Configuration

This page walks you end to end: create a connection in WHMCS, pick the exact tools it may use, and connect an AI client to it. A connection is an admin-provisioned link to one AI client, limited to the tools you tick and secured with its own OAuth credentials.

What is MCP?

The Model Context Protocol (MCP) is an open standard that lets AI assistants call external tools. Relyagent makes your WHMCS one of those tool providers — so a client like Claude can list and call only the WHMCS tools you allow.

Before you start, make sure connections are enabled globally: open Addons → Relyagent → Settings → MCP Settings → AI Client Connections and turn on Allow AI clients to connect. See global caps below.

Create a connection

Open Addons → Relyagent → MCP Clients. Near the top you'll find the persistent Endpoint URL with a Copy button — it's the same for every connection:

https://<your-whmcs>/modules/addons/relyagent/public/mcp/endpoint.php

Addons → Relyagent → MCP Clients

1. Click New connection and give it a clear name — the placeholder suggests something like "Claude — Production" so you can tell connections apart later.
2. Tick the exact Allowed tools this connection may use. As the on-screen help puts it: "Tick exactly the tools this connection may use — only ticked tools are listable and callable, and OAuth scopes are derived from them automatically. Click a group to expand it."
3. Scopes are derived automatically from the tools you tick — you never hand-edit scopes. A <group>:read scope appears when you tick a read tool in that group, and <group>:write when you tick a write tool.
4. State-changing tools show a red dangerous badge; a tool whose group is switched off shows "group off — won't run" so you know it won't do anything even if ticked.

Start read-only

Tick only the read tools you actually need for the first connection. You can always edit it later — see the secure edit model.

Credentials Relyagent issues

When you save, Relyagent issues this connection its own OAuth credentials:

• Client ID — identifies the connection.
• Client Secret — shown once, right after you create the connection. Copy it now and store it somewhere safe; you can't view it again.
• Endpoint URL — the shared MCP address above.

The secret is shown only once

If you lose the secret, you can't recover it — use Regenerate secret to issue a new one (which forces the client to reconnect). Never paste a secret into a page you don't trust.

You hand these three values to the AI client. There is no open self-registration: a client can only connect with a Client ID and Client Secret you issue.

Connect the AI client

In the AI client's custom-connector settings, paste the Endpoint URL, Client ID and Client Secret, then let it connect:

1. The client auto-discovers Relyagent's OAuth endpoints and starts the sign-in.
2. You're sent to your native WHMCS admin login — Relyagent shows no login form of its own, so your existing 2FA, brute-force and IP rules all still apply.
3. A consent screen lists this connection's tools. Approve it to finish.
4. From then on the client sees only that connection's tools when it lists them, and any other tool call is rejected.

Addons → Relyagent → MCP Clients (consent shown after admin login)

For step-by-step instructions per client, see the guides: Claude Desktop, Claude.ai, Claude Code, Cursor and ChatGPT. The Setup tab in WHMCS has the same steps with your Endpoint URL pre-filled.

The secure edit model

Use Edit on a connection to change its ticked tools. Changes apply differently depending on direction, and this is by design so tightening access is instant:

• Removing a tool applies immediately — the client can no longer list or call it.
• Adding a tool requires the client to reconnect and re-consent. Adding revokes the connection's existing tokens, so the operator on the client side signs in again and approves the new consent screen before the added tool becomes usable.

Why the difference?

Removing access should never wait, so it's immediate. Adding access means granting a new tool, so it goes back through the consent screen — nobody gains a tool without an explicit re-approval.

Regenerate a secret

Use Regenerate secret when a secret may be exposed or you're rotating credentials. You'll be asked to confirm: "Generate a new secret? The current secret stops working immediately and the client must reconnect with the new one." After regenerating, paste the new secret into the AI client and reconnect.

Revoke a connection

Use Revoke to shut a connection down entirely. The client can no longer connect or call any tool. Revoke when a connection is no longer needed or you suspect its credentials are compromised.

Global MCP Settings caps

Per-connection tool selections always sit underneath the global caps in Addons → Relyagent → Settings → MCP Settings. Even a ticked tool won't run if a global cap blocks it:

• Allow AI clients to connect — the master switch. Off means no connection can connect.
• Allowed Scopes — the ceiling on what any connection may be granted (read-only by default; enable write scopes deliberately).
• Tool-group toggles — enable/disable each of the 10 groups; a disabled group's tools never list or run, whatever a connection has ticked.
• Dangerous Operations — off by default. State-changing tools only run when this is on and the tool is ticked on the connection.
• Rate limits — Calls / minute (default 60) and Calls / day (default 5000), per token.

Addons → Relyagent → Settings → MCP Settings

Where to go next

• MCP tools — the 10 groups and the dangerous-op gate
• Connections & OAuth — how the sign-in flow works
• Settings reference — every setting and its default
• Per-client guides: Claude Desktop · Claude.ai · Claude Code · Cursor · ChatGPT
• Back to the overview