Skip to main content
Glama

nittim

by com.nittim
OverviewDiscussionsAdmin

Run a Single Audit Module

run_module

Run ONE nittim audit module against a GitHub repository, never producing scores or a verdict. The two deterministic modules (secret-scan, dependency-cve) return scanner evidence directly, free, with nothing to confirm. Deep-tier modules make one focused model call, cost 5.03 credits each and follow the protocol below. NEEDS A KEY: mint one at https://nittim.com/keys. COSTS MONEY in three calls: the first quotes a price and charges nothing; a second with confirmedCost set to that exact price returns a one-time link for the ACCOUNT OWNER to confirm — their yes, not the assistant's; a plain third call with the same arguments runs once at that price. A moved price is re-quoted, never charged.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
repoUrlYesGitHub repository URL or owner/repo. A private repo needs a githubToken.
moduleKeyYesThe module's key, e.g. 'secret-scan', 'dependency-cve', 'security', 'privacy', 'gdpr'.
githubTokenNoOptional read-only GitHub token. Without one, only public repos are reachable.
authorizationNoHUMAN CONFIRMATION. The `authorization` id from the confirm-link answer, once the account owner has pressed Confirm. Single-use, short TTL.
confirmedCostNoCOST CONFIRMATION. Omit on the first call; then send back the exact quoted `cost`.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed7 schema fields changed
    • changedInput schema / properties / authorization / description
      Previous value: -"HUMAN CONFIRMATION. Omit until the account owner has pressed Confirm on the link a paid tool answered with; then set to that answer's `authorization` id (single-use, short TTL). Protocol: server instructions."New value: +"HUMAN CONFIRMATION. The `authorization` id from the confirm-link answer, once the account owner has pressed Confirm. Single-use, short TTL."
    • changedInput schema / properties / confirmedCost / description
      Previous value: -"COST CONFIRMATION. Omit on the first call (it only quotes); then set to the exact `cost` object quoted. A moved price is re-quoted, never charged. Protocol: server instructions."New value: +"COST CONFIRMATION. Omit on the first call; then send back the exact quoted `cost`."
    • changedInput schema / properties / confirmedCost / properties / centicredits / description
      Previous value: -"Copy the `centicredits` integer from the cost this tool quoted you, if it has one. Omit it if the quote did not carry one."New value: +"The `centicredits` integer from the quoted cost, if it carried one."
    • changedInput schema / properties / confirmedCost / properties / credits / description
      Previous value: -"Copy the `credits` number from the cost this tool quoted you."New value: +"The `credits` number from the quoted cost."
    • changedInput schema / properties / confirmedCost / properties / kind / description
      Previous value: -"Copy the `kind` from the cost this tool quoted you, e.g. 'credits'."New value: +"The `kind` from the quoted cost, e.g. 'credits'."
    • changedInput schema / properties / githubToken / description
      Previous value: -"Optional GitHub personal access token (read-only) for private repos. If omitted, only public repos are accessible."New value: +"Optional read-only GitHub token. Without one, only public repos are reachable."
    • changedInput schema / properties / repoUrl / description
      Previous value: -"GitHub repository URL or owner/repo string, e.g. https://github.com/owner/repo or owner/repo. Private repos require a githubToken."New value: +"GitHub repository URL or owner/repo. A private repo needs a githubToken."
  2. Added

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Thoroughly discloses side effects and prerequisites: requires an API key, can charge credits, first call quotes a price, second call confirms with a human-owned link, third call actually runs. This goes well beyond the annotations and gives an agent a realistic picture of multi-call, cost-bearing behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is informative but repetitive, especially the COSTS MONEY section which restates the three-call flow after already explaining deep-tier costs. The ALL-CAPS emphasis and repeated clauses make it longer than necessary, though the content is relevant.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers prerequisites, cost behavior, human confirmation, and private-repo token needs. There is no output schema and the description does not describe the final successful response shape beyond 'scanner evidence', but the essential operational context for calling the tool correctly is present.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema already covers all parameters at 100%, and the description adds important meaning to confirmedCost and authorization by explaining the exact quote/confirm/run flow. It also clarifies githubToken's role for private repos. Slightly less direct parameter-by-parameter mapping, but the added cost-confirmation semantics are genuinely useful.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific action: run ONE audit module against a GitHub repository, and clearly distinguishes from whole-repo or scoring tools by saying it never produces scores or verdicts. It also names concrete module keys, so an agent knows exactly what this tool does.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides clear operational guidance: deterministic modules return directly, deep-tier modules require a key and a three-step cost confirmation flow. It does not explicitly contrast with sibling tools like audit_repo or scan_source, but the 'ONE module' wording and protocol details make appropriate usage reasonably clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All nittim toolsInspect
Try in Browser
One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources