Security model

Running an AI agent’s eyes on a live LAN is a trust decision, so here is exactly what the probe and engine do with your network and your secrets.

Data residency — raw stays on the LAN

The probe stores raw telemetry locally, in SQLite databases under /var/lib/probe-mcp. Only aggregates (rollups, top-N, health summaries) are shipped to the engine. Raw, live data — a syslog search, an SNMP walk, a packet slice — is fetched on demand over the tunnel when Claude asks for it, and only the result of a query leaves the LAN.

Network exposure — outbound only

• The probe opens no inbound public ports. It connects out through a bundled cloudflared tunnel; the engine reaches the probe only back down that tunnel.
• The probe’s local HTTP API binds to 127.0.0.1:8080 and is reachable only through the tunnel, never exposed on the LAN.
• On the LAN, the probe listens only for the telemetry you point at it (syslog, SNMP traps, sFlow) and makes outbound SNMP polls and — if enabled — SSH to your devices.

The whole picture: raw telemetry stays inside the LAN, the probe dials out to the engine over a single cloudflared tunnel (the engine’s own requests ride back down that same tunnel), and Claude reaches the engine — never the probe directly.

Telemetry authentication — HMAC both ways

• The probe signs every uplink to the engine with HMAC-SHA256 over a shared secret, with a 5-minute timestamp window and a signature-nonce cache to reject replays, plus sequence-gap detection.
• Requests the engine sends down to the probe are HMAC-signed the same way, with their own replay cache.

MCP authentication — OAuth 2.1

Claude connects with OAuth 2.1 (Dynamic Client Registration + PKCE-S256). Access tokens are scoped to probe:call, stored as SHA-256 hashes (the engine never keeps a raw copy of a token it issued), and refresh tokens rotate with reuse detection — replaying a rotated token revokes the whole token family. See Connecting to Claude.

Secrets at rest

• Persisted probe credentials (tunnel token, shared secret) are written mode 0600 in a 0700 data directory.
• The connection vault encrypts secrets with AES-256-GCM. Provisioning a probe-vault secret is end-to-end: your browser seals it to the probe’s hybrid post-quantum recipient keys (P-256 ECDH + ML-KEM-768) and the cloud only ever relays ciphertext. See API connections and the vault.

Companion link security

When you link with R1-MCP, each calling system has its own signing key, so compromising one system’s key can’t forge another’s. Keys support a dual-key rotation window (a previous key is accepted during rotation, so it’s never a hard cutover), host validation rejects private/ loopback/link-local targets, and every link and revoke is written to an audit trail.

Container privileges — what the probe needs

Be precise with a security team about the container’s footprint today:

• It runs with host networking (--network host) so LAN devices can reach its collector ports.
• Binding the privileged trap/syslog ports (162, 514) requires root or CAP_NET_BIND_SERVICE, and the shipped container runs with those privileges.
• Packet capture and LLDP discovery need CAP_NET_RAW — grant it only when you enable those features.

Note

The probe binary is a pure-Go static build (CGO_ENABLED=0) using an embedded SQLite, shipped in a small Alpine-based image alongside cloudflared. If your review needs the exact base image and capability set for a given release, ask support.