Skip to main content
Glama

nittim

by com.nittim
OverviewDiscussionsAdmin

Audit a GitHub Repository

audit_repo

Paid nittim AI audit of a GitHub repository: one structured pass over the highest-signal source; the only tool here that returns scores and a verdict. Answers with the audit's id, not the report. fullScan: true buys the wider Full Audit tier. NEEDS A KEY: mint one at https://nittim.com/keys. COSTS MONEY in three calls: the first quotes a price and charges nothing; a second with confirmedCost set to that exact price returns a one-time link for the ACCOUNT OWNER to confirm — their yes, not the assistant's; a plain third call with the same arguments runs once at that price. A moved price is re-quoted, never charged.DELIVERED AS A BATCH: the report lands Usually within 15 minutes*. * Most reports land within 15 minutes. Worst case, 24 hours.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
repoUrlYesGitHub repository URL or owner/repo. A private repo needs a githubToken.
fullScanNoTrue buys the wider Full Audit tier: every eligible source file, priced by pass count.
payInsteadNoTrue pays credits now instead of queuing for the daily free-audit budget to reopen, skipping the covered (Audit) entitlement even when it would otherwise be free.
deployedUrlNoOptional URL of this repository's live deployment, for an origin the account owner actually operates. When set, the audit adds one bounded, READ-ONLY fetch pass against it and reports drift between the deployed artifact and the audited commit. Redirects are never followed; private addresses are refused.
githubTokenNoOptional read-only GitHub token. Without one, only public repos are reachable.
authorizationNoHUMAN CONFIRMATION. The `authorization` id from the confirm-link answer, once the account owner has pressed Confirm. Single-use, short TTL.
confirmedCostNoCOST CONFIRMATION. Omit on the first call; then send back the exact quoted `cost`.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed10 schema fields changed
    • changedInput schema / properties / authorization / description
      Previous value: -"HUMAN CONFIRMATION. Omit until the account owner has pressed Confirm on the link a paid tool answered with; then set to that answer's `authorization` id (single-use, short TTL). Protocol: server instructions."New value: +"HUMAN CONFIRMATION. The `authorization` id from the confirm-link answer, once the account owner has pressed Confirm. Single-use, short TTL."
    • changedInput schema / properties / confirmedCost / description
      Previous value: -"COST CONFIRMATION. Omit on the first call (it only quotes); then set to the exact `cost` object quoted. A moved price is re-quoted, never charged. Protocol: server instructions."New value: +"COST CONFIRMATION. Omit on the first call; then send back the exact quoted `cost`."
    • changedInput schema / properties / confirmedCost / properties / centicredits / description
      Previous value: -"Copy the `centicredits` integer from the cost this tool quoted you, if it has one. Omit it if the quote did not carry one."New value: +"The `centicredits` integer from the quoted cost, if it carried one."
    • changedInput schema / properties / confirmedCost / properties / credits / description
      Previous value: -"Copy the `credits` number from the cost this tool quoted you."New value: +"The `credits` number from the quoted cost."
    • changedInput schema / properties / confirmedCost / properties / kind / description
      Previous value: -"Copy the `kind` from the cost this tool quoted you, e.g. 'credits'."New value: +"The `kind` from the quoted cost, e.g. 'credits'."
    • changedInput schema / properties / deployedUrl / description
      Previous value: -"Optional URL of this repository's live deployment, intended for a URL the account owner actually operates. When set, the audit also runs one bounded, READ-ONLY fetch pass against that origin — the page itself plus a handful of GET requests for static files the repo also contains (e.g. /robots.txt) — and reports observed drift between the deployed artifact and the audited commit on the report. Nothing else is ever fetched, redirects are never followed, and private/internal addresses are refused."New value: +"Optional URL of this repository's live deployment, for an origin the account owner actually operates. When set, the audit adds one bounded, READ-ONLY fetch pass against it and reports drift between the deployed artifact and the audited commit. Redirects are never followed; private addresses are refused."
    • changedInput schema / properties / fullScan / description
      Previous value: -"True buys the wider Full Audit tier instead of the default Audit: every eligible source file, priced by pass count."New value: +"True buys the wider Full Audit tier: every eligible source file, priced by pass count."
    • changedInput schema / properties / githubToken / description
      Previous value: -"Optional GitHub personal access token (read-only) for private repos. If omitted, only public repos are accessible."New value: +"Optional read-only GitHub token. Without one, only public repos are reachable."
    • changedInput schema / properties / payInstead / description
      Previous value: -"True runs for credits immediately instead of queuing, skipping the covered (Audit) entitlement even when it would otherwise be free — for when the account owner has chosen to pay rather than wait for the daily free-audit budget to reopen."New value: +"True pays credits now instead of queuing for the daily free-audit budget to reopen, skipping the covered (Audit) entitlement even when it would otherwise be free."
    • changedInput schema / properties / repoUrl / description
      Previous value: -"GitHub repository URL or owner/repo string, e.g. https://github.com/owner/repo or owner/repo. Private repos require a githubToken."New value: +"GitHub repository URL or owner/repo. A private repo needs a githubToken."
  2. Added

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description fully discloses the tool's side effects: it costs money, requires a key, involves a three-call confirmation flow, returns an id rather than a report, and may take up to 24 hours. It also details the optional read-only deployment fetch behavior and single-use authorization, going well beyond the minimal annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness2/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is overly verbose and repetitive, with multiple sections re-explaining the cost, key, and delivery times in different words (e.g., 'COSTS MONEY' and 'DELIVERED AS A BATCH'). It contains marketing-like phrases and redundant details, making it longer than necessary and less scannable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity of the tool (payment, confirmation, tokens, optional deployment fetch), the description covers the essential flow, required inputs, and expected outcomes (returns an audit id). It lacks an output schema, but the description provides enough context for an agent to call it and interpret the immediate response.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

All seven parameters are described in the schema (100% coverage) and the description adds extra context, such as the need for a githubToken for private repos and the exact meaning of confirmedCost. The description also clarifies the cost-flow and provides usage nuances for payInstead and deployedUrl.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states that this tool performs a paid AI audit of a GitHub repository, returns scores and a verdict, and is the only tool here that does so. It also specifies that the response is an audit id, not the full report, which sets it apart from sibling tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains when to use this tool (for a paid audit with scoring/verdict) and differentiates it from siblings by noting it is the only one that returns scores. It also outlines the multi-call cost-confirmation flow and optional parameters like fullScan, but does not explicitly say 'use this instead of X' beyond the 'only tool' statement.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All nittim toolsInspect
Try in Browser
One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources