# Connect Cyfendo to Replit

One click to add Cyfendo to Replit Agent.

- Server URL: https://mcp.cyfendo.com/mcp
- Transport: Streamable HTTP
- Sign-in: OAuth is detected automatically. As a fallback, add the header X-Cyfendo-Api-Key with a Cyfendo API key.
- Time: about 1 minute

One-click install: https://replit.com/integrations?mcp=eyJkaXNwbGF5TmFtZSI6IkN5ZmVuZG8iLCJiYXNlVXJsIjoiaHR0cHM6Ly9tY3AuY3lmZW5kby5jb20vbWNwIn0%3D

## Steps

1. Click Add to Replit. Replit opens Settings → Integrations with Cyfendo already filled in.
2. Keep Scan tool output for prompt injection turned on, and click Test & save.
3. Click Authorize Cyfendo. In the window that opens, sign in to Cyfendo and click Allow.
4. Add the instruction below to replit.md, the file Replit Agent reads on every request (the clicks are listed with the instruction). On the first check, Cyfendo gives the project its own ID and the agent saves it in cyfendo.json.
5. Start a new Agent chat so Replit Agent picks up the instruction.

New to Cyfendo? Choose Continue with Google to create a free account in the same step. If you sign up with email instead, confirm your email first, then start the connection again from your app.

Adding it by hand? In Replit, open Settings → Integrations → Your integrations, click Add custom → Add personal MCP server, name it Cyfendo and enter the URL https://mcp.cyfendo.com/mcp.

## Project instruction (paste into replit.md)

How to add it in Replit:

1. Click Copy on the instruction below.
2. Open your Replit App. At the very top right, just right of the blue Publish button, click the sidebar button (a rectangle with a line down its right side). The Library sidebar opens: select its Files tab.
3. Click replit.md to open it, or type replit.md in Search files. It's at the top level of the project, not inside a folder.
4. Scroll to the very end of the file, after the last section, and paste the instruction on a new line as a section of its own. Don't paste it inside an existing section such as User preferences or Gotchas: Replit Agent fills those in as it builds and could overwrite it. Replit saves your changes automatically.
5. Check that the file now ends with the Security checks (Cyfendo) section and its four bullet points.

- No replit.md, or prefer not to edit files? Send Replit Agent the message “Add this to replit.md at the root of the project, word for word (create the file if it doesn't exist):” followed by the instruction.
- To use it in every Replit project instead, paste it into Settings → Customization → Instructions and click Save changes.

```text
## Security checks (Cyfendo)
Cyfendo identifies this project by the project_id in cyfendo.json at the project root. Pass it in every Cyfendo call. If the file doesn't exist, the first check or scan creates the project: save the project_id it returns to cyfendo.json.
- At the start of each of my requests, call cyfendo_status and tell me about any earlier_results before doing anything else.
- When you finish a task that changed login, sessions, permissions, database access, payments, file uploads, API routes or secrets, call cyfendo_check_changes once with all the files the task changed and a short label. Don't wait for the result.
- For a confirmed issue that is still current, fix it as its fix_steps describe, or call cyfendo_generate_fix and then cyfendo_get_fix for Cyfendo's tested patch and show me the diff before applying it. Then call cyfendo_verify_fix.
- When I say I'm getting ready to publish, call cyfendo_scan_project and tell me when it has finished.
```

## Try it

- Check that it's connected: "Use Cyfendo to show my security status."
- Check a change: "Check the files you just changed with Cyfendo."
- Collect finished results: "Collect any Cyfendo results that are ready."
- Before you publish: "I'm getting ready to publish. Run a full Cyfendo security scan."

## Replit app security

### Is my Replit app secure?

Replit Agent writes and deploys a full app, often with a database, sign-in and API routes. Whether it's secure depends on that code: whether every route checks who is calling, whether users can reach each other's data, and whether secrets stay in Replit's Secrets instead of the code.

### Doesn't Replit already have a security scanner?

Yes. Replit checks your packages for known vulnerabilities for free, and on paid plans its Security Agent reviews your source code before you publish; a deeper level also tests the running app from the outside. Replit's own documentation says a scan isn't a complete security review. Cyfendo checks each risky change as Agent builds and proves what it reports with a safe attack in an isolated sandbox, so it works alongside Replit's scans.

### What does Cyfendo find that a pattern scan misses?

Flaws in your app's own logic: a route that returns another user's records, an admin action any signed-in user can call, a webhook that trusts whatever it's sent. No rule matches these, because the code looks normal. Cyfendo shows them by trying the attack.

## Good to know

- Each project gets its own Cyfendo project ID on its first check, and the agent saves it in cyfendo.json for you: don't create that file yourself. If you remix, fork or duplicate a project, delete cyfendo.json in the copy (or ask the agent to), so the copy starts its own check history instead of adding to the original's.
- Replit Agent also edits replit.md as it learns about your project. Now and then, check that the Security checks (Cyfendo) section is still at the end of the file. If Agent keeps removing it, put the instruction in Settings → Customization → Instructions instead, which Agent doesn't change.
- Checks run in the background for several minutes while Replit Agent keeps working. The agent can only report a result when you send it a message, so Cyfendo notifies you when a check finishes. Then send any message, or "Collect any Cyfendo results that are ready."
- Full scans: if your Repl is connected to a GitHub repository (Replit's Git tool) and that repository is connected in Cyfendo (Settings → Integrations → Git), the agent asks Cyfendo to scan the repository directly, whatever its size. Without it, or if Cyfendo can't read the repository, the agent uploads the source files in parts of up to 50 files, which takes longer and uses more of your Replit Agent usage.
- If the sign-in window doesn't open, your browser blocked the popup: allow popups for replit.com and click Authorize again.
- If Replit asks you to confirm a Cyfendo tool before it runs, approve it so the check can start.
- If Replit's Manage screen says the server no longer exists, remove Cyfendo from Your integrations and add it again with Add to Replit. Your findings and check history stay in your Cyfendo workspace.
- To use an API key instead of signing in, open Advanced settings → Custom headers and add X-Cyfendo-Api-Key with your key.
- Replit screens tool definitions and planned calls with its security scanner. Cyfendo's tools never change your code; your agent applies fixes after you approve them.

## Troubleshooting

- **The sign-in window doesn't open.** Your browser blocked the popup. Allow popups for your app builder's site, then click the authorize or connect button again.
- **I can't find my personal workspace.** On a business account, your own workspace is your business workspace, so it carries your organization's name. Pick the one marked "your workspace".
- **The connection test fails.** Check the server URL is exactly https://mcp.cyfendo.com/mcp (with /mcp at the end) and, if your app asks, that the transport is HTTP (Streamable HTTP), not SSE.
- **A check stays "running".** Proving an attack takes several minutes, so checks run in the background. Your agent can only report a result when you send it a message: Cyfendo notifies you when a check finishes, then send your agent "Collect any Cyfendo results that are ready." A check stops testing after about 15 minutes and reports what it has.

More guides: https://cyfendo.com/docs/integration