Questions worth answering plainly

A secret key (nittim_sk_…) is what CI, scripts and your own MCP config use — the full API surface, scopable to an organization, named so you can tell one integration from another, and revocable in one click. Keep it server-side, the same way you would any other secret.A secret key (nittim_sk_…) is the private password your own tools and scripts use to act as you — it can do everything your account can, you can name each one so you know what it’s for, and you can switch any one off in a single click. Keep it where only you can see it, like any password.Use a secret key (nittim_sk_…) in CI, scripts and your MCP config — full API access, scoped per integration, revocable anytime. Keep it server-side.

A publishable key (nittim_pk_…) is for a place that is world-readable by design — a team’s shared assistant config, a .mcp.json checked into the repo and read by every teammate and by CI. It can only list modules and call the judge, spends the issuer’s credits up to a per-key cap its owner sets, and revokes just as instantly.A publishable key (nittim_pk_…) is the one that’s safe to share — for example in a settings file a whole team can see. It can only do two harmless things: list the checks and ask for a second opinion. It spends the owner’s credits only up to a limit the owner sets, and it can be switched off just as instantly.A publishable key (nittim_pk_…) is safe to check into a shared .mcp.json — it can only list modules and call the judge, spends the issuer's credits up to a set cap, and revokes instantly.

The same idea as Stripe’s pk_… or Supabase’s anon key: a distributable credential with a narrow, capped blast radius, sitting beside a secret one that never leaves your own systems.The same idea many well-known services use: one shareable key that can do very little damage, next to one secret key that never leaves your own computers.Like Stripe's pk_… or Supabase's anon key — narrow blast radius, next to a secret key that stays on your systems.

GitHub’s ghp_, Stripe’s sk_live_, AWS’s AKIA — a readable prefix is what lets a secret scanner recognize a credential by pattern instead of by guessing at entropy alone. nittim is itself a secret scanner, and it detects its own leaked nittim_sk_… keys the same way it flags anyone else’s. The prefix is a label; the random part after it carries all the entropy.Every nittim key starts with a readable label like nittim_sk_ — the same trick GitHub, Stripe and Amazon use. The label is what lets scanning tools spot a key that ended up somewhere public and raise the alarm. nittim itself scans code for leaked keys, and it catches its own the same way it catches anyone else’s. The label is just a name tag; the random part after it is the actual secret.nittim scans for leaked keys, including its own nittim_sk_… ones. The prefix is a label — the random part carries the entropy.

List every check the audit engine can run, each with a plain-English description of what it looks for. Same copy as the public What we check page. A guest with no key can call this too.

Price: free. Same copy as What we check.Price: free. It’s the same list you can read on What we check.Price: free. Same list as What we check.

An agent hands over a work product — code, a plan, a claim — and an independent, version-pinned model from a different lab than the one that produced the work grades it. The point is that a model never grades its own homework: an agent that wrote the code and an agent that reviews it are not independent just because they run in different turns, so the judge is deliberately a different vendor’s model, pinned to one version so a provider’s own upgrade can never quietly move the ruler underneath a comparison.Your AI assistant hands over a piece of work — code, a plan, a claim — and a completely separate AI, made by a different company than the one that produced the work, reviews it. The point is that no AI should grade its own homework. The judge is also locked to one fixed version, so a silent upgrade at the AI company can never quietly change the measuring stick between two comparisons.An agent hands work — code, a plan, a claim — to an independent, version-pinned model from a different lab, which grades it. No model grades its own work: the judge is a different vendor’s model, pinned to one version, so an upgrade can’t quietly change the ruler.

Hand over any work product — code, a plan, a claim — and an independent judge grades it: a version-pinned model from a different lab than the audit model, so an agent never has to grade its own homework. Returns severity-tagged findings and a rationale — never a score, never a verdict.

Price: 5.03 credits per call. It never returns a score or a verdict — only severity-tagged findings and a rationale for a person or agent to weigh. The scores and verdict on an audit report always come from the audit’s own pipeline, never from the judge.Price: 5.03 credits per call. It never hands back a grade or a pass/fail — only a list of problems, each marked by how serious it is, with the reasoning, for you or your assistant to weigh. The scores and verdict on an audit report always come from the audit itself, never from the judge.Price: 5.03 credits per call. No score or verdict — only findings and reasoning. Scores and the verdict always come from the audit itself, never the judge.

Model Context Protocol is the open standard that lets an AI coding assistant call a tool server’s functions the same way it already calls the tools built into your editor — no browser tab, no pasting a diff into a chat window. nittim speaks MCP over one HTTPS endpoint; connecting is one command, and the free tools (scan_source, list_modules) work with no account and no key at all — an account only becomes necessary the moment a tool would spend money.Model Context Protocol is an open standard that lets an AI assistant use outside services as if they were built into it — no browser tab, no copy-pasting code into a chat window. Connecting your assistant to nittim is one command, and the free tools — the code scan and the list of checks — work with no account and no key at all. An account only becomes necessary the moment something would cost money.MCP lets your coding assistant call outside tools directly — no browser tab, no pasting diffs. nittim speaks MCP over one HTTPS endpoint; connect with one command. scan_source and list_modules work with no account or key — you only need one once a tool would spend money.

The free scan is deterministic only — committed secrets and known vulnerable dependencies, no model call involved, ever. No card, no sign-in, no cap on honest use. It previews what the deeper categories would check, but it issues no verdict: deterministic facts, never a verdict.The free scan runs fixed, rule-based checks only — passwords left in your code and known security bugs in the ready-made packages you use. No AI, no card, no sign-in, no limit on honest use. It shows what the deeper audit would look at, but it never issues a verdict: facts, not judgment.The free scan checks only committed secrets and known vulnerable dependencies — no model, no card, no sign-in, no cap. It previews the deeper categories; no verdict.

Audit is your first Audit is free. After that, about $5. It reads the repository’s highest-signal source in one structured, model-reasoned pass — up to two, at the same price, if the plan needs a second — and produces the six scores plus a verdict. Your covered Audit reads the files that matter most, in a single pass. A paid Audit reads more of your code, across two.Audit is your first Audit is free. After that, about $5. The AI reads the most important parts of your project — the files most likely to hide real problems — and produces the six scores plus a verdict. Your covered Audit looks at the files most likely to hide a real problem, in one pass. Pay for one and it reads more of your project, across two.Audit is your first Audit is free. After that, about $5. It reads your repo’s highest-signal source in one pass — up to two at the same price — and returns the six scores plus a verdict. Covered Audit: the files that matter most, one pass. Paid: more of your code, two passes.

Full Audit reads every eligible file in the repository instead of the highest-signal subset, priced by how many passes that takes. A repository too large to sell as Full Audit at any price is refused up front, with the way to trim it — never a partial pass quietly sold as the full one.Full Audit reads every file that can be read, not just the most important ones, and the price depends on how much reading that takes. A project too large to read in full is told so up front, with advice on how to trim it — you are never quietly sold a partial read as the full one.Full Audit reads every eligible file, priced by how many passes it takes. Too large to price at all? You’re told up front, with how to trim it — never sold a partial pass as full.

A run that stops short of what you paid for because of something on our side or our model provider’s — never because your repository is simply bigger than what you bought, which is priced and delivered as the plan working as intended — delivers whatever already landed (real passes, real evidence; there is no reason to discard them) and returns the entire charge, not a prorated share of it. Credits never expire · unused credits refundable within 30 days. Unused, prepaid credits are refundable the same way if you simply change your mind. An automatic refund can be held for a day’s manual review once an account crosses 3 auto-refunds in a day — you hear back within a day, not silence.If a run stops short because of a problem on our side or our AI provider’s, you keep everything that did finish — real results are never thrown away — and the entire payment comes back, not a portion of it. Credits never expire · unused credits refundable within 30 days. Unused, prepaid credits can be refunded the same way if you simply change your mind. If an account triggers more than 3 automatic refunds in one day, the next one waits for a quick human look — and you hear back within a day, not silence.If a run stops short because of our side or our model provider’s — never because your repo is simply bigger than what you bought — you keep whatever landed and get the entire charge back, not a prorated share. Credits never expire · unused credits refundable within 30 days. Unused prepaid credits refund the same way if you change your mind. More than 3 auto-refunds in a day holds the next one for a quick human review — you hear back within a day.

“Eligible” means plain source and config text under this audit’s read budget, once build output, binaries, and vendored dependencies are filtered out — not literally every byte in the repository. Full Audit walks every eligible file; Audit reads the highest-signal subset of them. When a run had to leave eligible files unread — a repository past the size a single run reads — the report says so honestly rather than letting a partial pass read as a finished one; a claim that “every file in this repository can be audited” is only ever made when it’s literally true.“Eligible” means the files a person would actually read — your code and settings — after generated files, images and third-party packages are set aside. Full Audit reads every eligible file; Audit reads the most important ones. When a run couldn’t read everything, the report says so plainly instead of letting a partial read look finished — the claim “every file can be audited” is only ever made when it’s literally true.“Eligible” means source and config text, after generated files and dependencies are filtered out — not every byte in the repo. Full Audit walks every eligible file; Audit reads the highest-signal subset. When a run can’t read everything, the report says so — “every file audited” is only claimed when true.

This is exactly what nittim.com/trust exists to answer in full, byte by byte, rather than a shorter and necessarily looser version repeated here — read it before sending anything you’d rather keep private.This is exactly what nittim.com/trust exists to answer in full — a shorter version here would only be a looser one. Read it before sending anything you’d rather keep private.Read nittim.com/trust for the full, byte-by-byte answer — before sending anything you’d rather keep private.

Every finding on a report carries a “Dispute this finding” control. Say what the code actually does and why the finding is wrong; a human reviews it and marks it upheld or rejected, and either way you see the outcome on the report. An upheld dispute — a confirmed false positive — earns 1 credit back, up to what that report cost you. And whoever filed the winning dispute — you, or your own AI agent over MCP — is paid in credits for the catch, more when it exposed a flaw in the pipeline itself. We pay people to prove us wrong.Every finding on a report carries a “Dispute this finding” button. Explain what your code actually does and why the finding is wrong; a person reviews it and marks it accepted or rejected, and either way you see the outcome on the report. If your challenge is accepted — the finding really was wrong — 1 credit comes back, up to what that report cost you. And whoever filed the winning challenge — you, or your own AI assistant — is paid in credits for the catch, more when it uncovered a flaw in how our checks work. We pay people to prove us wrong.Every finding carries a “Dispute this finding” control. Say why the finding is wrong; a human reviews it and marks it upheld or rejected — you see the outcome either way. An upheld dispute earns 1 credit back, up to what the report cost. Whoever filed the winning dispute — you or your agent — gets paid in credits, more for exposing a pipeline flaw.