Is the token safe on a public Repl?

Yes, as long as it stays in Secrets and .replit only references $MOODSPEC_TOKEN. Secrets are not visible to people who view or fork the Repl; the .replit file is.

Do I have to restart after every canvas edit?

No. Restarts are for config changes. Canvas edits are picked up on the next tool call, because the Agent reads the canvas live rather than caching it at startup.

Can Replit Agent change the canvas?

Only by proposing. propose_change is the one write tool, it is a Business scope, and every proposal waits for an owner to approve it.

What does the Agent get back?

Structured data — type stack, palette with usage rules, marks, references, personas and voice — rather than a prompt blob. The response shape is published in the tools reference.

What is the rate limit?

600 calls an hour per token on Pro and 5,000 on Business. Over it the endpoint returns 429 slow_down with a Retry-After header saying when the window resets.

← All integrations

Replit + moodspec

Give Replit Agent the same design context your local tools have: fonts, palette, marks and voice, read from one canvas.

Setup · about 2 minutes

Add the secretIn Secrets, add MOODSPEC_TOKEN with the bearer token from Connect agent.
Edit .replitAdd the agent MCP block below.
Restart the AgentReplit Agent reloads MCP servers on restart.
BuildAsk for a screen and it arrives using your canvas, not the default theme.

.replit

[agent]
mcp_servers = ["moodspec"]

[agent.mcp.moodspec]
url = "https://mcp.moodspec.app/c/brand-soul"
token = "$MOODSPEC_TOKEN"

Keep the token safe

Store MOODSPEC_TOKEN in Replit Secrets rather than the .replit file, then reference it as shown — the canvas stays private even on a public Repl.

Confirm it is connected

Replit shell

echo $MOODSPEC_TOKEN | cut -c1-9

It prints msk_live_. An empty line means the Secret is under a different name, or the Repl has not been restarted since it was added.

When it does not work

The Agent does not list moodspec after editing .replit: Replit Agent reads MCP servers when it starts, and editing .replit does not restart it. Stop and restart the Repl. Reloading the browser tab is not enough.
$MOODSPEC_TOKEN resolves to an empty string: The Secret was added after the Repl started, or the name differs by a character. Check the name in the Secrets pane matches exactly, then restart. Never inline the token in .replit — that file is visible to anyone who views or forks a public Repl.
403 locked when the Agent calls a tool: The token belongs to another canvas, or the tool needs a Business scope — get_history and propose_change are not covered by a Pro token. Reissue the token from Connect agent on the right canvas, and check which scope each tool needs.
Works in the editor, fails in a deployment: Deployments carry their own secrets, separate from the Repl's. Add MOODSPEC_TOKEN to the deployment's secrets as well.

Questions

Is the token safe on a public Repl?: Yes, as long as it stays in Secrets and .replit only references $MOODSPEC_TOKEN. Secrets are not visible to people who view or fork the Repl; the .replit file is.
Do I have to restart after every canvas edit?: No. Restarts are for config changes. Canvas edits are picked up on the next tool call, because the Agent reads the canvas live rather than caching it at startup.
Can Replit Agent change the canvas?: Only by proposing. propose_change is the one write tool, it is a Business scope, and every proposal waits for an owner to approve it.
What does the Agent get back?: Structured data — type stack, palette with usage rules, marks, references, personas and voice — rather than a prompt blob. The response shape is published in the tools reference.
What is the rate limit?: 600 calls an hour per token on Pro and 5,000 on Business. Over it the endpoint returns 429 slow_down with a Retry-After header saying when the window resets.

MCP is on Pro — see pricing