Skip to main content
Glama

nittim

by com.nittim

Free Scan of Posted Source (no GitHub repo required)

scan_source
Read-onlyIdempotent

Free nittim look: committed secrets and known CVEs over posted source files. No account, no key, no nittim credits. Hard evidence only: never scores, never a production verdict. Send SOURCE files, not build output (no node_modules, no dist, no binaries).

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
nameYesA display label for this project, e.g. 'my-abacus-app'. Sanitized before use — no path/URL characters needed.
filesYesThe source files to audit, as { path, content }[]. Send SOURCE files, not build output (no node_modules, no dist/build, no binaries) — pre-filter before posting. At most 1000 files; the highest-priority ones (manifests, lockfiles, CI config, .env-shaped files, server-execution routes) win if you're over the internal per-audit cap.
uploadGrantNoThe grant id `preview_upload` returned, once the account owner has confirmed it. Required only for a post larger than the small-upload threshold; a smaller one goes straight through.

Schema Changelog

Changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. First observed

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds useful non-obvious behavior beyond the annotations: it only reports hard evidence, never scores, and never gives a production verdict. However, the claim 'No account, no key' is misleading because the uploadGrant parameter implies account-owner confirmation is needed for larger posts, making the auth-related disclosure incomplete.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two tight sentences with the key selection criteria and exclusions front-loaded. Every clause carries information, with no filler or repetition of schema details.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For an input-focused scan tool, the description covers eligibility, file constraints, and behavioral limits well. It does not describe the exact response format, and with no output schema that is a minor gap, but the 'hard evidence only' framing conveys enough about what the tool will return.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all three parameters. The description adds useful file-filtering guidance (no build output, no binaries) but does not add meaning for the name or uploadGrant parameters beyond what the schema already provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb ('scan'), a specific resource ('posted source files'), and a concrete scope ('committed secrets and known CVEs'). The title's 'no GitHub repo required' and the 'never scores, never a production verdict' line distinguish it from repo-based or deeper audit siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear practical guidance: send SOURCE files, not build output, and lists exclusions like node_modules, dist, and binaries. It does not explicitly route between scan_source and the sibling audit_source/audit_repo tools, but the 'no repo required' and 'free' framing implies the appropriate use case.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All nittim toolsInspect
Try in Browser
RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

A4.3/5.0
Disambiguation4/5

Most tools map to distinct workflow stages: estimate, preview, submit audit, retrieve audit, run module, dispute finding, and judge output. The closest pairs are audit_repo vs audit_source and scan_source vs run_module, but the descriptions provide enough boundary detail for an agent to choose correctly.

Naming Consistency5/5

Every tool follows the same snake_case verb_noun pattern: audit_repo, audit_source, estimate_audit, get_audit, list_modules, run_module, scan_source, and so on. There is no mixing of naming conventions or vague standalone verbs.

Tool Count5/5

11 tools is well-scoped for a paid AI audit service with async delivery, approval flows, and both repo-based and source-based inputs. Each tool covers a distinct step in the audit pipeline without feeling redundant or bloated.

Completeness4/5

The core lifecycle is covered: estimate cost, submit audits, run single modules, check status, retrieve results, and dispute findings. Minor gaps include no way to list past audits, cancel a pending audit, or manage credits directly, though estimate_audit does show the balance.

Resources