# Connect Cyfendo to Replit (one-click MCP setup)

One click to add Cyfendo to Replit Agent.

- Server URL: https://mcp.cyfendo.com/mcp
- Transport: Streamable HTTP
- Sign-in: OAuth is detected automatically. As a fallback, add the header X-Cyfendo-Api-Key with a Cyfendo API key.
- Time: about 1 minute

One-click install: https://replit.com/integrations?mcp=eyJkaXNwbGF5TmFtZSI6IkN5ZmVuZG8iLCJiYXNlVXJsIjoiaHR0cHM6Ly9tY3AuY3lmZW5kby5jb20vbWNwIn0%3D

## Steps

1. Click Add to Replit. Replit opens Settings → Integrations with Cyfendo already filled in.
2. Keep Scan tool output for prompt injection turned on, and click Test & save.
3. Click Authorize Cyfendo. In the window that opens, sign in to Cyfendo and click Allow.
4. Add the instruction below to replit.md so Replit Agent checks risky changes automatically.

New to Cyfendo? Choose Continue with Google to create a free account in the same step. If you sign up with email instead, confirm your email first, then start the connection again from your app.

Adding it by hand? In Replit, open Settings → Integrations → Your integrations, click Add custom, and add an MCP server named Cyfendo with the URL https://mcp.cyfendo.com/mcp.

## Project instruction (paste into replit.md)

```text
## Security checks
Use the Cyfendo MCP server. After edits to login, sessions, permissions, database access, payments, file uploads, API routes or secrets, call cyfendo_check_changes with the changed files. If it reports a confirmed issue, call cyfendo_get_fix, show me the diff, apply it after I agree, then call cyfendo_verify_fix. Call cyfendo_scan_project before I publish.
```

## Try it

- Check that it's connected: "Use Cyfendo to show my security status."
- Check a change: "Check the files you just changed with Cyfendo."
- Before you publish: "Run a full Cyfendo security scan before we publish."

## Good to know

- If the sign-in window doesn't open, your browser blocked the popup: allow popups for replit.com and click Authorize again.
- To use an API key instead of signing in, open Advanced settings → Custom headers and add X-Cyfendo-Api-Key with your key.
- Replit screens tool definitions and planned calls with its security scanner. Cyfendo's tools never change your code; your agent applies fixes after you approve them.

## Troubleshooting

- **The sign-in window doesn't open.** Your browser blocked the popup. Allow popups for your app builder's site, then click the authorize or connect button again.
- **I can't find my personal workspace.** On a business account, your own workspace is your business workspace, so it carries your organization's name. Pick the one marked "your workspace".
- **The connection test fails.** Check the server URL is exactly https://mcp.cyfendo.com/mcp (with /mcp at the end) and, if your app asks, that the transport is HTTP (Streamable HTTP), not SSE.
- **A check stays "running".** Proving an attack takes a few minutes. Your agent asks Cyfendo for the result in its next step; you can also follow the scan in your Cyfendo dashboard.

More guides: https://cyfendo.com/docs/mcp