Skip to main content
Glama

nittim

by com.nittim
OverviewDiscussionsAdmin

Audit a GitHub Repository

audit_repo

Paid nittim AI audit of a GitHub repository: one structured pass over the highest-signal source; the only tool here that returns scores and a verdict. Answers with the audit's id, not the report. fullScan: true buys the wider Full Audit tier. NEEDS A KEY: mint one at https://nittim.com/keys. COSTS MONEY in three calls: the first quotes a price and charges nothing; a second with confirmedCost set to that exact price returns a one-time link for the ACCOUNT OWNER to confirm — their yes, not the assistant's; a plain third call with the same arguments runs once at that price. A moved price is re-quoted, never charged.DELIVERED AS A BATCH: the report lands Usually within 15 minutes*. * Most reports land within 15 minutes. Worst case, 24 hours.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
repoUrlYesGitHub repository URL or owner/repo. A private repo needs a githubToken, unless the account has installed nittim's GitHub App at nittim.com for it.
fullScanNoTrue buys the wider Full Audit tier: every eligible source file, priced by pass count.
payInsteadNoTrue pays credits now instead of queuing for the daily free-audit budget to reopen, skipping the covered (Audit) entitlement even when it would otherwise be free.
deployedUrlNoOptional URL of this repository's live deployment, for an origin the account owner actually operates. When set, the audit adds one bounded, READ-ONLY fetch pass against it and reports drift between the deployed artifact and the audited commit. Redirects are never followed; private addresses are refused.
githubTokenNoOptional read-only GitHub token for a private repo. Without one, only public repos are reachable — unless the account has installed nittim's GitHub App at nittim.com for this repo, in which case a private repo works with no token at all.
authorizationNoHUMAN CONFIRMATION. The `authorization` id from the confirm-link answer, once the account owner has pressed Confirm. Single-use, short TTL.
confirmedCostNoCOST CONFIRMATION. Omit on the first call; then send back the exact quoted `cost`.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed2 schema fields changed
    • changedInput schema / properties / githubToken / description
      Previous value: -"Optional read-only GitHub token. Without one, only public repos are reachable."New value: +"Optional read-only GitHub token for a private repo. Without one, only public repos are reachable — unless the account has installed nittim's GitHub App at nittim.com for this repo, in which case a private repo works with no token at all."
    • changedInput schema / properties / repoUrl / description
      Previous value: -"GitHub repository URL or owner/repo. A private repo needs a githubToken."New value: +"GitHub repository URL or owner/repo. A private repo needs a githubToken, unless the account has installed nittim's GitHub App at nittim.com for it."
  2. Changed10 schema fields changed
    • changedInput schema / properties / authorization / description
      Previous value: -"HUMAN CONFIRMATION. Omit until the account owner has pressed Confirm on the link a paid tool answered with; then set to that answer's `authorization` id (single-use, short TTL). Protocol: server instructions."New value: +"HUMAN CONFIRMATION. The `authorization` id from the confirm-link answer, once the account owner has pressed Confirm. Single-use, short TTL."
    • changedInput schema / properties / confirmedCost / description
      Previous value: -"COST CONFIRMATION. Omit on the first call (it only quotes); then set to the exact `cost` object quoted. A moved price is re-quoted, never charged. Protocol: server instructions."New value: +"COST CONFIRMATION. Omit on the first call; then send back the exact quoted `cost`."
    • changedInput schema / properties / confirmedCost / properties / centicredits / description
      Previous value: -"Copy the `centicredits` integer from the cost this tool quoted you, if it has one. Omit it if the quote did not carry one."New value: +"The `centicredits` integer from the quoted cost, if it carried one."
    • changedInput schema / properties / confirmedCost / properties / credits / description
      Previous value: -"Copy the `credits` number from the cost this tool quoted you."New value: +"The `credits` number from the quoted cost."
    • changedInput schema / properties / confirmedCost / properties / kind / description
      Previous value: -"Copy the `kind` from the cost this tool quoted you, e.g. 'credits'."New value: +"The `kind` from the quoted cost, e.g. 'credits'."
    • changedInput schema / properties / deployedUrl / description
      Previous value: -"Optional URL of this repository's live deployment, intended for a URL the account owner actually operates. When set, the audit also runs one bounded, READ-ONLY fetch pass against that origin — the page itself plus a handful of GET requests for static files the repo also contains (e.g. /robots.txt) — and reports observed drift between the deployed artifact and the audited commit on the report. Nothing else is ever fetched, redirects are never followed, and private/internal addresses are refused."New value: +"Optional URL of this repository's live deployment, for an origin the account owner actually operates. When set, the audit adds one bounded, READ-ONLY fetch pass against it and reports drift between the deployed artifact and the audited commit. Redirects are never followed; private addresses are refused."
    • changedInput schema / properties / fullScan / description
      Previous value: -"True buys the wider Full Audit tier instead of the default Audit: every eligible source file, priced by pass count."New value: +"True buys the wider Full Audit tier: every eligible source file, priced by pass count."
    • changedInput schema / properties / githubToken / description
      Previous value: -"Optional GitHub personal access token (read-only) for private repos. If omitted, only public repos are accessible."New value: +"Optional read-only GitHub token. Without one, only public repos are reachable."
    • changedInput schema / properties / payInstead / description
      Previous value: -"True runs for credits immediately instead of queuing, skipping the covered (Audit) entitlement even when it would otherwise be free — for when the account owner has chosen to pay rather than wait for the daily free-audit budget to reopen."New value: +"True pays credits now instead of queuing for the daily free-audit budget to reopen, skipping the covered (Audit) entitlement even when it would otherwise be free."
    • changedInput schema / properties / repoUrl / description
      Previous value: -"GitHub repository URL or owner/repo string, e.g. https://github.com/owner/repo or owner/repo. Private repos require a githubToken."New value: +"GitHub repository URL or owner/repo. A private repo needs a githubToken."
  3. Added

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description goes well beyond the annotations by disclosing the full cost workflow: first call quotes, second call requires explicit owner confirmation via a one-time link, third call runs at the quoted price, and changed prices are re-quoted. It also explains key requirements, batch delivery, the typical and worst-case delay, and that the response is an id rather than a report. No contradiction with the annotations exists.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The definition is front-loaded with purpose and well-paragraphed, but it is wordy and contains redundancy around delivery timing: 'Usually within 15 minutes*' followed by '* Most reports land within 15 minutes. Worst case, 24 hours.' There is also an awkward phrase ('A moved price is re-quoted') that hurts clarity. The length is partly justified by the complex payment flow, but tightening would help.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a complex paid tool with 7 parameters, nested objects, no output schema, and meaningful side effects, the description is thorough. It covers auth requirements, cost confirmation, human-in-the-loop authorization, delivery latency, fullScan behavior, and the non-obvious fact that the result is an audit id rather than the report. Nothing essential seems missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the parameter descriptions already carry most of the load. The prose adds meaningful orchestration context: how confirmedCost and authorization relate across the three-call payment flow, and what fullScan actually buys. This temporal sequencing is value beyond the structured schema fields.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The first sentence states a specific verb and resource ('Paid nittim AI audit of a GitHub repository') and clarifies the unique value ('the only tool here that returns scores and a verdict'). It also sets correct output expectations: the tool returns an audit id, not the report. This clearly distinguishes it from sibling tools like scan_source or estimate_audit.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear context for when the tool is appropriate: it is the only one returning scores and a verdict, requires a paid key, and has a multi-call confirmation flow. It does not explicitly name alternatives or list when-not-to-use conditions, but the uniqueness statement provides a strong implicit selection rule.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All nittim toolsInspect
Try in Browser
One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources