Turning it on

The master switch, the port the endpoint listens on, and the four things that keep it local.

A fresh install advertises nothing to agents. Agent access is one switch away, and the switch is the first of the three gates that stand in for authentication: the master switch, the per-area toggles and the journal.

The switch and the port

The master switch is off by default. Enable it on the Agent page (opening the page requires the agent-management permission of your local role); the endpoint then listens at http://127.0.0.1:<port>/mcp over Streamable HTTP. Agents can connect while the app runs hidden in the tray too.

Setting	What it does	Values	Default
Enable agent access (MCP)	Starts or stops the endpoint. Off = no endpoint, nothing advertised.	on / off	off
Port	Local port the endpoint listens on. Changing it restarts agent access, and every connection snippet on the page updates to match.	1024–65535. A port agent access cannot move to is refused before anything is stored: the reason is said under the field, the field goes back to the port in force, and nothing restarts. Six entries are refused: a value outside the range ("Enter a number between 1024 and 65535."); the port of the web server, set on Remote access ("Port N is already the web server. Pick another port, or move the web server first."); the port of the OPC UA server on Configuration, running or stopped ("Port N is already the OPC UA server. Pick another port, or move the server first."); the port of the Modbus server on the Connector page, on or off ("Port N is already the Modbus server. Pick another port, or move the Modbus server first."); the port of the MQTT broker on the Connector page, on or off ("Port N is already the MQTT broker. Pick another port, or move the MQTT broker first."); and a port something else on this machine already holds ("Port N is in use on this machine. Close what is holding it, or pick another port.").	18181

Beside the switch, a state pill reads Sealed while the switch is off and Open while it is on, so the endpoint's state is read off the pill at a glance.

Under the endpoint, a count with no heading of its own sums up the Allowed areas toggles further down the page. Its first line gives each of the four tiers the number of its areas that are on, behind a dot lit in the tier's color while at least one of them is on and grey while none is: with every area on, it reads 5 Read, 6 Configure, 4 Operate and 1 Restore. The line under it adds them up, "16 of 16 capability groups open", and while an Operate or Restore area is on, it goes on to say how many of the open groups can write to live equipment: "5 live-write". It counts the area toggles and nothing else, so the station's exposure is readable at a glance. While the master switch is off, the count is greyed with the endpoint and the port but goes on reading the toggles, which keep what was saved: it shows what agent access opens as soon as the switch is turned on again.

While the switch is off, Copy URL and Port stand greyed under the endpoint, and resting the pointer on either says why: "Agent access is off. Turn it on under Access first." The Allowed areas card says the same sentence above its greyed toggles.

Everything on the page autosaves; there is no Save button.

How the endpoint is protected

Loopback only. The socket binds to 127.0.0.1, never to a network interface. The plant network cannot reach it.
Browser requests are refused. The bind alone would not stop a malicious web page from rebinding its own domain to 127.0.0.1, so the endpoint also checks the two headers a browser cannot forge: a request whose Host is not local, or that carries a non-local Origin, is refused with 403 before it can even open a session. Each refusal is journaled under the Agent area in Events, so a station being probed from a browser tab leaves a trace.
No endpoint authentication, by design. The gates are the master switch, the per-area toggles and the journal. If you ever expose the endpoint through a tunnel, the authentication must live on the tunnel (see ChatGPT and other cloud-routed clients).
The tool list equals the enabled areas. A disabled area's tools are not advertised at all: they are absent, not "answering no". Changing any toggle restarts the endpoint so what an agent sees always matches what you allowed. The two help tools are the one exception: they read the app's documentation and nothing of the station, so they come with the endpoint whatever the toggles say (Help).