> ## Documentation Index
> Fetch the complete documentation index at: https://docs.clarion.cantina.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Replit

> Connect your Replit Enterprise Account to Clarion so the exposure agent can find deployments that are reachable from the public internet but were never meant to be.

This guide walks you through connecting a Replit Enterprise Account to Clarion. Once connected, Clarion's Exposure Agent sweeps the Account daily: it lists your workspaces and deployments, reads each deployment's privacy setting, checks whether the public ones actually answer on the internet, and opens an issue for anything that looks internal but is reachable by anyone.

<Note>
  **Estimated time:** 5 minutes. You will need to be an **admin of a Replit Enterprise Account**, since the Admin API is only available to Account admins on Enterprise Accounts.
</Note>

## Prerequisites

* A **Replit Enterprise Account**, and **admin** access to it
* The ability to create an **Admin API key** with read scope
* A **Clarion workspace** with the Replit integration page open

<Warning>
  One Clarion workspace connects one Replit Account. The key you paste grants read access to everything in the Account that issued it, so create it from the Account whose deployments you want swept.
</Warning>

***

## Step 1 — Create an Admin API key in Replit

1. Sign in to Replit as an Account admin.
2. Open your **Account** settings and find the **Admin API** section.
3. Create a new API key with **read** scope.
4. Copy the key. It begins with `rpl_`.

<Warning>
  Copy the key immediately and store it securely — Replit may only show it once. Grant read scope only; Clarion never writes to Replit.
</Warning>

***

## Step 2 — Enter the key in Clarion

1. In Clarion, open **Integrations** and find **Replit** under Development & Planning.
2. Paste your **Admin API key**.
3. Click **Connect**.

Clarion checks the key against Replit before saving it. If the key is wrong or the Account is not entitled to the Admin API, you'll see a clear error and nothing is stored. To rotate a key later, paste the new one and connect again — it replaces the old one.

***

## What the exposure agent does

The Exposure Agent runs a daily sweep of every provider you have connected. For Replit it:

| Step               | What happens                                                                                           |
| ------------------ | ------------------------------------------------------------------------------------------------------ |
| Enumerate          | Lists the Account's workspaces and their deployments                                                   |
| Read posture       | Records each deployment's privacy as `public`, `password`, or `private`                                |
| Check reachability | Requests the root of public deployments only, and records the response status — never the page content |
| Classify           | Separates deployments that show a login page from those serving open content                           |
| File               | Opens and escalates an issue for each reachable deployment that looks internal, up to ten per run      |
| Remember           | Records each verdict so an intentionally public site stops being re-reported                           |

Deployments set to `password` or `private` are recorded as gated and never contacted.

<Note>
  The reachability check is read-only: Clarion requests the deployment's root address, follows at most two redirects, and keeps only the status code, byte count, and whether the page mentioned signing in. No page content, headers, or cookies are stored, shown, or sent to the agent.
</Note>

### Agent tools

Once connected, agents on this workspace gain access to the `/replit` action, which exposes these read-only tools:

| Tool                    | What it does                                                                   |
| ----------------------- | ------------------------------------------------------------------------------ |
| `list_workspaces`       | List every workspace in the connected Account                                  |
| `list_projects`         | List a workspace's projects, including who owns each                           |
| `list_deployments`      | List a workspace's deployments with their privacy setting, status, and address |
| `get_deployment`        | Fetch one deployment's current privacy setting and status                      |
| `list_members`          | List a workspace's members, used to route a finding to its owner               |
| `probe_deployment_root` | Check whether one public deployment answers on the internet                    |

All six are read-only and need no approval. None of them can change anything in Replit.

***

## Disconnect

To remove the integration:

1. In Clarion, open **Integrations → Replit**.
2. Click **Disconnect**.

This deletes the stored key. The exposure agent stops sweeping Replit, and any saved skills that reference the `/replit` action will surface the integration as missing until you reconnect.

***

## Troubleshooting

### "Replit rejected the key"

The key is malformed, unknown, revoked, or expired. Create a fresh Admin API key in your Replit Account settings and connect again. Check that you copied the whole key, including the `rpl_` prefix.

### "The key needs read scope and Enterprise Admin API entitlement"

Replit authenticated the key but refused the request. Either the key was issued without read scope, or the Account is not an Enterprise Account with Admin API access. Confirm both with your Replit administrator.

### A deployment I expected is missing from the sweep summary

If the summary says coverage was **incomplete**, Replit returned more results than a single sweep walks, and some deployments were not examined. Each run starts from the beginning rather than resuming where the last one stopped, so the same deployments are examined every time and the ones past the limit stay unexamined until the limit is raised. The summary reports this per run, so incomplete coverage is always stated rather than implied. If you see it, let us know how many workspaces and deployments your Account has.