Replit Agent

The only documented export is 'Download as zip' or GitHub sync of project files. Replit states that the model powering the Agent 'runs on Replit's infrastructure and can't be swapped', and there is no documented way to restore the agent on a runtime Replit does not operate.

• Replit Docs – Projects and files
• Replit Docs – Agent and AI (help)

The docs state that secrets, the database and deployment configuration are not included when a project is copied. Agent chat history, account memories, routines and connector grants are also not documented as exportable. Connectors use Replit's own registered OAuth app unless you are on Enterprise.

• Replit Docs – Projects and files
• Replit Docs – Connectors
• Replit Docs – Memories

The Agent runs only on Replit's hosted service and needs a Replit account and plan allowance or credits to act. No perpetual right to run it exists.

• Replit Docs – Agent and AI (help)
• Replit Terms of Service

The Agent's model 'can't be swapped'. Core users choose only from Replit's model list in Power or Max mode, and Free mode is routed automatically. There is no documented way to bring your own key or use a local model for the Agent itself (your own keys apply only to models your app calls).

• Replit Docs – Agent and AI (help)
• Replit Docs – Model selector

The ToS lets Replit suspend or terminate accounts 'in its sole discretion' and gives self-serve users no export window after termination. The 30-day migration window appears only in the Enterprise commercial agreement, and agent state lives on Replit's servers.

• Replit Terms of Service
• Replit Commercial (Enterprise) Agreement

Project files are ordinary files, but the Agent conversation, checkpoints metadata, memories, routines and run history can be read only through Replit's hosted service. No public schema or offline format is documented for them.

• Replit Docs – Checkpoints and rollbacks
• Replit Docs – Memories
• Replit Docs – Routines

Replit's base system prompt and any provider-injected context are not visible to the owner (shortfall 1). In Free mode the model is chosen by 'intelligent model routing', and the docs do not let the owner determine which model or version handled a call (shortfall 2).

• Replit Docs – Agent modes
• Replit Docs – Model selector

The privacy policy says data is deleted or de-identified 'when it is no longer necessary', with no retention table or bounded periods. Usage data, logs and revision history are collected, but none of it is shown to the owner item by item.

• Replit Privacy Policy
• Replit Docs – Deleting your data

The Agent is marketed as integrating Replit's own services (Database, Auth, AI Integrations, publishing). These first-party defaults are disclosed, and no paid placement was found. However, no binding commitment rules out self-preferencing, and there is no documented switch to turn off first-party defaults.

• Replit AI (product page)
• Replit Docs – Connectors

On Core, the record is the Agent chat, checkpoints and routine run history. There is no documented guarantee that failed recording is surfaced to the owner, and none that connector and MCP calls are recorded with arguments and targets or kept until the owner deletes them. Under G12 both shortfalls count, and audit logs are Enterprise-only.

• Replit Docs – Audit logs
• Replit Docs – Routines

No integrity data or verifier for the action record is documented. Even the Enterprise audit log docs do not address tamper evidence.

• Replit Docs – Audit logs

No documented mechanism stops the Agent from altering or suppressing its record. Checkpoints are Git commits in a project where the Agent works with shell access, and the docs describe no protection for that history or for the chat record.

• Replit Docs – Checkpoints and rollbacks
• Replit Docs – Version control

The Agent runtime and its hosted services are proprietary and closed source, so a required component is closed.

• Replit Docs – Agent and AI (help)
• Replit Terms of Service

The agent acts through the owner's Replit account and, for connectors, through Replit's registered OAuth app (custom OAuth apps are Enterprise-only). Both are provider-issued credentials Replit can revoke.

• Replit Docs – Connectors
• Replit Terms of Service

Checkpoints capture project files, conversation context, environment configuration, Agent memory and optionally the database. They appear as Git commits with diffs and one-click rollback. Account-level memories, workspace settings, connectors, model changes and provider updates are not covered, and changes are not attributed beyond Agent checkpoints versus manual commits.

• Replit Docs – Checkpoints and rollbacks
• Replit Docs – Version control

Owners can edit replit.md and add skills (workspace custom instructions are not available on Core). Replit's base Agent prompt is not exposed and cannot be replaced.

• Replit Docs – replit.md
• Replit Docs – Agent customization

Memories are opt-in, and user memories can be viewed, edited and disabled through a Memory file in Settings. Project memories are 'retrieved when relevant', but the docs do not show them itemised and editable.

• Replit Docs – Memories

Owners can connect any remote MCP server by HTTPS URL with no provider review, and can disconnect connectors. No documented setting removes built-in Agent tools (shell, browser testing, web search, Replit-managed services).

• Replit Docs – Connect via MCP
• Replit Docs – Connectors

The Agent's sandboxed environment, rate and allowance limits, and platform logging are set by Replit. No documented owner setting changes or disables any of them.

• Replit Docs – Agent modes
• Replit Docs – Security

Free mode picks models by server-side routing, Replit states 'availability can vary', and modes change at Replit's discretion (Economy Mode was discontinued and replaced by Power). No version pinning for the Agent, model or instructions is offered.

• Replit Docs – Agent modes
• Replit Docs – Model selector

No documented owner limits on instruction sources, or per-recipient or per-channel contact limits, for connectors such as Gmail and Slack. Spend limits exist only as per-run routine budgets. Per-tool and per-path scope is not documented. Two or more dimensions are missing.

• Replit Docs – Connectors
• Replit Docs – Routines

Approval exists only for a fixed set of cases: Plan mode approval before building, confirmation before paid usage, and confirmation for MCP tools that declare it. The owner cannot choose which action classes are gated.

• Replit Docs – Agent and AI (help)
• Replit Docs – Connect via MCP
• Replit Docs – Agent

'Select Stop in the Agent panel to halt it immediately' stops the foreground turn. Scheduled routines are managed separately (run now or delete, with no documented pause), and there is no single global stop.

• Replit Docs – Agent and AI (help)
• Replit Docs – Routines

Replit uses prompts, instructions, context and responses 'to help develop and improve our models and AI features'. An opt-out is documented only for Pro, Enterprise is excluded, and none is documented for Core. The ToS also reserves access to private apps for 'improving our service', and terms can change without a set notice period.

• Replit Docs – Model improvement
• Replit Terms of Service
• Replit Privacy Policy

Secrets can be viewed and deleted one by one, and connectors can be disconnected via Manage. Connector OAuth tokens are held by Replit under its own OAuth app, with no disclosure that the provider copy is deleted on revocation or that use is limited to owner-directed actions.

• Replit Docs – Secrets
• Replit Docs – Connectors

Owners can request account deletion in Settings, which 'removes all of your content'. No completion time limit, completion confirmation or handling of backups is stated, and the privacy policy allows keeping data in de-identified form.

• Replit Docs – Deleting your data
• Replit Privacy Policy