpstation.net/terms.html