Probe tools reference

Inside code_mode, Claude calls functions on a probe object. They fall into the groups below. Remember the split: stored functions work even when the probe is offline; on-demand functions reach live into the LAN and need the probe Online.

Reference

Function	What it does
`get_reference`	Fetch bundled guides and playbooks (no argument lists available docs; a `doc`/`section` fetches a section).

Stored (offline-OK)

Aggregates the engine already ingested — read even when the probe is offline.

Function	What it does
`list_probes`	List your probes with site, status, last heartbeat, and LAN IP.
`probe_status`	One probe’s latest status, heartbeat, and version.
`list_devices`	Discovered device inventory (SNMP + discovery) with taxonomy.
`syslog_rollups`	Syslog volume summary (average / peak events-per-minute) over a window.
`snmp_metrics`	SNMP health rollup (CPU, memory, bandwidth) per device.
`top_talkers`	Top source IPs by bytes, from sFlow.

On-demand (probe must be Online)

These proxy live to the probe over its tunnel.

Function	What it does
`query_syslog`	Live syslog query by severity / host / program / time (SNMP traps included).
`search_syslog`	Full-text (FTS5) search of live syslog.
`snmp_get`	Live SNMP GET of specific OIDs.
`snmp_walk`	Live SNMP WALK of a subtree.
`poe_status`	Live PoE diagnostics (POWER-ETHERNET-MIB + RUCKUS ICX).
`port_diag`	Live per-port health (IF-MIB) — status, speed, error counters.
`query_flows`	Live individual sFlow records.
`topology`	Live L2 topology graph (LLDP + wireless associations).
`inventory`	Live ground-truth LAN inventory with RUCKUS fingerprints.
`reconcile_inventory`	Join a controller’s cloud inventory against probe ground truth.
`top_conns`	Top live packet-capture connections by bytes (Zeek-style).
`search_conns`	Free-text search of the live pcap connection table.
`pcap_query`	Slice the pcap ring buffer to a downloadable `.pcap`.
`auth_sessions`	Correlated 802.1X/EAPOL + RADIUS + DHCP access timeline.
`https_forward`	Reach a private on-prem controller over HTTP (RFC1918 targets only).
`serve_tftp`	Serve one config file over TFTP for a switch restore (lab/bench).
`stop_tftp`	Tear down the active TFTP serve.

API connections and vault

Function	What it does
`store_connection`	Register an upstream API connection (cloud / probe-vault / fallback secret modes).
`list_connections`	List registered connections (never the secrets).
`delete_connection`	Delete a connection and its probe-side vault secret.
`vault_pubkey`	Fetch a probe’s hybrid post-quantum vault recipient keys (P-256 + ML-KEM-768).
`provision_vault_secret`	Deliver a secret to the probe vault as an end-to-end sealed envelope.
`connection_egress`	Make an authenticated call to an upstream API, secret injected server/probe-side.

Device CLI (SSH over the tunnel)

Function	What it does
`store_device_credential`	Store an SSH credential (AES-256-GCM at rest).
`device_cli`	Open a persistent SSH session to a device; returns a `session_id`.
`ssh_send`	Send input to an open SSH session.
`ssh_read`	Read accumulated output from an SSH session.
`ssh_close`	Close an SSH session and finalize its recording.
`run_device_cli`	RUCKUS-aware batch CLI to an ICX switch or AP.

Report

Function	What it does
`generate_scorecard`	Render a co-branded assessment/scorecard PDF from findings; returns a shareable URL.