Security model

Running an AI agent’s eyes on a live LAN is a trust decision, so here is exactly what the probe and engine do with your network and your secrets.

Data residency — raw stays on the LAN

The probe stores raw telemetry locally, in SQLite databases under /var/lib/probe-mcp. Only aggregates (rollups, top-N, health summaries) are shipped to the engine. Raw, live data — a syslog search, an SNMP walk, a packet slice — is fetched on demand over the tunnel when Claude asks for it, and only the result of a query leaves the LAN.

Network exposure — outbound only

• The probe opens no inbound public ports. It connects out through a bundled cloudflared tunnel; the engine reaches the probe only back down that tunnel.
• The probe’s local HTTP API binds to 127.0.0.1:8080 and is reachable only through the tunnel, never exposed on the LAN.
• On the LAN, the probe listens only for the telemetry you point at it (syslog, SNMP traps, sFlow) and makes outbound SNMP polls and — if enabled — SSH to your devices.

The whole picture: raw telemetry stays inside the LAN, the probe dials out to the engine over a single cloudflared tunnel (the engine’s own requests ride back down that same tunnel), and Claude reaches the engine — never the probe directly.

Telemetry authentication — HMAC both ways

• The probe signs every uplink to the engine with HMAC-SHA256 over a shared secret, with a 5-minute timestamp window and a signature-nonce cache to reject replays, plus sequence-gap detection.
• Requests the engine sends down to the probe are HMAC-signed the same way, with their own replay cache.

MCP authentication — OAuth 2.1

Claude connects with OAuth 2.1 (Dynamic Client Registration + PKCE-S256). Access tokens are scoped to probe:call, stored as SHA-256 hashes (the engine never keeps a raw copy of a token it issued), and refresh tokens rotate with reuse detection — replaying a rotated token revokes the whole token family. See Connecting to Claude.

Secrets at rest

• Persisted probe credentials (tunnel token, shared secret) are written mode 0600 in a 0700 data directory.
• The connection vault encrypts secrets with AES-256-GCM. Provisioning a probe-vault secret is end-to-end: your browser seals it to the probe’s hybrid post-quantum recipient keys (P-256 ECDH + ML-KEM-768) and the cloud only ever relays ciphertext. See API connections and the vault.

Companion link security

When you link with R1-MCP, the calling system proves its identity with a signed assertion, and each system’s key is resolved separately — R1-MCP, the one live caller, signs with its own dedicated key, so compromising R1-MCP yields nothing that can forge an assertion for another system. The registered-but-dormant systems (sz-mcp, cp-mcp, the coordinator) share a default key until they wire up and get their own.

Two more properties matter for a security review:

• Rotation is never a hard cutover. Each key accepts a previous value during a rotation window, so the key can be replaced without a moment where valid callers are rejected.
• Short keys fail closed. A signing key shorter than 32 characters is treated as unset rather than accepted as weak, so a misconfigured secret refuses callers instead of admitting them.

Beyond the signature, the link is scoped: a linked system may call only the tools on its own allowlist — see what the link grants — host validation rejects private/loopback/link-local targets, and every link, owner-move, and revoke is written to an audit trail.

Container privileges — what the probe needs

Be precise with a security team about the container’s footprint today:

• It runs with host networking (--network host) so LAN devices can reach its collector ports.
• Binding the privileged trap/syslog ports (162, 514) requires root or CAP_NET_BIND_SERVICE, and the shipped container runs with those privileges.
• Packet capture and LLDP discovery need CAP_NET_RAW — grant it only when you enable those features.

Note

The probe binary is a pure-Go static build (CGO_ENABLED=0) using an embedded SQLite, shipped in a small Alpine-based image alongside cloudflared. If your review needs the exact base image and capability set for a given release, ask support.

The privileged capabilities are opt-in

The three things a security review usually asks about — capturing packets, opening SSH sessions to devices, and terminating TLS to a private controller — are all disabled by default and stay disabled until someone edits the probe’s config on the host. So is the config-restore TFTP server, which serves bytes over cleartext UDP. A probe deployed and left alone collects telemetry and polls SNMP; it does none of those things.

The full list, with the error each one returns while it’s off, is in Limits and budgets.

Next steps

API connections and the vault How a secret is sealed to the probe end-to-end, and what break glass exposes.

Linking with R1-MCP Exactly which functions a linked companion system may call against your probe.

Configuring the probe The keys that turn the privileged capabilities on, and their defaults.