# Scan: Replit Agent

> GAMMA-Ray v0.0.155 (beta, for review; every rating is experimental). An example GAMMA-Ray beta rating of Replit Agent: freedom 4, 4, 4, 4, 4, 4 across its configurations; deployment governance not assessed.
> Page: https://gamma-ray.sgit.ai/scans/replit-agent/ · Source: data/scans/replit-agent.json


Example · beta rating · a product as its vendor documents it · read 2026-11-10 · not seen by the vendor

Replit's AI agent that builds, runs, tests and publishes software from a description in plain language, inside a Replit project.

A scan of a product as its vendor documents it, not of any one deployment. Made by the report studio: two assessors working blind, a challenger, then the scorer.

Built only from Replit's own public documentation, product, security, subprocessor and customer pages, and its published llms.txt. Nothing was tested. If you are the vendor and something here is wrong, the correction will be made and dated.

*Figure. The label for this rating; its contents are in the text.*

4 Freedom as shipped Acts widely 4 Freedom at most Acts widely 14 Controls it brings as shipped n/a Deployment governance not assessed

## How to read it

This is a product, not a deployment. A product has no owner, no policy in force and no mandate until somebody runs it, so it is given **no governance level and no level held**: those belong to a deployment. What a product has is a freedom level for each way it can be configured, and a list of the controls each configuration brings.

*Figure. The freedom level of each configuration; the table has the same.*

| Configuration | What changes | Freedom | Controls | Turned on by the operator |
|---|---|---|---|---|
| **As shipped** | Agent on a paid plan with its defaults: it builds in the project, background tasks wait for review, no external connectors. | 4 Acts widely | 14 | nothing |
| **Plan mode on** | The person turns on Plan before Agent builds; Agent plans and asks without changing code or data. | 4 Acts widely | 14 | it retrieves information and recommends actions; a person acts |
| **App Testing on** | The App Testing toggle in Advanced settings, Power or Max mode only. | 4 Acts widely | 14 | the agent handles routine tasks; the person is consulted on exceptions |
| **Background changes applied automatically** | The person enables automatic apply for background tasks. | 4 Acts widely | 14 | the agent has full autonomy within boundaries; the person monitors |
| **With connectors and MCP servers** | External services connected through Connectors or MCP servers. | 4 Acts widely | 14 | it works across several domains or systems; it connects to external tools or services across a trust boundary |
| **Enterprise workspace** | Enterprise admin controls: connector scopes, model and provider policies, workspace custom instructions. | 4 Acts widely | 16 | it asks for narrower access than the whole account; a limit on it is a rule in prose |

The same product is a different agent in each row. A rating of a deployment starts by saying which row it is.

An indicator with no evidence is reported as not evidenced; it is never read as a no.

## The profile

*Figure. One square per indicator, by question; every answer is listed below.*

## The grant: what it can actually do

The questions measure what is said about an agent: its purpose, its rules, its controls. The grant is the other half: what its permissions let it do, capability by capability, and what stands in the way of each. This is RiskMandate's measurement, and it depends on the permissions a deployment was given.

**Not measured.** Not measured. No deployment shape for this product is published in the capability grammar.

## Seen, and not credited

- Replit states a SOC 2 Type 2 attestation. No report or scope statement is public, and nothing says it covers Agent rather than the company; the trust centre's content did not load without JavaScript. Not counted as an independent check yet. [Source](https://docs.replit.com/teams/information-security/overview)
- The main chat hands tasks to parallel worker chats that report back. One agent delegating sub-tasks for the same person and project; the indicator for several agents coordinating asks for more. [Source](https://docs.replit.com/build/code/coordinate-work)
- An MCP scanner blocks suspicious tools before they run. A gate before a tool runs, not detection of anomalies in operation. [Source](https://docs.replit.com/features/mcp/overview)

## What its evidence reaches

*Figure. The mashup graph with this agent's evidenced indicators lit.*

## Every answer, with its source

### What is the agent built on?

- **As shipped.** It is a vendor's assistant, used as supplied. The help page states the model behind Agent runs on Replit's infrastructure and cannot be replaced by the user. [Source](https://docs.replit.com/help/agent-and-ai) (documented)
- *Not evidenced.* It runs on an AI platform with the organisation's own data, without executing arbitrary code.
- *Not evidenced.* It is configured on a low-code or no-code builder and acts on real organisational data.
- **As shipped.** It generates and executes code with local or cloud privileges. The General Agent page states Agent executes code as part of its work and sets up its own environment. [Source](https://docs.replit.com/features/agent/general-agent) (documented)
- *Not evidenced.* It is built in-house: the organisation controls its identity, tools and boundaries.

### Does it act, or only answer and recommend?

- *Not evidenced.* It follows fixed rules, with no reasoning.
- **Available, if the operator turns it on.** It retrieves information and recommends actions; a person acts. In Plan mode Agent brainstorms and plans without changing code or data; the person then chooses to build. [Source](https://docs.replit.com/features/agent/plan-mode) (documented)
- **As shipped.** It executes actions itself. The overview states Agent takes actions such as setting up projects and fixing problems. [Source](https://docs.replit.com/features/agent/overview) (documented)
- **As shipped.** It is in production: a public source names a customer or gives usage figures for what it does on its own. A Forbes article reposted on Replit's newsroom names Zillow, with about 600 seats and more than 7,000 apps its employees made with Replit over a year; the article describes Replit's product as an AI agent that writes its own code. A second source, Replit's Plaid story, names Replit Agent and an internal dashboard in use. [Source](https://replit.com/news/funding-announcement) (documented)

### How far does it reach?

- **As shipped.** It works in one domain's data. The General Agent FAQ states each chat is contained within a single project. [Source](https://docs.replit.com/features/agent/general-agent) (documented)
- **Available, if the operator turns it on.** It works across several domains or systems. With connectors added, Agent reads and writes to several external services such as BigQuery, Linear, Slack and Notion. [Source](https://docs.replit.com/features/agent/general-agent) (documented)
- **Available, if the operator turns it on.** It connects to external tools or services across a trust boundary. The MCP list states Agent connects to external tools and data sources through MCP servers the user installs. [Source](https://docs.replit.com/features/mcp/overview) (documented)

### Does it work with other agents?

- *Not evidenced.* Several agents coordinate inside the organisation.
- *Not evidenced.* Agents operate across organisational boundaries or disparate stacks.
- *Not evidenced.* There is a published protocol or communication layer between agents.
- **As shipped.** Others build on it: third parties publish integrations, skills or agents for it. The skills directory lists skills published by partners such as Stripe, PayPal and Atlassian for Agent. [Source](https://docs.replit.com/features/agent/skills-directory) (documented)
- *Not evidenced.* It exposes an agent interface: a published MCP server, an agent card, or an API documented for agents to call.

### What is the person's role?

- *Not evidenced.* The person operates: every action is prompted and controlled by them.
- *Not evidenced.* The agent suggests; the person reviews and approves each action.
- **Available, if the operator turns it on.** The agent handles routine tasks; the person is consulted on exceptions. With App Testing on, Agent tests the app on its own and hands over to the person at a roadblock such as a login. [Source](https://docs.replit.com/features/agent/app-testing) (documented)
- **As shipped.** The agent works independently; the person approves critical decisions only. In the default build mode Agent plans, writes code, sets up infrastructure, tests and deploys on its own from a description. [Source](https://docs.replit.com/features/agent/overview) (documented)
- **Available, if the operator turns it on.** The agent has full autonomy within boundaries; the person monitors. Background tasks wait for review by default; the person can switch on automatic apply of their changes. [Source](https://docs.replit.com/features/agent/plan-mode) (documented)

### Is what it is for written down?

- **As shipped.** Its purpose and permitted tasks are stated in writing. The overview states what Agent is for: turning plain-language ideas into apps, designs, slides and other outputs. [Source](https://docs.replit.com/features/agent/overview) (documented)
- **As shipped.** Its autonomy limits and the tools it may use are defined. The page defines that Agent reaches external tools only through connectors the user adds and has no access by default. [Source](https://docs.replit.com/features/agent/general-agent) (documented)
- **As shipped.** Its limits and known failure cases are documented for those who use it. The help page documents known failure cases such as Agent freezing, looping and adding unrequested features, with what to do. [Source](https://docs.replit.com/help/agent-and-ai) (documented)

### Does it have its own identity and only the access it needs?

- *Not evidenced.* What it can reach is enumerated: scopes, permissions, tools.
- *Not evidenced.* Its authorisation is published as metadata that anyone can read.
- **Available, if the operator turns it on.** It asks for narrower access than the whole account. On Enterprise an organisation can bring its own OAuth app and set the exact scopes builders can request for a connector. [Source](https://docs.replit.com/features/integrations/overview) (documented)
- *Not evidenced.* It has its own identity, separate from any person's.
- *Not evidenced.* Its identity is cryptographic and can be checked by others.
- *Not evidenced.* Its tokens are bound to the service they were issued for and are not passed on.

### Is it in a registry, with an owner?

- *Not evidenced.* The organisation keeps a registry of its agents.
- *Not evidenced.* Each agent has a named owner.
- *Not evidenced.* Agents are retired by a defined process.

### Who is accountable for it?

- *Not evidenced.* A named executive or body is accountable for the organisation's agents.
- *Not evidenced.* Roles and responsibilities for AI risk are documented.

### Is there a policy that governs it?

- *Not evidenced.* A governance policy for agents is published.
- *Not evidenced.* Agents and use cases are classed by risk.
- *Not evidenced.* The laws that apply to it are identified.
- *Not evidenced.* New agents pass an approval or review before they run.

### Can a person step in or stop it?

- **As shipped.** High-impact actions need a person's approval. Changes made by background tasks are held for the person to review before they are applied to the main version. [Source](https://docs.replit.com/features/agent/task-lifecycle) (documented)
- **As shipped.** There is a way to pause or stop it. The help page states the person can select Stop in the Agent panel to halt Agent immediately. [Source](https://docs.replit.com/help/agent-and-ai) (documented)
- *Not evidenced.* There is a defined escalation path.

### Is what it does logged?

- **Claimed, not counted.** Its actions are logged. Each checkpoint Agent makes creates a Git commit, a record of what it changed. Documented, so it does not count where an operation fact must be observed. [Source](https://docs.replit.com/features/version-control/checkpoints-and-rollbacks) (documented; this fact has to be observed or measured to count)
- *Not evidenced.* The log is tamper-evident and kept for a stated time.

### Is it watched while it runs?

- *Not evidenced.* It is monitored in operation.
- *Not evidenced.* Anomalies are detected in real time and raise alerts.

### What stands between it and what it should not do?

- *Not evidenced.* A limit on it is enforced by something outside its own reach.
- **As shipped.** A limit on it is a setting that its own account could change. Agent settings such as auto-merge for background tasks and auto-approve for plans are the user's own settings. [Source](https://docs.replit.com/features/agent/agent-modes) (documented)
- **Available, if the operator turns it on.** A limit on it is a rule in prose. Workspace custom instructions are guidance in prose that Agent is guided to follow, without a guarantee. [Source](https://docs.replit.com/features/agent/agent-customization) (documented)
- *Not evidenced.* Policy is enforced as machine-readable rules.
- *Not evidenced.* The difference between what it can reach and what it is for is stated.

### Is it tested, and are the results shown?

- *Not evidenced.* Test or evaluation results are published.
- **Claimed, not counted.** It is tested for safety and security, including by attack. The security page states an internal harness continuously probes and tests the AI Agent for safety and security boundaries. [Source](https://replit.com/security) (documented; this fact has to be observed or measured to count)
- **As shipped.** People who did not build it take part in assessing it. The security page names external testing of the platform: a public HackerOne bug bounty and Trail of Bits penetration testing. The source says this covers the platform; it does not name Agent. [Source](https://replit.com/security) (documented)

### What happens when it goes wrong?

- *Not evidenced.* There is an incident process for agents.
- *Not evidenced.* Incidents and errors are communicated to those affected.
- *Not evidenced.* There is a plan for a failure of a third party it depends on.

### Do people know it is an AI, and can they answer back?

- *Not evidenced.* It tells the people it talks to that it is an AI.
- **As shipped.** There is a channel to report problems with it or contest its output. The Agent help page points users with unresolved Agent problems to Replit Support. [Source](https://docs.replit.com/help/agent-and-ai) (documented)
- **As shipped.** It is machine-readable for agents: it publishes an llms.txt, an AGENTS.md, an API description or an agent card. The docs llms.txt was fetched and resolves, listing Agent, MCP, security and admin pages. [Source](https://docs.replit.com/llms.txt) (observed)

### What data does it use, and under what rules?

- **As shipped.** The data it uses is described. The page describes the content used for model improvement: prompts, instructions, context and generated responses. [Source](https://docs.replit.com/legal-and-security-info/model-improvement) (documented)
- *Not evidenced.* There are data quality rules for what it reads.
- *Not evidenced.* Its privacy risk has been examined.

### What does it depend on from others?

- **As shipped.** The models and third-party components it uses are listed. The subprocessor list names the providers of AI models (Anthropic, OpenAI, Google); it lists providers, not which model Agent uses. [Source](https://replit.com/subprocessors) (documented)
- *Not evidenced.* Third-party components are monitored and have risk controls.

### Has anyone independent checked?

- *Not evidenced.* A public certificate or audit report covers it.
- *Not evidenced.* Compliance evidence is produced continuously, ready for a regulator.

### Is the organisation behind it ready?

- *Not evidenced.* There is a stated strategy for agents.
- *Not evidenced.* The people who work with it are trained.
- *Not evidenced.* Its value is measured.
- **As shipped.** It is improved on a regular cycle. The documentation index lists a weekly changelog; the latest entry read is dated 6 November 2026. [Source](https://docs.replit.com/_llms/en/features.txt) (documented)
- *Not evidenced.* The organisation's risk management covers agents.

## The vault

This rating, its evidence list, its grant and the questions it was made against are kept in a public sgit vault (`micbbanr`, published 2026-11-10). Anyone can read it with this key:

`sgit_public_read_a835cecf0324b1147350caf9a8566f08f8c1c10df7eb007bd866eb156f228154:micbbanr`

With [sgit](https://sgit.ai/): `sgit clone sgit_public_read_a835cecf0324b1147350caf9a8566f08f8c1c10df7eb007bd866eb156f228154:micbbanr`. The key reads; it cannot write. An operator who wants to add what only they hold forks the vault into a private one.