MCP integration · Replit

Connect Cyfendo to Replit

One click to add Cyfendo to Replit Agent. Cyfendo reports only vulnerabilities it proves with a safe test attack in an isolated sandbox, and hands Replit's agent a tested fix.

  • 1 min setup
  • Free Cyfendo account
  • Sign in with OAuth
  • Never changes your code
Add to Replit (opens in a new tab)
Server URL https://mcp.cyfendo.com/mcp

Setup · about 1 minute

Set it up

OAuth is detected automatically. As a fallback, add the header X-Cyfendo-Api-Key with a Cyfendo API key.

  1. Click Add to Replit. Replit opens Settings → Integrations with Cyfendo already filled in.

  2. Keep Scan tool output for prompt injection turned on, and click Test & save.

  3. Click Authorize Cyfendo. In the window that opens, sign in to Cyfendo and click Allow.

  4. Add the instruction below to replit.md so Replit Agent checks risky changes automatically.

New to Cyfendo? Choose Continue with Google to create a free account in the same step. If you sign up with email instead, confirm your email first, then start the connection again from your app.

Adding it by hand? In Replit, open Settings → Integrations → Your integrations, click Add custom, and add an MCP server named Cyfendo with the URL https://mcp.cyfendo.com/mcp.

Recommended

Teach your agent when to check

Paste this into replit.md so Replit calls Cyfendo on its own after risky changes.

replit.md 
## Security checks
Use the Cyfendo MCP server. After edits to login, sessions, permissions, database access, payments, file uploads, API routes or secrets, call cyfendo_check_changes with the changed files. If it reports a confirmed issue, call cyfendo_get_fix, show me the diff, apply it after I agree, then call cyfendo_verify_fix. Call cyfendo_scan_project before I publish.

Check it works

Try it

Send one of these to Replit's agent.

  • Check that it's connectedUse Cyfendo to show my security status.
  • Check a changeCheck the files you just changed with Cyfendo.
  • Before you publishRun a full Cyfendo security scan before we publish.

Good to know

  • If the sign-in window doesn't open, your browser blocked the popup: allow popups for replit.com and click Authorize again.
  • To use an API key instead of signing in, open Advanced settings → Custom headers and add X-Cyfendo-Api-Key with your key.
  • Replit screens tool definitions and planned calls with its security scanner. Cyfendo's tools never change your code; your agent applies fixes after you approve them.

Troubleshooting

The sign-in window doesn't open

Your browser blocked the popup. Allow popups for your app builder's site, then click the authorize or connect button again.

I can't find my personal workspace

On a business account, your own workspace is your business workspace, so it carries your organization's name. Pick the one marked "your workspace".

The connection test fails

Check the server URL is exactly https://mcp.cyfendo.com/mcp (with /mcp at the end) and, if your app asks, that the transport is HTTP (Streamable HTTP), not SSE.

A check stays "running"

Proving an attack takes a few minutes. Your agent asks Cyfendo for the result in its next step; you can also follow the scan in your Cyfendo dashboard.

Last updated · View as Markdown