Turning it on
The master switch, the port the endpoint listens on, and the four things that keep it local.
A fresh install advertises nothing to agents. Agent access is one switch away, and the switch is the first of the three gates that stand in for authentication: the master switch, the per-area toggles and the journal.
The switch and the port
The master switch is off by default. Enable it on the Agent page (opening the page
requires the agent-management permission of your local role); the endpoint then listens at
http://127.0.0.1:<port>/mcp over Streamable HTTP. Agents can connect while the app runs
hidden in the tray too.
| Setting | What it does | Values | Default |
|---|---|---|---|
| Enable agent access (MCP) | Starts or stops the endpoint. Off = no endpoint, nothing advertised. | on / off | off |
| Port | Local port the endpoint listens on. Changing it restarts agent access, and every connection snippet on the page updates to match. | 1024–65535 (values outside the range are clamped) | 18181 |
Everything on the page autosaves; there is no Save button. The Granted readout under the endpoint counts how many capability groups are open and how many of them can write to live equipment, so the station's exposure is readable at a glance.
How the endpoint is protected
- Loopback only. The socket binds to
127.0.0.1, never to a network interface. The plant network cannot reach it. - Browser requests are refused. The bind alone would not stop a malicious web page
from rebinding its own domain to 127.0.0.1, so the endpoint also checks the two headers
a browser cannot forge: a request whose
Hostis not local, or that carries a non-localOrigin, is refused with 403 before it can even open a session. Each refusal is journaled under the Agent area in Events, so a station being probed from a browser tab leaves a trace. - No endpoint authentication, by design. The gates are the master switch, the per-area toggles and the journal. If you ever expose the endpoint through a tunnel, the authentication must live on the tunnel (see ChatGPT and other cloud-routed clients).
- The tool list equals the enabled areas. A disabled area's tools are not advertised at all — they are absent, not "answering no". Changing any toggle restarts the endpoint so what an agent sees always matches what you allowed.