nittim is a remote MCP server that gives an AI agent 15 tools, among them audit_repo, audit_source, describe_protocol. It answers at https://nittim.com/api/mcp over streamable HTTP, and it listed its tools to an anonymous client, so no sign-in was needed for that. Our probes reached it 6 of 6 times since 10 September 2026; the last check, on 19 October 2026, succeeded.
Production-safety audits for AI-generated code, with a fix for every finding.
Description as the publisher wrote it.
| Tool | What it does |
|---|---|
audit_repo | Paid nittim AI audit of a GitHub repository: one structured pass over the highest-signal source; the only tool here that returns scores and a verdict. Answers with the audit's id, not the report. `fullScan: true` buys the wider Full Audit t Inputs: repoUrl, githubToken, confirmedCost, authorization, fullScan, payInstead |
audit_source | Paid nittim AI audit of source files you post, for a project with no GitHub remote. Send SOURCE files, not build output — no node_modules or dist. On nittim's own key this answers with the audit's id; the report lands Usually within 15 minu Inputs: name, files, uploadGrant, confirmedCost, authorization, fullScan |
describe_protocol | How this server works, in full: how a paid call quotes and charges, the two audit tiers, the Nittim Loop and its reward rules and caps, and dispute guidance. Free, no key, no charge, no side effects — it reads static text and calls no model Inputs: section |
dispute_finding | NEEDS A KEY: mint one at https://nittim.com/keys. Records that a finding from a prior audit is wrong (stance:'dispute') or genuinely real (stance:'confirm'), backed by evidence from the repo. Free. A SIGNAL for owner triage — it never chang Inputs: auditId, findingKey, dimension, title, stance, evidence |
estimate_audit | Price an audit before buying one: give a GitHub repository URL, or a manifest of paths and byte sizes — no file content, nothing uploaded — and get the tier (Audit or Full Audit), the pass count and the exact price. No account or key is nee Inputs: repoUrl, githubToken, files, fullScan |
get_audit | Retrieve a nittim audit by its UUID, at any stage: the finished markdown digest (verdict, scores, top findings) plus its report link, or — no error, nothing charged — that it is still running, or why it failed and what happened to the charg Inputs: id |
get_loop | Returns the current text of nittim's free, tool-agnostic self-review checklist — the same content served at https://nittim.com/selfcheck.md. Reviews a codebase against the public shape of nittim's 13-category Priority Framework, plus a 14th |
judge_output | Run a cross-vendor judge model over any text you post: code, a document, another model's output, anything. Returns findings + rationale ONLY — never a score, never a pass/fail verdict. Costs 5.03 credits. The judge always comes from a diffe Inputs: content, criteria, context, modelUnderTest, confirmedCost, authorization |
list_modules | List every audit module nittim can run: the two deterministic scanners (secret scan + OSV dependency CVE check) and the LLM-reasoned checks. Returns each module's key, tier, and a plain-English description of what it checks. Each module's k |
mint_key | For a client that cannot sign in over OAuth: a short, one-time link to https://nittim.com/keys/claim/<token>. Opening it, signed in, mints a real nittim API key and shows it once — the key itself is NEVER returned by this tool or by any oth Inputs: keyName |
preview_upload | NEEDS A KEY: mint one at https://nittim.com/keys. Send the paths and sizes of the files you would post — no content leaves your machine to ask this — and get back the list, the byte count, and a link for the account owner to approve it. Fre Inputs: name, files |
report_loop | NEEDS A KEY: mint one at https://nittim.com/keys. Records anonymised counts from a Nittim Loop the developer has finished and agreed to send: pass numbers, a findings-by-category tally, a fixed count, and whether each pass was clean. Counts Inputs: repo_hash, client_name, client_version, repo_size_bucket, convergence, swept |
run_module | Run ONE nittim audit module against a GitHub repository, never producing scores or a verdict. The two deterministic modules (secret-scan, dependency-cve) return scanner evidence directly, free, with nothing to confirm. Deep-tier modules mak Inputs: repoUrl, moduleKey, githubToken, confirmedCost, authorization |
scan_source | Free nittim look: committed secrets and known CVEs over posted source files. No account, no key, no nittim credits. Hard evidence only: never scores, never a production verdict. Send SOURCE files, not build output (no node_modules, no dist, Inputs: name, files, uploadGrant |
verify_fix | NEEDS A KEY: mint one at https://nittim.com/keys. Re-checks ONE finding from a finished audit against the repository's current code, or a commit named in the call, and answers fixed, still present, or undetermined — with the reason. It read Inputs: auditId, findingKey, ref |
Every block below points at https://nittim.com/api/mcp. Pick your client and copy.
claude mcp add --transport http nittim https://nittim.com/api/mcp
{
"mcpServers": {
"nittim": {
"command": "npx",
"args": ["-y", "mcp-remote", "https://nittim.com/api/mcp"]
}
}
}{
"mcpServers": {
"nittim": {
"url": "https://nittim.com/api/mcp"
}
}
}{
"servers": {
"nittim": {
"type": "http",
"url": "https://nittim.com/api/mcp"
}
}
}{
"context_servers": {
"nittim": {
"url": "https://nittim.com/api/mcp"
}
}
}{
"mcpServers": {
"nittim": {
"serverUrl": "https://nittim.com/api/mcp"
}
}
}{
"mcpServers": {
"nittim": {
"url": "https://nittim.com/api/mcp"
}
}
}name: nittim
version: 0.0.1
schema: v1
mcpServers:
- name: nittim
type: streamable-http
url: https://nittim.com/api/mcp{
"mcpServers": {
"nittim": {
"httpUrl": "https://nittim.com/api/mcp"
}
}
}{
"mcpServers": {
"nittim": {
"type": "http",
"url": "https://nittim.com/api/mcp"
}
}
}{
"mcpServers": {
"nittim": {
"url": "https://nittim.com/api/mcp"
}
}
}goose://extension?url=https%3A%2F%2Fnittim.com%2Fapi%2Fmcp&type=streamable_http&id=nittim&name=nittim
It answered our last check on 19 October 2026 in 309 ms. Over 6 checks since 10 September 2026 it answered 6. Status here comes from Neuronto's own probes, not from the publisher.
Yes. It is published by nittim.com and served from nittim.com, the vendor's own domain: https://nittim.com/api/mcp.
15, as returned by the server's own tools/list on 11 September 2026: audit_repo, audit_source, describe_protocol, dispute_finding, estimate_audit, get_audit, get_loop, judge_output, and 7 more.
It answered our last check on 19 October 2026 in 309 ms. Over 6 checks since 10 September 2026 it answered 6.
Put the server under mcpServers in ~/.cursor/mcp.json with the URL https://nittim.com/api/mcp. The exact JSON is above, with the same setup for Claude Code, Claude Desktop, VS Code, Windsurf, Zed, Gemini CLI and the rest.
It listed its tools to an anonymous client, so reading the tool list needs no key. Individual tools can still ask for credentials in their own inputs.
Publisher: com.nittim. Endpoint host: nittim.com. ARD identifier: urn:air:com.nittim:mcp:nittim.
First indexed 10 September 2026. The tools are exactly what the server returned; nothing on this page
is inferred from its name. Ranking in Neuronto search is never for sale.