# Turning it on

> The master switch, the port the endpoint listens on, and the four things that keep it local.

A fresh install advertises nothing to agents. Agent access is one switch away, and the
switch is the first of the three gates that stand in for authentication: the master
switch, the per-area toggles and the journal.

## The switch and the port {#the-switch-and-the-port}

The master switch is **off** by default. Enable it on the **Agent** page (opening the page
requires the agent-management permission of your local role); the endpoint then listens at
`http://127.0.0.1:<port>/mcp` over Streamable HTTP. Agents can connect while the app runs
hidden in the tray too.

| Setting | What it does | Values | Default |
| --- | --- | --- | --- |
| Enable agent access (MCP) | Starts or stops the endpoint. Off = no endpoint, nothing advertised. | on / off | off |
| Port | Local port the endpoint listens on. Changing it restarts agent access, and every connection snippet on the page updates to match. | 1024–65535. A port agent access cannot move to is refused before anything is stored: the reason is said under the field, the field goes back to the port in force, and nothing restarts. Six entries are refused: a value outside the range ("Enter a number between 1024 and 65535."); the port of the web server, set on [Remote access](remote-access) ("Port N is already the web server. Pick another port, or move the web server first."); the port of the OPC UA server on [Configuration](connector-opcua-configuration), running or stopped ("Port N is already the OPC UA server. Pick another port, or move the server first."); the port of the [Modbus server](connector-modbus-server) on the Connector page, on or off ("Port N is already the Modbus server. Pick another port, or move the Modbus server first."); the port of the [MQTT broker](connector-mqtt-broker) on the Connector page, on or off ("Port N is already the MQTT broker. Pick another port, or move the MQTT broker first."); and a port something else on this machine already holds ("Port N is in use on this machine. Close what is holding it, or pick another port."). | 18181 |

Beside the switch, a state pill reads **Sealed** while the switch is off and **Open** while
it is on, so the endpoint's state is read off the pill at a glance.

Under the endpoint, a count with no heading of its own sums up the **Allowed areas**
toggles further down the page. Its first line gives each of the four tiers the number of
its areas that are on, behind a dot lit in the tier's color while at least one of them is
on and grey while none is: with every area on, it reads 5 **Read**, 6 **Configure**, 4
**Operate** and 1 **Restore**. The line under it adds them up, "16 of 16 capability groups
open", and while an Operate or Restore area is on, it goes on to say how many of the open
groups can write to live equipment: "5 live-write". It counts the area toggles and nothing
else, so the station's exposure is readable at a glance. While the master switch is off,
the count is greyed with the endpoint and the port but goes on reading the toggles, which
keep what was saved: it shows what agent access opens as soon as the switch is turned on
again.

While the switch is off, **Copy URL** and **Port** stand greyed under the endpoint, and resting the pointer on either says why: "Agent access is off. Turn it on under Access first." The **Allowed areas** card says the same sentence above its greyed toggles.

Everything on the page autosaves; there is no Save button.

## How the endpoint is protected {#how-the-endpoint-is-protected}

- **Loopback only.** The socket binds to `127.0.0.1`, never to a network interface. The
  plant network cannot reach it.
- **Browser requests are refused.** The bind alone would not stop a malicious web page
  from rebinding its own domain to 127.0.0.1, so the endpoint also checks the two headers
  a browser cannot forge: a request whose `Host` is not local, or that carries a
  non-local `Origin`, is refused with 403 before it can even open a session. Each
  refusal is journaled under the **Agent** area in [Events](events), so a station being
  probed from a browser tab leaves a trace.
- **No endpoint authentication, by design.** The gates are the master switch, the
  per-area toggles and the journal. If you ever expose the endpoint through a tunnel,
  the authentication must live on the tunnel (see [ChatGPT and other cloud-routed
  clients](agent-clients)).
- **The tool list equals the enabled areas.** A disabled area's tools are not advertised
  at all: they are absent, not "answering no". Changing any toggle restarts the endpoint
  so what an agent sees always matches what you allowed. The two help tools are the one
  exception: they read the app's documentation and nothing of the station, so they come
  with the endpoint whatever the toggles say ([Help](agent-tools#help)).