--- url: /relyagent-whmcs/faq.md description: >- Straight answers to the questions WHMCS operators ask before and after installing Relyagent — what MCP is, which AI clients work, data handling, safety, control, licensing, auditing and updates. --- # Relyagent FAQ Short answers to the questions we hear most. For deeper detail, follow the links. ## What is MCP, and why would I use it? **Model Context Protocol (MCP)** is an open standard enabling AI assistants to invoke external tools: * **Direct integration:** allows AI clients to fetch data and trigger actions without custom integrations. * **Controlled access:** exposes designated WHMCS tools without sharing root admin credentials. * **Learn more:** see the [product overview](/relyagent-whmcs/). ## Which AI clients can I connect? Claude Desktop, Claude.ai, Claude Code, Cursor and ChatGPT. Each has a copy-paste walkthrough starting with the [Claude Desktop guide](/relyagent-whmcs/guides/claude-desktop). ## Is my data sent anywhere I don't control? No data goes anywhere except between your own WHMCS server and the AI client you connect. Relyagent is a **self-hosted** MCP server running inside your WHMCS install. See [Requirements](/relyagent-whmcs/requirements). ## Can an AI client do destructive things to my WHMCS? No. State-changing tools are classified as **dangerous operations** and disabled by default. They execute only when: 1. **Global gate:** **Dangerous Operations** is enabled under **Settings → MCP Settings**. 2. **Connection scope:** the specific tool is explicitly ticked on the connection profile. 3. **Reference:** see [MCP dangerous operations](/relyagent-whmcs/features/mcp-tools#dangerous-operations). ## How do I limit what a single connection can do? Each connection has its own **allowed-tools** list — tick exactly the tools it may use, and OAuth scopes are derived automatically. Only ticked tools can be listed or called. See [Connections & OAuth](/relyagent-whmcs/features/connections-oauth). ## Do admins still log in normally? Yes. Every connection authorizes through your **native WHMCS admin login**, preserving existing 2FA, IP restrictions, and brute-force rules. The admin then approves a consent screen listing allowed tools. ## What happens if my license lapses? The MCP server is license-gated. When a license becomes inactive, endpoints return **HTTP 403** and reject connections: * **Restoring access:** enter an active key under **Settings → License**. * **Resilience:** temporary licensing-server outages do not interrupt active installations. * **Details:** see [Licensing](/relyagent-whmcs/licensing). ## Is there an audit trail? Yes — one row per tool call in the **Audit Log**, filterable by date, status and tool, with **CSV export**. Statuses include Success, Error, Sanitized, Forbidden and Rate Limited. See [Audit and rate limits](/relyagent-whmcs/features/audit-and-rate-limits). ## Can I rate-limit connections? Yes. Set **Calls / minute** (default 60) and **Calls / day** (default 5000) per token under **Settings → MCP Settings**. Requests over the cap return HTTP 429 and are logged as Rate Limited. ## Do I need HTTPS and mod\_rewrite? Yes to both. OAuth and remote AI clients require **HTTPS**, and **mod\_rewrite** serves the OAuth/MCP discovery documents at their standard `.well-known` paths. Full list on [Requirements](/relyagent-whmcs/requirements). ## What happens to my data if I deactivate Relyagent? Deactivating removes the generated hook loader but **keeps your database tables** — audit log, connections and config — so a deactivate/reactivate is lossless. To remove everything, drop the `mod_relyagent_*` tables manually after deactivating (irreversible). ## How are updates and backups handled? Navigate to **Settings → Update Status → Check for Updates → Update Now**: * **Automated safety:** creates a file and database backup before applying updates, reverting on failure. * **Retained backups:** stored under **Database Backups** (contain connection secrets; store securely). * **Details:** see [Updating](/relyagent-whmcs/updating). ## Can two connections have different tools? Yes — that's the point. Each connection has its own tool allowlist and its own OAuth credentials, so you can give, say, a read-only "reporting" connection and a separate "support desk" connection with reply-to-ticket tools. See [Connections & OAuth](/relyagent-whmcs/features/connections-oauth). ## Can a client register itself without my involvement? No. There's no open self-registration. A client can only connect with a **Client ID** and **Client Secret** you issue when you create the connection under **MCP Clients**. ## What are the "scopes" I keep seeing? Scopes are OAuth permissions named `:read` and `:write` (for example, `clients:read`, `invoices:write`). You never hand-edit them — they're derived automatically from the tools you tick for a connection. See [MCP tools](/relyagent-whmcs/features/mcp-tools). ::: tip Didn't find your question? Check [Troubleshooting](/relyagent-whmcs/troubleshooting) for fixes or the [Error reference](/relyagent-whmcs/errors) for a specific message. :::