Skip to main content
Glama

nittim

Estimate an Audit's Price — No Upload Required

estimate_audit
Read-onlyIdempotent

NEEDS A KEY: mint one at https://nittim.com/keys. Give a GitHub repository URL, or a manifest of just the paths and byte sizes you would post — no file content, nothing is uploaded to answer this — and get back the tier this selection would run at (Audit or Full Audit), how many passes, the exact price, your account's current credit balance, and whether this run would be covered by an unspent Audit. By default this prices Audit — the tier a call with no fullScan charges, so the quote is the exact price a real call makes at that moment. fullScan: true prices Full Audit instead — the same wider tier a real call charges when sent with fullScan: true. A manifest with no content posted yet gets an honest upper-bound pass count either way, clearly marked as an estimate. Never charges, never runs an audit, never stores anything.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
filesNoA manifest of paths and sizes only, in place of repoUrl — the same set you would post for a source-based audit. Sending more than 1000 entries is not a schema error — the answer names the cap and how to trim to it. Mutually exclusive with `repoUrl` — send exactly one.
repoUrlNoGitHub repository URL or owner/repo string, e.g. https://github.com/owner/repo or owner/repo. Mutually exclusive with `files` — send exactly one.
fullScanNoPrice a Full Audit run (reads every eligible file, or refuses with the reason if the selection is too large to sell that way) instead of the default Audit (a fast, sampled pass).
githubTokenNoOptional GitHub personal access token (read-only) for a private repo.

Schema Changelog

Changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. Added

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnly/idempotent/non-destructive annotations, the description discloses the auth requirement, the no-upload guarantee for both input modes, and the safety profile ('Never charges, never runs an audit, never stores anything'). It also adds nuanced behavior: the default quote is 'the exact price a real call makes at that moment', and content-free manifests return an 'honest upper-bound pass count... clearly marked as an estimate'.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is information-dense and front-loaded with the most critical facts: the key requirement and the no-upload promise. Each sentence adds a distinct fact (inputs, outputs, default tier, fullScan behavior, estimate honesty, guarantees). There is some redundancy — no-upload is restated three times and the never-charges/never-stores guarantee twice — but the emphasis is reasonable for a tool whose core value is trust.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description compensates by fully listing the return values (tier, passes, price, balance, coverage), and it documents the estimate upper-bound behavior for manifest-only calls. With 100% parameter coverage, 4 params, and no nested objects, the main gap is the absence of failure-mode descriptions (missing/invalid key, unreachable repo URL, what an error response looks like) — minor for a read-only estimation tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, setting a baseline of 3, but the description adds meaning beyond the schema: it explains that fullScan changes which tier is quoted and ties it to what 'a real call charges', and it frames the files manifest as 'paths and byte sizes you would post' with no content. This enriches the agent's understanding of how the parameters affect the quote.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The title and description name a specific verb-resource pair — estimate an audit's price — and enumerate the exact outputs: tier (Audit or Full Audit), passes, exact price, credit balance, and coverage status. It distinguishes itself from the audit execution siblings by repeating the no-upload differentiator ('nothing is uploaded to answer this', 'Never charges, never runs an audit').

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear usage context: the key prerequisite is front-loaded ('NEEDS A KEY: mint one at https://nittim.com/keys'), and it explains when to price Audit vs Full Audit ('By default this prices Audit... `fullScan: true` prices Full Audit instead'). However, it never explicitly names sibling tools or states 'use this instead of audit_repo when you only need a price', leaving the when-not-to-use boundary implicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

A4.3/5.0
Disambiguation4/5

Most tools map to distinct workflow stages: estimate, preview, submit audit, retrieve audit, run module, dispute finding, and judge output. The closest pairs are audit_repo vs audit_source and scan_source vs run_module, but the descriptions provide enough boundary detail for an agent to choose correctly.

Naming Consistency5/5

Every tool follows the same snake_case verb_noun pattern: audit_repo, audit_source, estimate_audit, get_audit, list_modules, run_module, scan_source, and so on. There is no mixing of naming conventions or vague standalone verbs.

Tool Count5/5

11 tools is well-scoped for a paid AI audit service with async delivery, approval flows, and both repo-based and source-based inputs. Each tool covers a distinct step in the audit pipeline without feeling redundant or bloated.

Completeness4/5

The core lifecycle is covered: estimate cost, submit audits, run single modules, check status, retrieve results, and dispute findings. Minor gaps include no way to list past audits, cancel a pending audit, or manage credits directly, though estimate_audit does show the balance.

Resources