Basic information
Security audit for AI-written code, inside your coding assistant. Free scan of any public GitHub repo for committed secrets and vulnerable dependencies, then a full audit with findings, evidence and the fix for each. Free tools need no key; paid tools show the price first and never run until you confirm. Works in Cursor, Claude Code, Windsurf, Codex and Copilot.
https://nittim.com/api/mcpclaude mcp add nittim --transport http https://nittim.com/api/mcpPaid nittim AI audit of a GitHub repository: one structured pass over the highest-signal source; the only tool here that returns scores and a verdict. Answers with the audit's id, not the report. `fullScan: true` buys the wider Full Audit tier. NEEDS A KEY: mint one at https://nittim.com/keys. COSTS MONEY in three calls: the first quotes a price and charges nothing; a second with `confirmedCost` set to that exact price returns a one-time link for the ACCOUNT OWNER to confirm — their yes, not the assistant's; a plain third call with the same arguments runs once at that price. A moved price is re-quoted, never charged.DELIVERED AS A BATCH: the report lands Usually within 15 minutes*. * Most reports land within 15 minutes. Worst case, 24 hours.
Paid nittim AI audit of source files you post, for a project with no GitHub remote. Send SOURCE files, not build output — no node_modules or dist. On nittim's own key this answers with the audit's id; the report lands Usually within 15 minutes*. * Most reports land within 15 minutes. Worst case, 24 hours. On your own key (BYOK Pro) the report comes back in this call instead. Costs 5.14 credits (a paid+subscribed org's included allowance, an unspent Audit, then prepaid credits), always saved as a PRIVATE report. `fullScan: true` buys the wider Full Audit tier. NEEDS A KEY: mint one at https://nittim.com/keys. COSTS MONEY in three calls: the first quotes a price and charges nothing; a second with `confirmedCost` set to that exact price returns a one-time link for the ACCOUNT OWNER to confirm — their yes, not the assistant's; a plain third call with the same arguments runs once at that price. A moved price is re-quoted, never charged.
Free nittim look: committed secrets and known CVEs over posted source files. No account, no key, no nittim credits. Hard evidence only: never scores, never a production verdict. Send SOURCE files, not build output (no node_modules, no dist, no binaries).
Price an audit before buying one: give a GitHub repository URL, or a manifest of paths and byte sizes — no file content, nothing uploaded — and get the tier (Audit or Full Audit), the pass count and the exact price. No account or key is needed: it never charges, runs no audit, calls no model and stores nothing. Signed in it also returns your credit balance and whether an unspent Audit covers the run; a guest quote omits both. `fullScan: true` prices Full Audit.
Retrieve a nittim audit by its UUID, at any stage: the finished markdown digest (verdict, scores, top findings) plus its report link, or — no error, nothing charged — that it is still running, or why it failed and what happened to the charge. Free. An audit of a public repository reads without a key; a private one needs the key of the account that owns it.
NEEDS A KEY: mint one at https://nittim.com/keys. Re-checks ONE finding from a finished audit against the repository's current code, or a commit named in the call, and answers fixed, still present, or undetermined — with the reason. It reads only the file that finding cites. Free, capped per day, and it moves no score or verdict: the report keeps recording what was true of the commit it ran on.
List every audit module nittim can run: the two deterministic scanners (secret scan + OSV dependency CVE check) and the LLM-reasoned checks. Returns each module's key, tier, and a plain-English description of what it checks. Each module's key identifies it for running individually.
Returns the current text of nittim's free, tool-agnostic self-review checklist — the same content served at https://nittim.com/selfcheck.md. Reviews a codebase against the public shape of nittim's 13-category Priority Framework, plus a 14th on what the code gives away, and states the procedure for running it as a loop. No arguments. No key, no account and no charge — nothing here is sent anywhere.
How this server works, in full: how a paid call quotes and charges, the two audit tiers, the Nittim Loop and its reward rules and caps, and dispute guidance. Free, no key, no charge, no side effects — it reads static text and calls no model. `section` picks one page; omitted, it returns all of them.
For a client that cannot sign in over OAuth: a short, one-time link to https://nittim.com/keys/claim/<token>. Opening it, signed in, mints a real nittim API key and shows it once — the key itself is NEVER returned by this tool or by any other MCP result. The link expires in a few minutes and works exactly once. Free.
Run ONE nittim audit module against a GitHub repository, never producing scores or a verdict. The two deterministic modules (secret-scan, dependency-cve) return scanner evidence directly, free, with nothing to confirm. Deep-tier modules make one focused model call, cost 5.03 credits each and follow the protocol below. NEEDS A KEY: mint one at https://nittim.com/keys. COSTS MONEY in three calls: the first quotes a price and charges nothing; a second with `confirmedCost` set to that exact price returns a one-time link for the ACCOUNT OWNER to confirm — their yes, not the assistant's; a plain third call with the same arguments runs once at that price. A moved price is re-quoted, never charged.
Run a cross-vendor judge model over any text you post: code, a document, another model's output, anything. Returns findings + rationale ONLY — never a score, never a pass/fail verdict. Costs 5.03 credits. The judge always comes from a different vendor family than whatever produced the content, and the answer says which one ran. `modelUnderTest` names that family. NEEDS A KEY: mint one at https://nittim.com/keys. COSTS MONEY in three calls: the first quotes a price and charges nothing; a second with `confirmedCost` set to that exact price returns a one-time link for the ACCOUNT OWNER to confirm — their yes, not the assistant's; a plain third call with the same arguments runs once at that price. A moved price is re-quoted, never charged.
NEEDS A KEY: mint one at https://nittim.com/keys. Records that a finding from a prior audit is wrong (stance:'dispute') or genuinely real (stance:'confirm'), backed by evidence from the repo. Free. A SIGNAL for owner triage — it never changes the audit's scores, verdict or stored report on its own. The finding is identified by its findingKey (from the digest), or by its exact dimension and title.
NEEDS A KEY: mint one at https://nittim.com/keys. Records anonymised counts from a Nittim Loop the developer has finished and agreed to send: pass numbers, a findings-by-category tally, a fixed count, and whether each pass was clean. Counts only — never a title, file path or snippet. Nothing is charged, and an eligible report can earn a credit reward (rules and caps: see describe_protocol). Reporting the same repo again updates the existing record; the reply says which happened. Results appear at https://nittim.com/loop.
NEEDS A KEY: mint one at https://nittim.com/keys. Send the paths and sizes of the files you would post — no content leaves your machine to ask this — and get back the list, the byte count, and a link for the account owner to approve it. Free. The approval covers that file list and no other, and a paid audit's own confirmation already covers the file list beside the price, so approving ahead of time is optional.
nittim MCP Server is the hosted MCP endpoint for nittim, a security audit for AI-written code: your coding assistant can scan a repo or posted files for committed secrets and known vulnerable dependencies for free, then run a paid audit that returns a verdict, findings and a fix for each.
nittim runs at https://nittim.com/api/mcp over Streamable HTTP. The free tools need no account or key. Paid tools always quote a price first, and no charge goes through until the account owner confirms it on a one-time link. The GitHub repository ilanwolberger/nittim-mcp holds only listing manifests, a Claude Code plugin and the nittim-loop skill; the server itself is operated by nittim.
No install is needed. Connect the endpoint, then ask for a scan. Free tools (scan_source, list_modules, estimate_audit, get_loop) work right away. For paid audits, mint an API key at nittim.com/keys; the plaintext is shown once. nittim advises keeping the key at user scope and never in a project .mcp.json that gets committed. Clients that cannot sign in over OAuth can use the mint_key tool, which returns a short one-time claim link (never the key itself).
claude mcp add --transport http nittim https://nittim.com/api/mcp
Or install it as a plugin, which also adds the nittim-loop skill:
/plugin marketplace add ilanwolberger/nittim-mcp
/plugin install nittim@nittim
Claude Code's auto mode refuses tools it reads as able to spend money, even a paid tool's first, quote-only call. nittim's README suggests allowing the server in ~/.claude/settings.json or .claude/settings.json:
{ "permissions": { "allow": ["mcp__nittim"] } }
Open Settings → Connectors → Add custom connector and paste https://nittim.com/api/mcp.
Use the "Add to Cursor" button in the README, or add this to mcp.json:
{
"mcpServers": {
"nittim": {
"url": "https://nittim.com/api/mcp"
}
}
}
Use the "Install in VS Code" button, or add it to .vscode/mcp.json:
{
"servers": {
"nittim": {
"type": "http",
"url": "https://nittim.com/api/mcp"
}
}
}
nittim's docs put the entry in mcp_config.json (often ~/.codeium/windsurf/mcp_config.json), where the address field is serverUrl:
{
"mcpServers": {
"nittim": {
"serverUrl": "https://nittim.com/api/mcp"
}
}
}
estimate_audit quotes the tier, pass count and exact price for a repo or a manifest of paths and sizes, without uploading anything.verify_fix re-checks one finding against current code and answers fixed, still present or undetermined.get_loop returns nittim's public checklist so your assistant can review the code on your own model, with nothing sent to nittim.The server exposes 15 tools.
scan_source (secrets and CVEs over posted files), list_modules (every check, with key, tier and description), estimate_audit (exact price, no charge) and get_loop (the self-review checklist).audit_repo audits a GitHub repository and is the only tool that returns scores and a verdict (fullScan: true buys the wider Full Audit tier); audit_source audits posted source files for projects with no GitHub remote; run_module runs a single module (the secret-scan and dependency-cve modules are free); judge_output runs a cross-vendor judge model over any text and returns findings only.get_audit fetches an audit by ID at any stage, verify_fix re-checks a finding, and dispute_finding records that a finding is wrong or confirmed for owner triage.mint_key, preview_upload (approve a file list ahead of time), report_loop (send anonymised Nittim Loop counts, which can earn a credit reward) and describe_protocol (how quoting, charging, tiers and disputes work).get_loop and review this repo against it."verify_fix on each one.mcp__nittim (or mcp__<your-name>) to permissions.allow; the free tools work without this rule.x-nittim-auth: none to the server entry.verify_fix, dispute_finding, report_loop and preview_upload need a key from nittim.com/keys.The secret and CVE scan, module list, price estimate and self-review checklist are free. AI audits use prepaid credits: an Audit is 5.14 credits, and nittim's pricing page says your first Audit is free once per account. Credit packs start at $29.
Not for the free tools. Paid tools need a key minted at nittim.com/keys.
No. Every paid tool quotes a price first, and nothing is charged until the account owner confirms that exact price on a one-time link.
nittim documents setup for Cursor, Claude Code, Windsurf, Codex and GitHub Copilot in VS Code. Any MCP client that accepts a remote URL can connect.
nittim says it keeps findings (path, line and a masked excerpt) so the report has a link, never the files and never the secret itself, and it writes nothing into your project.
Yes. The BYOK Pro plan ($49/month) forwards your Anthropic key per request via the `x-nittim-anthropic-key` header, and nittim says it never stores it.
The nittim remote MCP server is a hosted Model Context Protocol endpoint at https://nittim.com/api/mcp, so AI assistants can connect to it without installing or running anything locally.
Add the endpoint https://nittim.com/api/mcp to any MCP-compatible client such as Claude Code, Cursor, or VS Code. The setup snippets on this page configure each client in one step.
Authentication requirements for nittim have not been confirmed in this listing. Check the provider’s documentation before connecting.
nittim exposes a Streamable HTTP endpoint, the transport used by remote MCP servers and supported by all major MCP clients.
Write, schedule and publish LinkedIn posts in your own voice, reply to comments and read your analytics, all from your AI assistant. Remote MCP server with OAuth sign-in.
Official 42min MCP server: let Claude, ChatGPT, Cursor or any MCP client manage your meeting scheduling. Check availability, find free slots, book, cancel and reschedule meetings, manage recurring series, secret booking
One MCP connection for all your Gmail, Google Calendar, Drive and Contacts accounts, Slack workspaces and Notion — free.
Hosted AdLoop: Google Ads, Reddit Ads, GA4 and Tag Manager in claude.ai, ChatGPT and more, with a preview before every change.
Aard connects Macroeconomic and other official data from 170+ publishers including World Bank, IMF, BIS, ECB, Eurostat, and National Statistical Offices. Aard is powered by a large graph of the metadata universe and an
Comments