# Turning it on

> The master switch, the port the endpoint listens on, and the four things that keep it local.

A fresh install advertises nothing to agents. Agent access is one switch away, and the
switch is the first of the three gates that stand in for authentication: the master
switch, the per-area toggles and the journal.

## The switch and the port {#the-switch-and-the-port}

The master switch is **off** by default. Enable it on the **Agent** page (opening the page
requires the agent-management permission of your local role); the endpoint then listens at
`http://127.0.0.1:<port>/mcp` over Streamable HTTP. Agents can connect while the app runs
hidden in the tray too.

| Setting | What it does | Values | Default |
| --- | --- | --- | --- |
| Enable agent access (MCP) | Starts or stops the endpoint. Off = no endpoint, nothing advertised. | on / off | off |
| Port | Local port the endpoint listens on. Changing it restarts agent access, and every connection snippet on the page updates to match. | 1024–65535 (values outside the range are clamped) | 18181 |

Everything on the page autosaves; there is no Save button. The **Granted** readout under
the endpoint counts how many capability groups are open and how many of them can write to
live equipment, so the station's exposure is readable at a glance.

## How the endpoint is protected {#how-the-endpoint-is-protected}

- **Loopback only.** The socket binds to `127.0.0.1`, never to a network interface. The
  plant network cannot reach it.
- **Browser requests are refused.** The bind alone would not stop a malicious web page
  from rebinding its own domain to 127.0.0.1, so the endpoint also checks the two headers
  a browser cannot forge: a request whose `Host` is not local, or that carries a
  non-local `Origin`, is refused with 403 before it can even open a session. Each
  refusal is journaled under the **Agent** area in [Events](events), so a station being
  probed from a browser tab leaves a trace.
- **No endpoint authentication, by design.** The gates are the master switch, the
  per-area toggles and the journal. If you ever expose the endpoint through a tunnel,
  the authentication must live on the tunnel (see [ChatGPT and other cloud-routed
  clients](agent-clients)).
- **The tool list equals the enabled areas.** A disabled area's tools are not advertised
  at all — they are absent, not "answering no". Changing any toggle restarts the endpoint
  so what an agent sees always matches what you allowed.