Replit

Replit has two places a key can live. Secrets on a Repl are environment variables for the app you are writing. An MCP server is a connection for Agent. Put the Vibe Coding Plan token in the MCP header, not in a Repl secret, unless you are also writing code that calls the REST API yourself. The Agent connection does not inject the token into your program.

Add it as a personal MCP server when it is only for you. Add a workspace MCP server only if you are allowed to manage workspace integrations and everyone in that workspace should see the connector. Even then, do not bake your personal token into a shared install link. Replit install links can carry headers. A link with your token in it is a leaked credential. Share the URL and let each person paste their own token.

Replit scans MCP tool definitions and planned calls. If a tool is rejected, Agent should say so. The six tools here read plans or create a project and tasks. None of them delete data. If the scanner blocks one, read the message before you retry with a broader prompt.

Custom MCP options depend on your account. If Add personal MCP server is missing under Your integrations, ask a workspace admin. The menu is not hidden because the URL is wrong.

Create the token at API Tokens after you sign in. Copy it once. The dashboard will not show the secret again.

The token lasts 30 days. When calls start returning unauthorized, create a new token and paste it into the connector again. Revoke the old one.

Do not choose OAuth, MCP OAuth, or "Add & authorize" for this server. That sign-in path is set up for ChatGPT. These builders need the API token.

Paste the token alone when the field is labeled bearer token or API key. If the form asks for a header, set the name to Authorization and the value to Bearer plus the token, with one space between them.

The connection lets the builder chat read and create your projects. It does not put the token into the app you publish. If the shipped app must call Vibe Coding Plan, that is a separate server-side integration, and the token stays in an environment variable.

You want a timer two people can join: a room code, a 25-minute countdown, and a note when the session ends. Replit Agent can scaffold that quickly and then keep adding chat, accounts, and a history graph. Get the size first.

Estimate. "Use Vibe Coding Plan estimate_project. Description: a shared study timer. Two people join with a room code, see the same countdown, and get a note when it ends. No accounts and no chat. Do not edit files." Read the hours and the phase titles. If complexity is High, the description was too wide. Cut the note feature and estimate again before Agent writes a backend.

Create the project. "Use Vibe Coding Plan create_project. Name: Study Timer. Description: shared 25-minute timer with a room code. generate_plan true. Print the new project id and the task titles." Keep that id. The next session can call get_project_tasks without listing everything.

Build in the Repl. "Using the Study Timer tasks, implement the first task only inside this Repl. Show me the files you changed." Review the diff. Then ask for the next title. Agent's MCP connection is what keeps the list. The running timer app still needs its own room storage, which is Replit's database or whatever you chose in the stack step.

A stack prompt that fits this app: "Use Vibe Coding Plan suggest_tech_stack. Preferences: JavaScript and SQLite." You should see a frontend, a backend, a database, and a host. Tell Agent to follow those four lines when it creates files, or name a different preference and call the tool again.

The usual miss is the header value. It must be the word Bearer, one space, and the token, with no quotes. The header name is Authorization, not X-API-Key, unless you are debugging. This server accepts both, but the documented Replit field is Authorization.

A URL without https, or a URL that points at the marketing homepage, fails the test. Use the /mcp endpoint.

401 after a month is expiry. API tokens last 30 days. Create a new one, edit the server, and test again. Revoke the expired token in API Tokens.

Agent says it cannot see the tool. The server saved, but the prompt did not name it, or the scanner rejected the call. Repeat a short read: list projects. Do not start by asking it to create five projects.

Can I generate a one-click install badge? Yes, from Replit's connect guide, and only if the badge does not contain your token. Leave headers out of anything you post.

Does this replace Replit Secrets? No. Secrets configure the app. This header configures Agent.

Will the connection work on a phone? Use the same integrations page in the browser. The server is remote, so nothing has to be installed on the device.