Probe tools reference

Inside code_mode, Claude calls functions on a probe object. They fall into the groups below. Remember the split: stored functions work even when the probe is offline; on-demand functions reach live into the LAN and need the probe Online.

Some of these need a service turned on first

Packet capture, SSH, reach-through, TFTP, and flow collection ship disabled on the probe. The functions that depend on them are always callable in code mode and fail with a specific error until you enable them in the config — they’re marked below, and listed together in Limits and budgets.

Reference

Function	What it does
get_reference	Fetch bundled guides and playbooks (no argument lists available docs; a doc/section fetches a section).

Stored (offline-OK)

Aggregates the engine already ingested — read even when the probe is offline.

Function	What it does
list_probes	List your probes with site, status, last heartbeat, and LAN IP.
probe_status	One probe’s latest status, heartbeat, and version.
list_devices	Discovered device inventory (SNMP + discovery) with taxonomy.
syslog_rollups	Syslog volume summary (average / peak events-per-minute) over a window.
snmp_metrics	SNMP health rollup (CPU, memory, bandwidth) per device.
top_talkers	Top 20 source IPs by bytes, from sFlow. Empty unless the flow collector is enabled.

On-demand (probe must be Online)

These proxy live to the probe over its tunnel.

Function	What it does
query_syslog	Live syslog query by severity / host / program / time (SNMP traps included).
search_syslog	Full-text (FTS5) search of live syslog.
snmp_get	Live SNMP GET of specific OIDs.
snmp_walk	Live SNMP WALK of a subtree.
poe_status	Live PoE diagnostics (POWER-ETHERNET-MIB + RUCKUS ICX).
port_diag	Live per-port health (IF-MIB) — status, speed, error counters.
query_flows	Live individual sFlow records. Needs flow_collector.enabled.
topology	Live L2 topology graph (LLDP + wireless associations).
inventory	Live ground-truth LAN inventory with RUCKUS fingerprints.
reconcile_inventory	Join a controller’s cloud inventory against probe ground truth.
top_conns	Top live packet-capture connections by bytes (Zeek-style). Needs pcap.enabled.
search_conns	Free-text search of the live pcap connection table. Needs pcap.enabled.
pcap_query	Slice the pcap ring buffer to a downloadable .pcap. Needs pcap.enabled.
auth_sessions	Correlated 802.1X/EAPOL + RADIUS + DHCP access timeline.
https_forward	Reach a private on-prem controller over HTTP (RFC1918 targets only). Needs reach_through.enabled.
serve_tftp	Serve one config file over TFTP for a switch restore (lab/bench). Needs tftp.enabled.
stop_tftp	Tear down the active TFTP serve. Needs tftp.enabled.

API connections and vault

Register upstream APIs Claude can call with a server-injected secret. See API connections and the vault.

Function	What it does
store_connection	Register an upstream API connection (cloud / probe-vault / fallback secret modes).
list_connections	List registered connections (never the secrets).
delete_connection	Delete a connection and its probe-side vault secret.
vault_pubkey	Fetch a probe’s hybrid post-quantum vault recipient keys (P-256 + ML-KEM-768).
provision_vault_secret	Deliver a secret to the probe vault as an end-to-end sealed envelope.
connection_egress	Make an authenticated call to an upstream API, secret injected server/probe-side.

Device CLI (SSH over the tunnel)

All of these except store_device_credential need ssh.enabled on the probe, which is off by default.

Function	What it does
store_device_credential	Store an SSH credential (AES-256-GCM at rest).
device_cli	Open a persistent SSH session to a device; returns a session_id. Five concurrent sessions, reaped after 600 s idle.
ssh_send	Send input to an open SSH session.
ssh_read	Read accumulated output from an SSH session.
ssh_close	Close an SSH session and finalize its recording.
run_device_cli	RUCKUS-aware batch CLI to an ICX switch or AP — up to 8 commands, 256 KB of output.

Report

Function	What it does
generate_scorecard	Render a co-branded assessment/scorecard PDF from findings; returns a shareable URL.

Note

You don’t call these by name in chat — you ask Claude for an outcome and it picks the functions. The workflow prompts package the common flows.

Next steps

Limits and budgets Row caps, size caps, and timeouts for each of these functions, plus the services that ship disabled.

How code mode works What happens inside code_mode, and why stored functions survive a probe outage.

Workflow prompts The two guided flows that call these functions for you from Claude's + menu.