Review these considerations to avoid common deployment, authentication, and integration issues.

• Port match: the client is hard-coded to localhost:5001; AIHost Aife:Port must equal 5001 (Fixed client connection facts (not configurable in XML)/ Aife (wire plane)).
• Where API keys come from: with the shipped Llm:AcceptedCredentialSources = "Runtime", keys must be supplied via the AIView <LLMApiKeys> XML (Configuring the View). Keys in plugin settings.json / env vars are ignored, and providers without an injected key fail (rather than silently using a disk/env key).
• Access gating: an <LLMApiKeys> section also restricts which users/groups can see the view — adding keys narrows visibility.
• Sessions are RAM-only:Persistence:Provider = "InMemory" — chat history is lost on AIHost restart. Recovering persisted sessions from the AIExtension is not yet supported; leave Provider on InMemory.
• MCP is two gates:Mcp:Enabled wires servers; Chat:Tools: AllowMCPDiscoveredTools decides whether their tools reach the agent.
• Local providers need the hardening opt-outs:http://BaseUrl requires AllowPlaintextHttp=true (plugin settings) and, for MCP StreamableHttp, Mcp:StreamableHttp:AllowPlaintextHttp=true.