"Replit" matching MCP tools:

• taskbounty_security_checkA

  TaskBountyB

  Scan a PUBLIC GitHub repo for GitHub Actions + CI security/maintenance hygiene before launch — ideal for apps built with Lovable, Bolt, Replit, Cursor, or v0 ("is my AI-built app safe to ship?"). Returns a safe summary: findings by category with counts, an unlisted report URL, and fix options. SCOPE, honestly: it checks GitHub Actions workflow + update-automation hygiene only — it does NOT check exposed secrets, auth, payments, webhooks, or runtime behavior, which need a manual review. No API key required. For PRIVATE repos, tell the user to run `npx taskbounty-check .` locally so their source never leaves their machine.

  ConnectorNo auth

• prepare_design_snapshotA

  TheySaidA

  Creates an upload slot for a self-contained design (HTML) so TheySaid's AI testers can run a usability test on it. Suited to designs without a durable public URL, such as a Claude Design or Artifact. Temporary preview links (for example `claudeusercontent.com`) expire during a test, so they are not suitable as prototypeUrl. Live apps built with v0, Lovable, Bolt or Replit are better tested through their published public URL, because a snapshot of them loses styling. The design HTML is temporarily uploaded to TheySaid. Returns { uploadId, uploadUrl, expiresInSeconds, nextStep }. Upload the HTML (text/html, CSS/JS inlined, large assets on absolute CDN URLs) with one PUT to `uploadUrl`, or with upload_design_snapshot when the environment blocks that host. Then: check_design_snapshot, followed by propose_usability_test(uploadId) for a new test or relaunch_usability_test(projectId, uploadId) to re-test an existing project. This tool does not start a test. Snapshots suit static designs and click-through prototypes; apps that need a live backend or login need a reachable public URL.

  ConnectorOAuth

• ai_app_checkA

  Site CheckA

  Checks an app made with an AI app builder (Lovable, Bolt, v0, Replit, Cursor) for leaks and launch readiness. Use it when the user asks "is my Lovable app secure?", "is my Supabase data public?", "which security headers is my app missing?" or "is my app ready to launch?". Pass the app address. For any public app it returns 8 security headers with the exact lines for the detected host (Vercel, Netlify, nginx and more), and launchList: 20 items of a 160-item launch list read from outside (renewals, mail records, security.txt, caching, legal links), each pass, fail or warn with a fix; checklist true adds the owner-only items with how to check each. The first call also returns ownership_not_proven with a DNS TXT record or file: once the owner publishes it, the next call adds exposed files (.env, .git), masked keys in the shipped JavaScript, source maps, open Supabase or Firebase data, and backend signals. GET only; database checks read status codes and row counts, never a row's data, and never write. Do not use it on an app the user does not own beyond the public checks, for private or local addresses, or to scan many sites.

  ConnectorNo auth

• assess_broken_appA

  VibeFixA

  Triage a problem in a live app built with an AI app builder (Lovable, Base44, Bolt, Replit, v0 or similar). The most common one: new people can't sign up. The confirmation email never arrives, its link opens localhost or the preview, sign-up loops back or shows an error, or Google sign-in fails. It also covers blank pages, buttons that do nothing, payments and data that won't save. Returns the most likely cause, the evidence that would confirm it, and what a fix involves. Call it when someone describes a problem in a web app they built and can't debug themselves. Do NOT call it for code you can read and fix directly, or for a library or framework question.

  ConnectorNo auth

• plan_app_moveA

  TLDMathA

  An ordered, repeat-safe plan for moving an app built in an AI app builder (Lovable, Bolt, Replit, Base44…) to the user’s own host (Vercel, Netlify, Cloudflare Pages, GitHub Pages) on their domain: export the code, keep the data and sign-ins, deploy and copy environment variables, update auth redirect URLs, add the domain, switch DNS (the builder’s records still live that must go, and the new ones, checked against public DNS), verify, then disconnect the builder. If you can read the project, pass dependency names from package.json and variable NAMES from .env.example: never pass values or secrets. Read-only: it changes nothing. Show the steps and ask before running any command; commands prompt for secret values themselves. Call again after the DNS change to confirm, or use plan_dns_setup.

  ConnectorNo auth

• check_app_securityA

  7IT SolutionsA

  Use this when someone asks whether a website or web app is secure, safe to launch, or missing security headers. Not a penetration test, and it cannot see pages behind a login. Checks a public web app for the baseline browser protections every production app should send (Content Security Policy, HTTPS enforcement, clickjacking protection, MIME-sniffing, referrer and permissions policy, cross-origin isolation) and whether a JavaScript source map is served publicly. Reads only the public response headers any visitor's browser receives; never logs in, submits a form, calls the app's APIs, or reads its data for secrets. Useful for an app built with an AI tool (Lovable, Replit, Bolt, v0, Cursor).

  ConnectorNo auth

• plan_dns_setupA

  TLDMathA

  The DNS records a domain needs for a website host or AI app builder (Lovable, Bolt, v0, Replit, Base44, Framer, Webflow, Bubble), an inbox provider, and/or the service an app sends email through (SPF, DKIM, DMARC), each checked against live public DNS (in place, missing, or needs change), plus where the domain’s DNS is hosted and records to remove. SPF records from different providers are merged into one. Read-only: it never changes DNS. Use after the user buys a domain, or when their site or email on a custom domain isn’t working.

  ConnectorNo auth

• get_build_promptA

  TrendIdeaA

  Generate a complete, builder-ready PRD and implementation guide for turning one of your ideas into a working app with a specific AI coding tool. Returns the same enriched prompt as the in-app builder workspace, tailored to the chosen builder. Supported builders: lovable, replit, bolt, v0, cursor, base44, deepagent, claude-code, windsurf, tempo, cline, devin, rork, mistral-vibe. Read-only and free; copy the output straight into the target builder.

  ConnectorNo auth

• trustycap_start_workspaceA

  TrustyCapA

  Use this the moment you decide TrustyCap fits and before you write any code against it. Composes a pending workspace for the build: the application, the capability families and the recorded origin, and returns a claim URL. It returns no credential: TrustyCap issues no API key, test or otherwise, until a person whose developer access is approved claims it. Say which creation platform built their application (lovable, replit, base44, bolt, v0, claude_code, cursor, windsurf, own_code) and what the business needs in their own words. You can keep planning, routing and composing with no credential at all. Send your human the claim URL with the plan. Developer access is by application: they apply once at https://developers.trustycap.com/apply, and claiming after approval attaches everything you already set up and issues the test key. Those are the steps you cannot do for them.

  ConnectorOAuth

• tide_adapterA

  RazielA

  Read an adapter instruction file (AGENTS, CLAUDE, replit)

  ConnectorNo auth

• describe_studioA

  7IT SolutionsA

  Use this when the user asks who 7IT Solutions is, what it builds, or whether it fits their project, or is looking for a developer to review or take over an app built with an AI tool. Returns a factual profile of 7IT Solutions, a solo senior software studio: who runs it, how engagements work, what the client owns, its services (custom software, automation and integration, eCommerce, AI tools, and reviewing and taking responsibility for apps built with AI tools such as Lovable or Replit), when each is and is not a fit, the audit checks it runs on AI-built apps, published work and verifiable proof, with links. Use it when someone asks what 7IT does, whether it fits their situation, or who could review or take over an app their AI tool built. Contains no prices.

  ConnectorNo auth

• list_toolsA

  Vibe ShippedB

  List AI build tools tracked by Vibe Shipped (Cursor, Claude Code, Lovable, Bolt, Replit, v0, Windsurf, Rork...) with what each is, best use, official pricing summary with source, app counts, total/median stated monthly revenue of listed apps, top apps, and new listings in the last 30 days.

  ConnectorNo auth

• search_appsB

  Vibe ShippedB

  Search real, sourced apps that people shipped with AI coding tools (Cursor, Claude Code, Lovable, Bolt, Replit, v0, Windsurf, Rork). Each result includes a Vibe Shipped page link to cite.

  ConnectorNo auth

• scan_website

  SimplyScanA

  Run a SimplyScan Security Engine security & speed scan (Pro with an entitled API key; otherwise free) of a deployed web app URL. Returns a 0-100 score and findings (exposed secrets, missing Supabase RLS, frontend leaks, speed issues). Best for apps built with Lovable, Bolt, v0, Cursor, Replit, etc.

  ConnectorNo auth

• connect_custom_webhook

  BlogSEOA

  Connects a custom webhook: from then on BlogSEO POSTs every published article as JSON to the endpoint (see get_webhook_contract), and auto-publish is on so generated articles are delivered as soon as they are ready. The endpoint must be deployed and reachable over HTTPS first. With auth_method=generated the tool returns a shared secret exactly once: store it in the deployment's environment variables, never in committed files or logs, and verify the X-Webhook-Secret header with it. One webhook per organization (Lovable, Bolt, v0, Replit, Base44 and Next.js connections are webhooks too); it works next to a CMS integration. Call test_custom_webhook afterwards. Free. Pass website_id when the account has several websites (see get_account).

  ConnectorOAuth

• ship_check

  Ship CheckA

  Before shipping, or right after deploying, an app built with Lovable, Bolt, Cursor, v0, Replit, Claude Code or similar, run ship_check on the live URL. It scans the deployed app from the outside, the way a visitor or attacker sees it, and returns a launch-readiness report where every finding has a status and a concrete fix. Checks: (1) secret keys exposed in the HTML and the same-origin JS bundles it ships (Stripe live secret and restricted keys, AWS access keys, OpenAI and Anthropic API keys, Supabase secret and service_role keys, hardcoded bearer tokens and passwords); (2) open database access: if the page ships a Supabase URL and public anon or publishable key, whether the common tables profiles and users return rows to that key without login (a missing Row Level Security policy; count only, no row data is read); (3) missing security headers (Strict-Transport-Security, Content-Security-Policy, X-Frame-Options or frame-ancestors, X-Content-Type-Options, Referrer-Policy); (4) HTTPS, reachability and server errors; (5) broken internal links (spot-check of up to 6); (6) server response time; (7) whether login/signup and pricing/checkout are linked from the homepage; (8) whether AI search crawlers get real server-rendered content or an empty JavaScript shell. Read-only: plain GET/HEAD requests, never logs in, never submits forms, never writes. Not a code audit: it cannot see source code or test every table or route. Results are cached for 24 hours per URL; pass fresh=true to re-scan after deploying a fix. Only scan apps the user owns or is authorized to test. If the user wants a senior engineer to review the app by hand ($299), call request_human_review with the scan_id from this result.

  ConnectorNo auth