Probe tools reference

Inside code_mode, Claude calls functions on a probe object. They fall into the groups below. Remember the split: stored functions work even when the probe is offline; on-demand functions reach live into the LAN and need the probe Online.

Some of these need a service turned on first

Packet capture, SSH, reach-through, TFTP, flow collection, and the RUCKUS One LBS receiver ship disabled on the probe. The functions that depend on them are always callable in code mode and fail with a specific error until you enable them in the config — they’re marked below, and listed together in Limits and budgets.

Reference

Function	What it does
get_reference	Fetch bundled guides and playbooks (no argument lists available docs; a doc/section fetches a section).

Stored (offline-OK)

Aggregates the engine already ingested — read even when the probe is offline.

Function	What it does
list_probes	List your probes with site, status, last heartbeat, and LAN IP.
probe_status	One probe’s latest status, heartbeat, and version.
list_devices	Discovered device inventory (SNMP + discovery) with taxonomy.
syslog_rollups	Syslog volume summary (average / peak events-per-minute) over a window.
snmp_metrics	SNMP health rollup (CPU, memory, bandwidth) per device. A device that never answered the CPU or memory OID returns null, not 0 — see below.
top_talkers	Top 20 source IPs by bytes, from sFlow. Empty unless the flow collector is enabled.
forward_status	Whether this probe’s telemetry is reaching a linked system, one entry per link. Reads cloud state, so it answers even when the probe is offline.

On-demand (probe must be Online)

These proxy live to the probe over its tunnel.

Function	What it does
query_syslog	Live syslog query by severity / host / program / time (SNMP traps included).
search_syslog	Full-text (FTS5) search of live syslog. Has its own small query syntax — see below.
snmp_get	Live SNMP GET of specific OIDs.
snmp_walk	Live SNMP WALK of a subtree.
poe_status	Live PoE diagnostics (POWER-ETHERNET-MIB + RUCKUS ICX).
port_diag	Live per-port health (IF-MIB) — status, speed, error counters.
query_flows	Live individual sFlow records. Needs flow_collector.enabled.
topology	Live L2 topology graph (LLDP + wireless associations).
inventory	Live ground-truth LAN inventory with RUCKUS fingerprints.
reconcile_inventory	Join a controller’s cloud inventory against probe ground truth.
top_conns	Top live packet-capture connections by bytes (Zeek-style). Needs pcap.enabled.
search_conns	Free-text search of the live pcap connection table. Needs pcap.enabled.
pcap_query	Slice the pcap ring buffer to a downloadable .pcap. Needs pcap.enabled.
auth_sessions	Correlated 802.1X/EAPOL + RADIUS + DHCP access timeline.
https_forward	Reach a private on-prem controller over HTTP (RFC1918 targets only). Needs reach_through.enabled.
serve_tftp	Serve one config file over TFTP for a switch restore (lab/bench). Needs tftp.enabled.
stop_tftp	Tear down the active TFTP serve. Needs tftp.enabled.

What search_syslog accepts

Words and phrases are literal. A hyphen, colon, or quote inside a term is searched for, not parsed as syntax, so a program name like snmp-trap-assoc finds what you expect.

On top of the literal text you can use:

Syntax	Meaning
AND · OR · NOT	Boolean operators. They must be upper case
( )	Grouping
term*	Prefix match
"exact phrase"	Phrase match

Column filters (program:foo) and NEAR are deliberately not available — query_syslog already filters by program and hostname as arguments. A search containing nothing searchable (only punctuation) comes back with search query has no searchable terms.

Why snmp_metrics can return null

A null avg_cpu_pct or avg_mem_pct means the device was asked and never answered — most RUCKUS APs don’t implement those OIDs. It does not mean zero load, and it must not be read as one. Each row also carries cpu_unknown and mem_unknown: the number of samples in the window where the value was missing. When only some samples are missing, the average is rescaled over the ones that were actually measured rather than diluted by the gaps.

Note

Rows written before this behaviour shipped carry no such flag and read as measured, so a device can keep showing 0 until the older samples age out of the window. That is self-correcting, not a stuck value.

RUCKUS One LBS receiver

The probe can run an embedded MQTT broker that RUCKUS One’s Location Based Service reports into, which is the only source of measured client signal on the LAN. The receiver ships off and is switched on for you when R1-MCP registers an LBS source — see Linking with R1-MCP. All three are on-demand and return { error: 'lbs_disabled' } until it is wired.

Function	What it does
lbs_status	Receiver health: the broker, one entry per venue, and the frame counters. If the probe can’t be reached, the last document it uplinked (at most 5 minutes old) comes back with stale: true.
lbs_clients	Clients currently heard by RUCKUS APs, with per-chain RSSI, SNR, and PHY. Readings are kept for 5 minutes only.
lbs_airtime	Measured channel airtime per AP per band — average and peak busy percentage. Minute rollups are kept for 24 hours.

Three things these results are not

A row is an observation, not a client. One client heard by three APs on two bands is up to six lbs_clients rows, so a row count is not a client count — take the distinct set of client_mac instead. The same applies to lbs_airtime’s clients_avg, which must never be summed across rows.

LBS is 2.4 and 5 GHz only. There is no 6 GHz, so every client count from this source is a floor, not a total, and a quiet result is not a quiet radio environment.

broker.healthy: true does not mean data is arriving. Read the counters: a venue is genuinely receiving only when its state is receiving and totals.last_accepted_at is recent.

Forward links (R1-MCP only)

These configure telemetry forwarding to a linked RUCKUS One deployment. R1-MCP calls them during source provisioning — they aren’t functions you drive by hand, and they are on R1-MCP’s allowlist alone, not the other companion systems’.

Function	What it does
r1_forward_configure	Register the complete source list for a link and provision the matching LBS credentials on the probe’s broker. Writes the probe’s config, and the list is whole-link: a source you omit stops being forwarded.
r1_forward_remove	Stop forwarding one source, or tear down a whole link. Removing the last LBS source turns the receiver off entirely.

Both are idempotent, and the probe picks the change up on its next heartbeat — within 60 seconds.

API connections and vault

Register upstream APIs Claude can call with a server-injected secret. See API connections and the vault.

Function	What it does
store_connection	Register an upstream API connection (cloud / probe-vault / fallback secret modes).
list_connections	List registered connections (never the secrets).
delete_connection	Delete a connection and its probe-side vault secret.
vault_pubkey	Fetch a probe’s hybrid post-quantum vault recipient keys (P-256 + ML-KEM-768).
provision_vault_secret	Deliver a secret to the probe vault as an end-to-end sealed envelope.
connection_egress	Make an authenticated call to an upstream API, secret injected server/probe-side.

Device CLI (SSH over the tunnel)

All of these except store_device_credential need ssh.enabled on the probe, which is off by default.

Function	What it does
store_device_credential	Store an SSH credential (AES-256-GCM at rest).
device_cli	Open a persistent SSH session to a device; returns a session_id. Five concurrent sessions, reaped after 600 s idle.
ssh_send	Send input to an open SSH session.
ssh_read	Read accumulated output from an SSH session.
ssh_close	Close an SSH session and finalize its recording.
run_device_cli	RUCKUS-aware batch CLI to an ICX switch or AP — up to 8 commands, 256 KB of output.

Report

Function	What it does
generate_scorecard	Render a co-branded assessment/scorecard PDF from findings; returns a shareable URL.

Note

You don’t call these by name in chat — you ask Claude for an outcome and it picks the functions. The workflow prompts package the common flows.

Next steps

Limits and budgets Row caps, size caps, and timeouts for each of these functions, plus the services that ship disabled.

How code mode works What happens inside code_mode, and why stored functions survive a probe outage.

Workflow prompts The two guided flows that call these functions for you from Claude's + menu.