Audit log & rate limits

Relyagent keeps a complete record of what your connected AI clients do, and caps how fast they can do it. Together the Audit Log and rate limits give you accountability and protection without any extra setup.

The Audit Log

The Audit Log tab records one row per tool call — every time a connected AI client runs a tool, whether it succeeded or not. Open it under Addons → Relyagent → Audit Log.

Addons → Relyagent → Audit Log

Statuses

Each row has a status that tells you exactly what happened:

• Success — the tool ran and returned normally.
• Error — the tool ran but hit a problem completing.
• Sanitized — the prompt-injection sanitiser altered the tool's output before returning it, removing content that tried to manipulate the AI client.
• Forbidden — the call was blocked by a gate: the connection lacked the tool's scope, the tool's group was turned off, or a dangerous tool was called with Dangerous Operations off.
• Rate Limited — the call was refused because it hit a rate cap (see below).

Filters and export

You can narrow the log by date range (it defaults to the last 7 days), by status, by tool, and with a free-text search box (for a client, token or IP). An Export CSV button downloads the current view so you can archive it or analyse it elsewhere.

TIP

A run of Forbidden rows usually means a connection is missing a tool, a group is off, or the dangerous-operations gate is blocking a write. See MCP tools.

Rate limits

Rate limits protect your WHMCS from a runaway or misbehaving client. They are enforced per token (that is, per connected client) and configured under Settings → MCP Settings:

• Calls / minute — default 60, with a hard cap of 10,000.
• Calls / day — default 5000.

When a client exceeds a limit, the call is refused with HTTP 429 and the attempt is recorded in the Audit Log with a Rate Limited status. If legitimate usage is hitting the cap, raise the per-minute or per-day limit in Settings → MCP Settings.

Accurate client IPs behind a proxy

If your WHMCS sits behind a reverse proxy or CDN you control, enable Settings → General → Trust X-Forwarded-For Header so audit rows capture the real client IP instead of the proxy's. Leave it off otherwise.