---
url: /relyagent-whmcs/faq.md
description: >-
  Straight answers to the questions WHMCS operators ask before and after
  installing Relyagent — what MCP is, which AI clients work, data handling,
  safety, control, licensing, auditing and updates.
---

# Relyagent FAQ

Short answers to the questions we hear most. For deeper detail, follow the links.

## What is MCP, and why would I use it?

**MCP** (Model Context Protocol) is an open standard that lets AI assistants call external
tools. Relyagent makes your WHMCS one of those tool providers, so you can *ask* an AI client to
do real WHMCS work — "summarise this client's open tickets", "list overdue invoices" — without
building an integration or handing out admin credentials. See the
[overview](/relyagent-whmcs/).

## Which AI clients can I connect?

Claude Desktop, Claude.ai, Claude Code, Cursor and ChatGPT. Each has a copy-paste walkthrough
starting with the [Claude Desktop guide](/relyagent-whmcs/guides/claude-desktop).

## Is my data sent anywhere I don't control?

No data goes anywhere except between your own WHMCS server and the AI client you connect.
Relyagent is a **self-hosted** MCP server running inside your WHMCS install. See
[Requirements](/relyagent-whmcs/requirements).

## Can an AI client do destructive things to my WHMCS?

Not by default. State-changing tools (like updating a client or creating an invoice) are
**dangerous operations**, kept off behind a gate. They only run when you enable **Dangerous
Operations** in **Settings → MCP Settings** *and* tick the specific tool on the connection.
See [MCP tools](/relyagent-whmcs/features/mcp-tools#dangerous-operations).

## How do I limit what a single connection can do?

Each connection has its own **allowed-tools** list — tick exactly the tools it may use, and
OAuth scopes are derived automatically. Only ticked tools can be listed or called. See
[Connections & OAuth](/relyagent-whmcs/features/connections-oauth).

## Do admins still log in normally?

Yes. Relyagent shows no login form of its own — every connection authorizes through your
**native WHMCS admin login**, so your existing 2FA, brute-force protection and IP rules all
still apply. You then approve a consent screen listing that connection's tools.

## What happens if my license lapses?

The MCP server is license-gated. If the license goes inactive, the MCP and OAuth endpoints
return **HTTP 403** and clients can't connect — renew or re-enter your key under
**Settings → License** to restore service. A brief licensing-server outage won't interrupt a
working install. See [Licensing](/relyagent-whmcs/licensing).

## Is there an audit trail?

Yes — one row per tool call in the **Audit Log**, filterable by date, status and tool, with
**CSV export**. Statuses include Success, Error, Sanitized, Forbidden and Rate Limited. See
[Audit and rate limits](/relyagent-whmcs/features/audit-and-rate-limits).

## Can I rate-limit connections?

Yes. Set **Calls / minute** (default 60) and **Calls / day** (default 5000) per token under
**Settings → MCP Settings**. Requests over the cap return HTTP 429 and are logged as Rate
Limited.

## Do I need HTTPS and mod\_rewrite?

Yes to both. OAuth and remote AI clients require **HTTPS**, and **mod\_rewrite** serves the
OAuth/MCP discovery documents at their standard `.well-known` paths. Full list on
[Requirements](/relyagent-whmcs/requirements).

## What happens to my data if I deactivate Relyagent?

Deactivating removes the generated hook loader but **keeps your database tables** — audit log,
connections and config — so a deactivate/reactivate is lossless. To remove everything, drop the
`mod_relyagent_*` tables manually after deactivating (irreversible).

## How are updates and backups handled?

Use **Settings → Update Status → Check for Updates → Update Now**. It backs up files and the
database first, applies the update, and auto-restores both on failure. A database backup is
retained afterward under **Database Backups** — store it privately, as it includes connection
secrets. See [Updating](/relyagent-whmcs/updating).

## Can two connections have different tools?

Yes — that's the point. Each connection has its own tool allowlist and its own OAuth
credentials, so you can give, say, a read-only "reporting" connection and a separate
"support desk" connection with reply-to-ticket tools. See
[Connections & OAuth](/relyagent-whmcs/features/connections-oauth).

## Can a client register itself without my involvement?

No. There's no open self-registration. A client can only connect with a **Client ID** and
**Client Secret** you issue when you create the connection under **MCP Clients**.

## What are the "scopes" I keep seeing?

Scopes are OAuth permissions named `<group>:read` and `<group>:write` (for example,
`clients:read`, `invoices:write`). You never hand-edit them — they're derived automatically
from the tools you tick for a connection. See
[MCP tools](/relyagent-whmcs/features/mcp-tools).

::: tip Didn't find your question?
Check [Troubleshooting](/relyagent-whmcs/troubleshooting) for fixes or the
[Error reference](/relyagent-whmcs/errors) for a specific message.
:::