Plug WHMCS into any AI agent.

A WHMCS addon that exposes your WHMCS install as a self-hosted MCP (Model Context Protocol) server — so any LLM client that speaks MCP (Claude Desktop, Cursor, your custom agent) can call WHMCS tools through OAuth 2.0 + PKCE.

Roughly 25 scope-gated tools across six groups: clients, tickets, invoices, services, domains, and admin.

You register the client from Addons → Relyagent → MCP Clients, picking which OAuth scopes it can request. The client then uses the standard OAuth 2.0 authorization-code flow with PKCE — you approve the request on a consent screen with the exact scopes spelled out, and the client receives a bearer access token and refresh token.

Every subsequent JSON-RPC call carries that bearer. Refresh tokens rotate on use.

Yes — Relyagent ships both MCP transports: Streamable HTTP (default) and Server-Sent Events (when the client sends Accept: text/event-stream). Anything that implements the MCP 2025-03-26 spec works out of the box.

That's the entire design centre. Every tool requires a specific OAuth scope. Write operations require an additional "Dangerous Operations" admin toggle, which starts off. Every parameter and result flows through a prompt-injection sanitiser. Every call is rate-limited per token. Every call is audit-logged with sensitive parameters redacted.

The agent can only do what you explicitly granted — and you can see exactly what it did.

Yes — and that's the default. The Dangerous Operations toggle in MCP Settings starts off. Until you flip it on, write tools (suspend_service, create_invoice, update_client, add_credit, etc.) reject every call with MCP error -32004.

You can also disable entire tool groups (clients, tickets, invoices, services, domains, admin) independently — useful for staging environments or restricted-purpose agents.

Each access token has its own minute + day counters. Defaults are 60/min and 5,000/day, tunable in MCP Settings (hard ceilings: 10,000/min and 1,000,000/day). On overflow the request returns HTTP 429 with a Retry-After header and MCP error -32029.

There's also a one-click "Revoke All Tokens" panic switch in the admin panel for when something's clearly wrong.

A library of ten known jailbreak patterns — ignore previous instructions, you are now a/an, act as, [INST], <|im_start|>, DAN mode, jailbreak, and several others — is matched against every string in every tool response. Anywhere user-generated text lives: ticket bodies, client notes, invoice descriptions, etc.

Matches are replaced with [sanitized]. The audit row gets tagged status=sanitized so you can spot which calls hit a pattern.

Relyagent v1.0.x is built and tested for WHMCS 8.x with PHP 7.4 or higher. ionCube Loader is required (it's pre-installed on virtually all WHMCS-ready hosting environments, including all Relyweb hosting plans).

One license per WHMCS installation, matched by domain and directory. The plugin checks your license periodically and caches the result locally. Updates are checked daily — when one's available, click "Update Now" from the admin panel; the plugin backs up the current installation before applying the update and auto-restores if anything fails.

Annual licenses continue to work after expiry, but stop receiving updates and support. Lifetime licenses never expire.

Yes — we offer a 14-day money-back guarantee. If Relyagent doesn't fit your setup or doesn't meet your needs, just contact support within 14 days of purchase for a full refund.