nittim MCP (com.nittim/nittim)

This MCP server performs production-safety audits for AI-generated code and provides a fix for every finding. The server is identified as com.nittim/nittim, with 15 tools available. It is associated with topics including ai-generated-code, code-audit, production-readiness, security, and MCP integration patterns.

🛠️ Key Features

Production-safety audits for AI-generated code
Fixes provided for every finding
Supports MCP usage with an HTTP endpoint (/api/mcp) referenced in installation links
Includes 15 tools

🚀 Use Cases

Auditing AI-generated code for production readiness
Applying remediations returned alongside audit findings
Security-focused review of generated code

⚡ Developer Benefits

Automated audit workflow with corresponding fixes
MCP tooling suitable for developer environments like Cursor and VS Code
Clearly scoped to code audit and production-safety outcomes

⚠️ Limitations

No additional details about specific tools, audit coverage, or output formats are provided in the available source data.

nittim MCP

nittim audits code before it ships.

Connect over MCP and your agent can:

Scan a repo or a handful of posted files for committed secrets and known vulnerable dependencies — free, no key needed.
List every check nittim runs, in plain English.
Read the free self-review checklist (get_loop) — free, no key needed.
Price a GitHub repo or a set of files before anything runs — free, no upload required.
Run a full audit and get back a verdict — Production Ready, Production Ready with Conditions, High Risk, or Not Safe — with security, privacy, reliability, and architecture findings, each paired with a fix.
Get a second opinion on any piece of work from an independent judge.
Flag a finding that looks wrong, for a person to review.

A paid audit quotes its price before it runs. Nothing is charged until you confirm.

Try it in 30 seconds

Connect (below), then ask your agent:

Run nittim's get_loop and review this repo against it.

That reads the free checklist and reviews your code on your own model. Nothing is uploaded and no key is needed. Or ask it to scan_source a file for committed secrets and vulnerable dependencies. Also free.

Connect

Claude Code, as a plugin (adds the server and the nittim-loop skill):

code

/plugin marketplace add ilanwolberger/nittim-mcp
/plugin install nittim@nittim

or just the server:

code

claude mcp add --transport http nittim https://nittim.com/api/mcp

Using Claude Code's auto mode?

Auto mode refuses any tool it reads as able to spend money before that tool runs. nittim's paid tools always quote a price first, and every charge waits for the account owner's click on a confirmation link — so allowing the server never lets an assistant spend on its own. Add this to ~/.claude/settings.json (or your project's .claude/settings.json):

json

{ "permissions": { "allow": ["mcp__nittim"] } }

The rule name follows whatever you called the server in claude mcp add — it's mcp__<your-name> if you picked something other than nittim. The free tools (scan, estimate, checklist) work without this rule.

Cursor or VS Code: the buttons at the top, or nittim → https://nittim.com/api/mcp in your MCP settings.

Or add it to any MCP client as:

json

{
  "nittim": {
    "type": "streamable-http",
    "url": "https://nittim.com/api/mcp"
  }
}

The free tools work right away, no account needed. Paid tools need a key — mint one at nittim.com/keys.

Skills

skills/nittim-loop is a free, local self-review — it walks your assistant through nittim's public checklist over a repository you own, on your own model, with nothing uploaded. It reads the checklist via the get_loop MCP tool when one is connected, or by fetching https://nittim.com/selfcheck.md directly otherwise.

Claude Code — install the plugin (see Connect above), then run /nittim:nittim-loop inside a project you want reviewed. Or install the skill on its own, available in every project:

code

mkdir -p ~/.claude/skills/nittim-loop && curl -fsSL https://nittim.com/skills/nittim-loop/SKILL.md -o ~/.claude/skills/nittim-loop/SKILL.md

Cursor — the same checklist as a project rule (skills/nittim-loop/nittim-loop.mdc), also served live at https://nittim.com/skills/nittim-loop/nittim-loop.mdc:

code

mkdir -p .cursor/rules && curl -fsSL https://nittim.com/skills/nittim-loop/nittim-loop.mdc -o .cursor/rules/nittim-loop.mdc

Any other MCP client — call the get_loop tool directly; no install needed.

Learn more

Full reference, for people and for agents: nittim.com/agents

Listed on Smithery, Glama, cursor.directory and the MCP Registry.

This repository holds the listing manifests for nittim's MCP server, all pointing at the live endpoint above: Open Plugins (plugin.json, .mcp.json), the MCP Registry (server.json), a Claude Code plugin and marketplace (.claude-plugin/), and the nittim-loop skill (SKILL.md for Claude Code, nittim-loop.mdc for Cursor). It carries no other application code. scripts/gate.sh checks the repo's own consistency — manifests agree, both skill copies identical, every URL above resolves — and hooks/pre-push runs a secret scan before anything reaches GitHub (git config core.hooksPath hooks once per clone).

repoUrl	string	required	GitHub repository URL or owner/repo. A private repo needs a githubToken.
githubToken	string	optional	Optional read-only GitHub token. Without one, only public repos are reachable.
confirmedCost	object	optional	COST CONFIRMATION. Omit on the first call; then send back the exact quoted `cost`.
authorization	string	optional	HUMAN CONFIRMATION. The `authorization` id from the confirm-link answer, once the account owner has pressed Confirm. Single-use, short TTL.
fullScan	boolean	optional	True buys the wider Full Audit tier: every eligible source file, priced by pass count.
payInstead	boolean	optional	True pays credits now instead of queuing for the daily free-audit budget to reopen, skipping the covered (Audit) entitlement even when it would otherwise be free.
deployedUrl	string	optional	Optional URL of this repository's live deployment, for an origin the account owner actually operates. When set, the audit adds one bounded, READ-ONLY fetch pass against it and reports drift between the deployed artifact and the audited commit. Redirects are never followed; private addresses are refused.

name	string	required	A display label for this project, e.g. 'my-abacus-app'. Sanitized before use.
files	array	required	Source files as { path, content }[] — not build output. At most 1000; over the internal per-audit cap, the highest-priority ones win.
uploadGrant	string	optional	Optional: the id of an upload approval the account owner already confirmed. A large post without one is answered with a confirmation covering the files and the price.
confirmedCost	object	optional	COST CONFIRMATION. Omit on the first call; then send back the exact quoted `cost`.
authorization	string	optional	HUMAN CONFIRMATION. The `authorization` id from the confirm-link answer, once the account owner has pressed Confirm. Single-use, short TTL.
fullScan	boolean	optional	True buys the wider Full Audit tier over the files you post, priced by pass count.

name	string	required	A display label for this project, e.g. 'my-abacus-app'. Sanitized before use.
files	array	required	Source files as { path, content }[] — not build output. At most 1000; over the internal per-audit cap, the highest-priority ones win.
uploadGrant	string	optional	Optional: the id of an upload approval the account owner already confirmed. A large post without one is answered with a confirmation covering the files and the price.

repoUrl	string	optional	GitHub repository URL or owner/repo. Mutually exclusive with `files` — send one.
githubToken	string	optional	Optional GitHub personal access token (read-only) for a private repo.
files	array	optional	A manifest of paths and sizes only, in place of `repoUrl` — the same set you would post. Over the cap the answer names it and how to trim. Send one or the other.
fullScan	boolean	optional	Price Full Audit (every eligible file, or a refusal with the reason when the selection is too large) instead of the default Audit.

auditId	string	required	The audit UUID, from its report link.
findingKey	string	required	The finding's stable key, as printed beside it in the report's findings list.
ref	string	optional	A commit SHA or branch to check instead of the repository's current HEAD. Must be the audited commit or newer.

nittim

nittim MCP (com.nittim/nittim)

🛠️ Key Features

🚀 Use Cases

⚡ Developer Benefits

⚠️ Limitations

Topics

audit_repo

audit_source

scan_source

estimate_audit

get_audit

verify_fix

list_modules

get_loop

describe_protocol

mint_key

run_module

judge_output

dispute_finding

report_loop

preview_upload

nittim MCP

Try it in 30 seconds

Connect

Using Claude Code's auto mode?

Skills

Learn more

Install

Remote endpoint

Related servers

content	string	required	The text to judge — code, a document, another model's output. Up to ~100KB.
criteria	string	optional	Optional — what to judge it against, e.g. 'correctness and security'.
context	string	optional	Optional — background the judge should know, e.g. what this content is for.
modelUnderTest	string	optional	Optional — which vendor family produced `content`, if it is itself a model's output. The judge that runs is always a different family than this names. Use 'unspecified' for anything that is not model output, or when the family is unknown.
confirmedCost	object	optional	COST CONFIRMATION. Omit on the first call; then send back the exact quoted `cost`.
authorization	string	optional	HUMAN CONFIRMATION. The `authorization` id from the confirm-link answer, once the account owner has pressed Confirm. Single-use, short TTL.

repo_hash	string	required	sha256 of the repository's canonical identity (the lowercased 'owner/repo', or a stable local fingerprint) — never the repo name itself. nittim never sees the name.
client_name	string	optional	Your own name — omit to read it from the MCP connection instead.
client_version	string	optional	Your own version string, if you have one.
repo_size_bucket	string	required	A rough size bucket for the repo you looped over.
convergence	string	optional	Optional: 'converged' (two consecutive clean passes) or 'cap_reached' (stopped for any other reason). Omit if unsure — the read from `passes` is derived either way.
swept	boolean	optional	Optional: was the CLASS swept — a guard, lint rule or exhaustiveness check that makes a new instance loud — rather than only the instances a pass named? Never derived, never changes the reward. On a repeat report, omitting it keeps the last answer; `false` withdraws it.
mode	string	optional	Optional: 'one_shot' (every lens sweeps the whole tree first, then one fix wave, then a short convergence loop) or 'serial' (one lens or area per pass, fixing between passes).
first_wave_lenses	integer	optional	Optional, with mode 'one_shot' only: how many lenses ran in parallel on pass 1.
passes	array	required	One entry per pass you actually ran, in order.