Security

Relyagent secures Model Context Protocol (MCP) integrations through strict administrative controls, ensuring AI access is explicitly provisioned, granularly scoped, and audited.

Only connections you provision

There is no self-registration: every AI client requires an administrator-provisioned connection under Addons → Relyagent → MCP Clients. Each profile uses a unique Client ID and Secret (see Connections & OAuth).

Native admin login and consent

Connecting routes directly through your native WHMCS admin login, enforcing existing 2FA, brute-force protection, and IP restrictions:

• Admin consent: operators approve a scoped consent screen displaying allowed tools.
• Dual requirement: token issuance requires both admin authentication and the unique connection secret.

Allowlists enforced everywhere

Connections are restricted to explicitly selected tools, enforced across all operations:

• Strict filtering: unticked tools cannot be listed or invoked.
• Dangerous operations gate: state-changing tools remain disabled by default behind a global switch (see MCP dangerous operations).

Safe input and output

• Prompt-injection sanitisation: filters tool output to prevent untrusted WHMCS content from manipulating AI clients (logged as Sanitized).
• SSRF guard: restricts outbound HTTP requests to prevent unauthorized internal network access.

Visibility and pace

Every tool call produces one audit-log row with a clear status, and per-minute and per-day rate limits cap how fast any client can act — so nothing happens silently and nothing runs away.

A trustworthy, licensed deployment

• File integrity: monitors deployed code against an HMAC-SHA256 baseline to detect tampering or drift (see File integrity & sync).
• License-gated server: blocks MCP and OAuth endpoints if the license becomes inactive, preventing unauthorized tool serving.

TIP

Security is layered, so you don't rely on any single control. Keep Dangerous Operations off unless you truly need writes, tick only the tools each connection needs, and review the audit log periodically.