Questions worth answering plainly

Use a secret key (nittim_sk_…) in CI, scripts and your MCP config — full API access, scoped per integration, revocable anytime. Keep it server-side.

A publishable key (nittim_pk_…) is safe to check into a shared .mcp.json — it can only list modules and call the judge, spends the issuer's credits up to a set cap, and revokes instantly.

Like Stripe's pk_… or Supabase's anon key — narrow blast radius, next to a secret key that stays on your systems.

nittim scans for leaked keys, including its own nittim_sk_… ones. The prefix is a label — the random part carries the entropy.

List every check the audit engine can run, each with a plain-English description of what it looks for. Same copy as the public What we check page. A guest with no key can call this too.

Price: free. Same list as What we check.

An agent hands work — code, a plan, a claim — to an independent, version-pinned model from a different lab, which grades it. No model grades its own work: the judge is a different vendor’s model, pinned to one version, so an upgrade can’t quietly change the ruler.

Hand over any work product — code, a plan, a claim — and an independent judge grades it: a version-pinned model from a different lab than the audit model, so an agent never has to grade its own homework. Returns severity-tagged findings and a rationale — never a score, never a verdict.

Price: 5.03 credits per call. No score or verdict — only findings and reasoning. Scores and the verdict always come from the audit itself, never the judge.

MCP lets your coding assistant call outside tools directly — no browser tab, no pasting diffs. nittim speaks MCP over one HTTPS endpoint; connect with one command. scan_source, list_modules and estimate_audit work with no account or key — you only need one once a tool would spend money.

The free scan checks only committed secrets and known vulnerable dependencies — no model, no card, no sign-in, no cap. It previews the deeper categories; no verdict.

Audit is your first Audit is free. After that, about $5. It reads your repo’s highest-signal source in one pass — up to two at the same price — and returns the six scores plus a verdict. Covered Audit: the files that matter most, one pass. Paid: more of your code, two passes.

Full Audit reads every eligible file, priced by how many passes it takes. Too large to price at all? You’re told up front, with how to trim it — never sold a partial pass as full.

Free, runs on your own model, sends nothing. One sweep with every lens, one fix wave, then loop over the fix diff only — a fix is new code and can break what the old code held up. Stop at two clean passes in a row.

Can’t fan out? A serial loop gets there too, in many more rounds. Checklist: /selfcheck. Shared counts: /loop.

If a run stops short because of our side or our model provider’s — never because your repo is simply bigger than what you bought — you keep whatever landed and get the entire charge back, not a prorated share. Credits never expire · unused credits refundable within 30 days. Unused prepaid credits refund the same way if you change your mind. More than 3 auto-refunds in a day holds the next one for a quick human review — you hear back within a day.

“Eligible” means source and config text, after generated files and dependencies are filtered out — not every byte in the repo. Full Audit walks every eligible file; Audit reads the highest-signal subset. When a run can’t read everything, the report says so — “every file audited” is only claimed when true.

Read nittim.com/trust for the full, byte-by-byte answer — before sending anything you’d rather keep private.

Every finding carries a “Dispute this finding” control. Say why the finding is wrong; a human reviews it and marks it upheld or rejected — you see the outcome either way. An upheld dispute earns 1 credit back, up to what the report cost. Whoever filed the winning dispute — you or your agent — gets paid in credits, more for exposing a pipeline flaw.