---
url: /relyagent-whmcs/settings.md
description: >-
  Every Relyagent setting explained — General, MCP Settings, Sync, Update Status
  and License — with defaults, so you know exactly what each toggle changes
  before you flip it.
---

# Settings reference

Everything you configure lives under **Addons → Relyagent → Settings**, split into five
sections: **General**, **MCP Settings**, **Sync**, **Update Status** and **License**. This page
is a complete reference to each setting and its default, so you can decide what to change with
confidence.

![Relyagent Settings screen](/relyagent-whmcs/img/relyagent-settings-overview.png)
*Addons → Relyagent → Settings*

::: info What is MCP?
The **Model Context Protocol (MCP)** is an open standard that lets AI assistants call external
tools. Relyagent makes your WHMCS one of those tool providers — safely, on your own server. The
**MCP Settings** section below controls which tools are exposed and how hard they can be called.
:::

## General

| Setting | Default | What it does |
| --- | --- | --- |
| **Verbose Debug Logging** | Off | Writes extra entries to the WHMCS module log on every MCP request. Turn it on only while diagnosing an integration problem, then turn it back off — it is noisy in day-to-day use. |
| **Trust X-Forwarded-For Header** | Off | Changes how the client IP is captured for the audit log. When On, Relyagent reads the closest-hop entry of the `X-Forwarded-For` header instead of the direct connection IP. |

::: warning Reverse proxies only
Enable **Trust X-Forwarded-For Header** *only* when WHMCS sits behind a reverse proxy or CDN you
control. If you turn it on without a trusted proxy in front, a client could spoof the header and
your audit log would record the wrong IP.
:::

## MCP Settings

This section decides which tools AI clients can see and how often they can call them.
See [MCP tools](/relyagent-whmcs/features/mcp-tools) for the full tool list and
[Connections & OAuth](/relyagent-whmcs/features/connections-oauth) for how these caps combine
with each connection's own tool selection.

### Tool groups

| Setting | Default | What it does |
| --- | --- | --- |
| **Tool group toggles** (Clients, Tickets, Invoices, Services, Domains, Admin, Affiliates, Email, Quotes, Orders) | On | Enables or disables each of the 10 groups install-wide. A disabled group's tools never list and never run, even if a connection has them ticked. |

### Dangerous Operations

| Setting | Default | What it does |
| --- | --- | --- |
| **Dangerous Operations** | Off | Master gate for state-changing tools. While Off, those tools are visible but refuse to run. |

When On, the following state-changing tools become runnable (and only if the tool is also ticked
on the connection):

* `update_client`
* `create_invoice`
* `add_credit`
* `suspend_service`
* `unsuspend_service`
* `change_package`

::: danger Leave this off unless you need it
These tools change live billing and account state. Enable **Dangerous Operations** deliberately,
grant the specific tools to only the connections that need them, and keep an eye on the
[audit log](/relyagent-whmcs/features/audit-and-rate-limits).
:::

### Rate limits

| Setting | Default | Notes |
| --- | --- | --- |
| **Calls / minute** | 60 | Per token. Hard cap of **10,000** — you cannot set a value higher than this. |
| **Calls / day** | 5000 | Per token. |

When a token exceeds either limit, further calls are refused until the window resets, and the
call is recorded as **Rate Limited** in the audit log.

### AI Client Connections

| Setting | Default | What it does |
| --- | --- | --- |
| **Allow AI clients to connect** | — | Master switch. While off, no AI client can connect, regardless of the connections you have created. Turn it on during setup. |
| **Allowed Scopes** (ceiling) | Read-only | An install-wide ceiling on what any connection may do. Read-only by default; enable write scopes deliberately, alongside **Dangerous Operations**, only when you intend AI clients to change data. |

These global caps apply *on top of* each connection's own ticked tools — a connection can never
do more than the Allowed Scopes ceiling permits, even if it has more tools ticked.

### OAuth signing keys

| Control | What it does |
| --- | --- |
| **Regenerate keys** | Rotates the per-install OAuth signing key. Use it if you suspect the key is compromised. Regenerating forces every connected client to reconnect, so plan for a brief interruption. |

## Sync

Relyagent verifies its own deployed files against an **HMAC-SHA256** signed baseline so you can
trust the deployment. See [File integrity](/relyagent-whmcs/features/file-integrity) for the full
story.

| Setting | Default | What it does |
| --- | --- | --- |
| **Auto-Sync** | — | Re-syncs deployed files automatically on admin page load when a mismatch is detected. |

The **File Integrity (HMAC-SHA256)** panel flags any tampered or missing deployed files, and a
status banner reads either **Everything In Sync** or **Sync Required**. When everything matches
you'll see: *"All deployed files match the HMAC-signed baseline."* A manual **Sync** control lets
you re-run the check; on success it flashes *"Sync completed successfully."*

## Update Status

This section shows your installed version, checks for new releases, and keeps your database
backups. Relyagent also checks for updates automatically once a day. For the full workflow, see
[Updating](/relyagent-whmcs/updating) and [Backup & restore](/relyagent-whmcs/backup-and-restore).

## License

Enter and manage your Relyagent license key here. The panel shows your license type and, for a
Lifetime key, whether your Support & Updates entitlement is active. For what each license type
grants and how lapses behave, see [Licensing](/relyagent-whmcs/licensing).

::: tip Next steps
Once your settings are how you want them, create a connection under
**Addons → Relyagent → MCP Clients** — see [Connections & OAuth](/relyagent-whmcs/features/connections-oauth).
:::