Replit

Replit Agent is a browser-based AI coding agent. MCP servers are added as custom connectors from the Integrations pane, and Perfai Cloud connects as a remote streamable-http server with a custom Bearer header.

Replit connects MCP servers at the account level, not per project — a server you add once is available to Agent across every Repl you build, and Agent fetches the tool list itself.

Generate your Bearer token

The value Replit needs is a PerfAI Token (id_token which is a JWT).

id_tokens are short-lived. If Agent later reports the connector failing after previously working, your token has likely expired — generate a fresh one with either method below and update the connector.

macOS / Linux
Windows (PowerShell)

read -s -p "PerfAI password: " PERFAI_PASSWORD; echo
curl -s -X POST "https://api.perfai.ai/api/v1/auth/token" \
  -H "Content-Type: application/json" \
  -d "{\"username\":\"you@example.com\",\"password\":\"$PERFAI_PASSWORD\"}" \
  | grep -o '"id_token":"[^"]*"' | cut -d'"' -f4

read -s masks the password prompt so it never lands in your shell history. Copy the printed id_token value in full.

$cred = Get-Credential -UserName "you@example.com" -Message "PerfAI password"
$body = @{ username = $cred.UserName; password = $cred.GetNetworkCredential().Password } | ConvertTo-Json
$resp = Invoke-RestMethod -Uri "https://api.perfai.ai/api/v1/auth/token" -Method Post -Body $body -ContentType "application/json"
$resp.id_token

Get-Credential masks the password prompt and, unlike a plain double-quoted string, won’t let PowerShell mangle special characters ($, `, ") in your password. Copy the printed id_token value in full — it wraps across multiple terminal lines, but that’s just visual wrapping, not truncation.

Copy the resulting string — you’ll paste it into Replit’s authentication field as Bearer <id_token>, or into a bare token field exactly as-is depending on how Replit’s form is laid out.

Installation

Open any Repl and go to the Integrations pane.
Scroll to MCP Servers for Replit Agent and click Add MCP server.
Paste the endpoint:
- URL: https://mcp-server.perfai.ai/mcp
In the authentication section, add a header:
- Header name: Authorization
- Header value: Bearer <id_token>
Optionally test a read-only endpoint (like auth_status) before saving, then save.

Credentials go in the authentication fields only — never in the connector’s description or in Agent instructions, since those are visible in plain text.

Verify the server is connected

Reopen the Integrations pane and find perfai-cloud under your connected MCP servers.
It should show as connected with 19 tools discovered.
If it fails, re-check the header value for trailing whitespace, and make sure the token hasn’t expired (generate a fresh id_token if it has).

The prompts below run inside Replit Agent’s chat, not your terminal. The only setup step outside the chat is adding the connector above.

In Agent’s chat, with the connector enabled, type:

Login to Perfai

This calls login with no arguments. Confirm the session with:

What's my Perfai auth status?

Register an app and run a scan

Register https://your-app.example.com with Perfai

Check the onboarding status for that app

Run a security test on the selected app

Show me the vulnerabilities it found

Fix and verify

Generate an auto-fix plan for all critical and high findings

Mark vulnerability 3 as fixed

Give me the fix summary

Getting Started

Core Concepts

Hybrid Deployment

Changelog

Generate your Bearer token

Installation

Verify the server is connected

Register an app and run a scan

Fix and verify

​Generate your Bearer token

​Installation

​Verify the server is connected

​Login

​Register an app and run a scan

​Fix and verify

Generate your Bearer token

Installation

Verify the server is connected

Login

Register an app and run a scan

Fix and verify