An MCP Hub connection can have an expiry date and a source-address restriction. These controls help define where and for how long an assistant may connect, alongside its ceiling, staff permissions and client scope.

Set the intended lifetime

1. Open PD Modules → MCP Hub → Connections and choose Edit for the intended connection.
2. Set Expires on to the required date.
3. Review the existing staff account, ceiling and selected areas.
4. Choose Save changes and confirm the saved date by reopening the row.

Leaving Expires on blank means no expiry. The date is interpreted by the installation, so do not assume that a date-only field represents a separate exact UTC appointment. When access must stop immediately, use Revoke rather than waiting for expiry.

Match the actual request source

In Only from these addresses, enter the source addresses you intend to allow, separated by commas. The module accepts individual IPv4 or IPv6 addresses and IPv4 CIDR ranges. Do not assume that an IPv6 subnet range is supported merely because a single IPv6 address is accepted.

A hosted assistant makes requests from its provider’s servers; a locally running client may use your internet connection’s outgoing address. Your browser’s address is not automatically the address used by the assistant. Confirm the intended caller’s network arrangement before saving a restriction.

An empty address field permits any source address that can otherwise authenticate. A changing mobile or portable-Wi-Fi address can stop matching a saved entry. Do not widen a range at random to work around a refusal.

Check the result

Reconnect the intended assistant and inspect Audit trail. A hub response saying the source address is not allowed points to this restriction; an expired credential can produce an authentication refusal. A generic error from a proxy or firewall needs separate investigation.

Editing either field keeps the token. If the expected source cannot be established, compare the caller’s actual request source with the saved address restriction before changing it. Never include the token or replace these controls with a broadly privileged connection just to test reachability.

See the PD MCP Hub WHMCS guide for related tasks, or explore PD MCP Hub.