Prototype · Preview: every server in the official registry, synced every 30 minutes. Reviews and accounts come in a later step.
PopNx MCPMCP servers for people who use AI · explained in plain words

nittim

by ilanwolbergerversion 1.1.0i★ –iRuns in the cloud
Registry namecom.nittim/nittim

Install

Overview

Description from the maker (original English)

Production-safety audits for AI-generated code, with a fix for every finding.

PopNx MCP’s three pillars

These three are never merged into one score: opinions, measurements and popularity are different things.

What you can do with it

We have not written a plain-language summary for this one yet. Below are the facts we read from the registry.

  • Connection: Runs in the cloud
  • Transport: Streamable HTTP
  • Category: Developer tools

Install

Pick the AI app you use, then copy the settings.

Before you install

You need

Which app do you use?

Pick your app above. We remember it, so next time the button says “Install in …”.

Works in Claude on the web, desktop and mobile:

  1. Open Settings → Connectors
  2. Press Add custom connector
  3. Paste the address below and press Add
  4. If it asks you to sign in, sign in with the maker
SettingsConnectors1+ Add2https://…3
https://nittim.com/api/mcp

Run this in your terminal

claude mcp add --transport http nittim https://nittim.com/api/mcp

Open in Cursor

Or copy the settings yourself

Paste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json

{
  "mcpServers": {
    "nittim": {
      "url": "https://nittim.com/api/mcp"
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

Open in VS Code

Or copy the settings yourself

Paste into .vscode/mcp.json in your project

{
  "servers": {
    "nittim": {
      "type": "http",
      "url": "https://nittim.com/api/mcp"
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

ChatGPT connects only to servers on the internet:

  1. Open ChatGPT on the web → Settings → Connectors (Apps)
  2. Press Create or Add (some plans need Developer mode under Advanced first)
  3. Paste the address below, give it a name and save
  4. If it asks you to sign in, sign in with the maker
SettingsConnectors1+ Create2https://…3
https://nittim.com/api/mcp

Menu names can differ slightly by plan and over time.

Your choice stays on this device in a cookie; no account needed.

These settings are generated from the maker’s registry entry. If the README says otherwise, follow the README.

What it can do

Tool names and descriptions exactly as the server reported them on Nov 9, 2026. The maker wrote them, not us; we show them as plain text.

  • audit_repo

    Paid nittim AI audit of a GitHub repository: one structured pass over the highest-signal source; the only tool here that returns scores and a verdict. Answers with the audit's id, not the report. `fullScan: true` buys the wider Full Audit tier. NEEDS A KEY: mint one at https://ni

  • audit_source

    Paid nittim AI audit of source files you post, for a project with no GitHub remote. Send SOURCE files, not build output — no node_modules or dist. On nittim's own key this answers with the audit's id; the report lands Usually within 15 minutes*. * Most reports land within 15 minu

  • scan_source

    Free nittim look: committed secrets and known CVEs over posted source files. No account, no key, no nittim credits. Hard evidence only: never scores, never a production verdict. Send SOURCE files, not build output (no node_modules, no dist, no binaries).

  • estimate_audit

    Price an audit before buying one: give a GitHub repository URL, or a manifest of paths and byte sizes — no file content, nothing uploaded — and get the tier (Audit or Full Audit), the pass count and the exact price. No account or key is needed: it never charges, runs no audit, ca

  • get_audit

    Retrieve a nittim audit by its UUID, at any stage: the finished markdown digest (verdict, scores, top findings) plus its report link, or — no error, nothing charged — that it is still running, or why it failed and what happened to the charge. Free. An audit of a public repository

  • verify_fix

    NEEDS A KEY: mint one at https://nittim.com/keys. Re-checks ONE finding from a finished audit against the repository's current code, or a commit named in the call, and answers fixed, still present, or undetermined — with the reason. It reads only the file that finding cites. Free

  • list_modules

    List every audit module nittim can run: the two deterministic scanners (secret scan + OSV dependency CVE check) and the LLM-reasoned checks. Returns each module's key, tier, and a plain-English description of what it checks. Each module's key identifies it for running individuall

  • get_loop

    Returns the current text of nittim's free, tool-agnostic self-review checklist — the same content served at https://nittim.com/selfcheck.md. Reviews a codebase against the public shape of nittim's 13-category Priority Framework, plus a 14th on what the code gives away, and states

  • describe_protocol

    How this server works, in full: how a paid call quotes and charges, the two audit tiers, the Nittim Loop and its reward rules and caps, and dispute guidance. Free, no key, no charge, no side effects — it reads static text and calls no model. `section` picks one page; omitted, it

  • mint_key

    For a client that cannot sign in over OAuth: a short, one-time link to https://nittim.com/keys/claim/ . Opening it, signed in, mints a real nittim API key and shows it once — the key itself is NEVER returned by this tool or by any other MCP result. The link expires in a few minut

  • run_module

    Run ONE nittim audit module against a GitHub repository, never producing scores or a verdict. The two deterministic modules (secret-scan, dependency-cve) return scanner evidence directly, free, with nothing to confirm. Deep-tier modules make one focused model call, cost 5.03 cred

  • judge_output

    Run a cross-vendor judge model over any text you post: code, a document, another model's output, anything. Returns findings + rationale ONLY — never a score, never a pass/fail verdict. Costs 5.03 credits. The judge always comes from a different vendor family than whatever produce

  • dispute_finding

    NEEDS A KEY: mint one at https://nittim.com/keys. Records that a finding from a prior audit is wrong (stance:'dispute') or genuinely real (stance:'confirm'), backed by evidence from the repo. Free. A SIGNAL for owner triage — it never changes the audit's scores, verdict or stored

  • report_loop

    NEEDS A KEY: mint one at https://nittim.com/keys. Records anonymised counts from a Nittim Loop the developer has finished and agreed to send: pass numbers, a findings-by-category tally, a fixed count, and whether each pass was clean. Counts only — never a title, file path or snip

  • preview_upload

    NEEDS A KEY: mint one at https://nittim.com/keys. Send the paths and sizes of the files you would post — no content leaves your machine to ask this — and get back the list, the byte count, and a link for the account owner to approve it. Free. The approval covers that file list an

Basic checksi

We check information anyone can see; we have not read the code. Checks that do not apply are left out of the count. · Checked Nov 10, 2026

  • ✓ Pass

    Maker matches the repo

    The registry name was verified against the domain nittim.com (the registry checks domain ownership)

  • … Not checked yet

    Still maintained

    We have not read this repo from GitHub yet

  • … Not checked yet

    Has a licence

    We have not read this repo from GitHub yet

  • ✓ Pass

    Endpoint responds

    Responded in 267 ms (HTTP 200)

  • – Not applicable

    Sign-in with OAuth

    No sign-in needed

  • ✓ Pass

    No hidden instructions in tool descriptions

    Read 15 tool descriptions and found no hidden instructions to the AI

Compared with others in Developer toolsi

  • More stars than 0% of the other 5616 servers in this category
  • Published to the registry more recently than 36% of the other 5616 servers in this category
  • Basic checks equal to or better than 100% of the other 5616 servers in this category

Compared with every active server in this category in the registry. Stars count only when the publisher owns the repo.

Common questions

Is nittim safe?

It passed 3 of 3 applicable basic checks. We have not read the code. Before adding a key or token, see what access the server asks for and use a key with only the permissions you need.

What keys or codes does it need?

The registry does not list a required key, though some servers ask you to sign in on first use.

Does it run on my computer or in the cloud?

It runs in the maker’s cloud. Connect over the internet with nothing to install, but what you send passes through the maker’s servers.

Is it still maintained?

The GitHub repo last changed –, and the latest version (1.1.0) reached the registry 2 months ago.

Which apps can use it?

Apps that support MCP, such as Claude Desktop, Claude Code, Cursor and VS Code. It connects by URL, so apps that accept remote MCP servers work too, such as ChatGPT in developer mode.

What can I use instead?

In the same category: GitHub, Desktop Commander, Cloudflare MCP

Alternatives

Servers in the same category from other makers, sorted by stars.

Reading a card:↓ Downloads per weeki★ GitHub starsiThree pillars: reviews · checks · usageiUpdated = latest version published to the registryi

GitHub

GitHub’s official server lets AI read and manage code, issues and pull requests in your account. Use GitHub’s hosted version or run it locally with Docker.

by githubWidely used★ 34.2KUpdated 7 days ago

Computer or cloud

Desktop Commander

MCP server for terminal commands, file operations, and process management

by wonderwhy-erWidely used↓ 709.6K/wk★ 10.2KUpdated 19 days ago

Runs on your computer

Cloudflare MCP

Cloudflare MCP servers

by cloudflareWidely used★ 4.4KUpdated 14 months ago

Runs in the cloud✓ mcp.cloudflare.com

README from the maker

Open the README

Copied from the maker’s repo as written. PopNx MCP has not reviewed or endorsed it. HTML, images and scripts are removed. Links lead off this site.

nittim MCP

nittim audits code before it ships.

Connect over MCP and your agent can:

  • Scan a repo or a handful of posted files for committed secrets and known vulnerable dependencies — free, no key needed.
  • List every check nittim runs, in plain English.
  • Read the free self-review checklist (get_loop) — free, no key needed.
  • Price a GitHub repo or a set of files before anything runs — free, no upload required.
  • Run a full audit and get back a verdict — Production Ready, Production Ready with Conditions, High Risk, or Not Safe — with security, privacy, reliability, and architecture findings, each paired with a fix.
  • Get a second opinion on any piece of work from an independent judge.
  • Flag a finding that looks wrong, for a person to review.

A paid audit quotes its price before it runs. Nothing is charged until you confirm.

Try it in 30 seconds

Connect (below), then ask your agent:

Run nittim's get_loop and review this repo against it.

That reads the free checklist and reviews your code on your own model. Nothing is uploaded and no key is needed. Or ask it to scan_source a file for committed secrets and vulnerable dependencies. Also free.

Connect

Claude Code, as a plugin (adds the server and the nittim-loop skill):

/plugin marketplace add ilanwolberger/nittim-mcp

/plugin install nittim@nittim

or just the server:

claude mcp add --transport http nittim https://nittim.com/api/mcp
Using Claude Code's auto mode?

Auto mode refuses any tool it reads as able to spend money before that tool runs. nittim's paid tools always quote a price first, and every charge waits for the account owner's click on a confirmation link — so allowing the server never lets an assistant spend on its own. Add this to ~/.claude/settings.json (or your project's .claude/settings.json):

{ "permissions": { "allow": ["mcp__nittim"] } }

The rule name follows whatever you called the server in claude mcp add — it's mcp__ if you picked something other than nittim. The free tools (scan, estimate, checklist) work without this rule.

Cursor or VS Code: the buttons at the top, or nittim → https://nittim.com/api/mcp in your MCP settings.

Or add it to any MCP client as:

{

"nittim": { "type": "streamable-http", "url": "https://nittim.com/api/mcp" } }

The free tools work right away, no account needed. Paid tools need a key — mint one at nittim.com/keys.

Skills

skills/nittim-loop is a free, local self-review — it walks your assistant through nittim's public checklist over a repository you own, on your own model, with nothing uploaded. It reads the checklist via the get_loop MCP tool when one is connected, or by fetching https://nittim.com/selfcheck.md directly otherwise.

Claude Code — install the plugin (see Connect above), then run /nittim:nittim-loop inside a project you want reviewed. Or install the skill on its own, available in every project:

mkdir -p ~/.claude/skills/nittim-loop && curl -fsSL https://nittim.com/skills/nittim-loop/SKILL.md -o ~/.claude/skills/nittim-loop/SKILL.md

Cursor — the same checklist as a project rule (skills/nittim-loop/nittim-loop.mdc), also served live at https://nittim.com/skills/nittim-loop/nittim-loop.mdc:

mkdir -p .cursor/rules && curl -fsSL https://nittim.com/skills/nittim-loop/nittim-loop.mdc -o .cursor/rules/nittim-loop.mdc

Any other MCP client — call the get_loop tool directly; no install needed.

Learn more

Full reference, for people and for agents: nittim.com/agents


Listed on Smithery, Glama, cursor.directory and the MCP Registry.

This repository holds the listing manifests for nittim's MCP server, all pointing at the live endpoint above: Open Plugins (plugin.json, .mcp.json), the MCP Registry (server.json), a Claude Code plugin and marketplace (.claude-plugin/), and the nittim-loop skill (SKILL.md for Claude Code, nittim-loop.mdc for Cursor). It carries no other application code. scripts/gate.sh checks the repo's own consistency — manifests agree, both skill copies identical, every URL above resolves — and hooks/pre-push runs a secret scan before anything reaches GitHub (git config core.hooksPath hooks once per clone).

Ask PopNx