Probe — on-LAN ground truth
The Probe feature lets Claude check what RUCKUS One believes against what is actually on your LAN. R1 tells you a controller’s view; a probe on the wire tells you whether that view is true.
This is an Early Access feature: unlock Early Access, then enable it under Features in the dashboard.
You connect one connector, not two
Section titled “You connect one connector, not two”You add only R1-MCP to Claude. R1-MCP calls Probe MCP itself, machine to machine over a private binding — there is no second connector to install.
What you do need is a one-time consent link on the Probe MCP side, which is what authorizes R1-MCP to drive your probes on your behalf.
Claude issues probe_call to R1-MCP; R1-MCP forwards it to Probe MCP over the
private binding, signing an identity assertion for your account; Probe MCP
resolves that against its own consent table and queries your LAN. Until you
complete the consent link, that resolution fails and the call returns
not_linked with a link_url — open it once in a browser and it stops
happening.
probe_link_status reports the current state: { linked: true, email } when
connected, { linked: false, link_url } when not. Call it first when a probe
call comes back not_linked, or before starting a probe-backed workflow.
The four R1-MCP tools
Section titled “The four R1-MCP tools”| Tool | What it does |
|---|---|
probe_link_status | Whether your account is connected to Probe MCP, and the link URL if not |
probe_describe | The probe tools available, with a JSON Schema for each |
probe_call | Invoke one read-only probe tool |
probe_reconcile | The cloud-versus-LAN divergence sweep (see below) |
Schemas live on the probe side and can gain fields between deploys, so
probe_describe is fetched before composing probe_call arguments rather than
assumed. It works before your account is linked — schemas only, no data.
What probe_call can reach
Section titled “What probe_call can reach”The exposed surface is read-only and deliberately narrower than what Probe MCP itself can do:
| Group | Tools |
|---|---|
| Inventory | list_probes, probe_status, list_devices, inventory, reconcile_inventory |
| Onboarding | auth_sessions — real 802.1X / RADIUS / DHCP outcomes seen on the wire |
| Switch ports | poe_status, port_diag |
| Topology | topology — live LLDP and association data |
| Logs | query_syslog, search_syslog, syslog_rollups |
| SNMP | snmp_get, snmp_walk, snmp_metrics |
CLI, packet capture, traffic, and egress tools are not exposed through
R1-MCP, and probe_describe filters them out of the schema listing.
probe_reconcile — the divergence sweep
Section titled “probe_reconcile — the divergence sweep”probe_reconcile is the composite worth knowing by name. It joins the R1 AP and
switch inventory against what the probe actually sees, in one call, and returns
divergent devices first.
| Verdict | Meaning |
|---|---|
confirmed_online | Cloud and LAN agree — collapsed to a count unless you ask for the detail |
dead | Offline in both |
disconnected_from_cloud | Cloud says offline, but the device is alive on the LAN — the cloud path is broken, the device is fine |
missing_from_lan | Cloud says online, but the probe can’t see it |
Matched devices can also carry mismatches — an ip mismatch is often just a
management interface versus a LAN interface, not a fault.
It also reports rogue devices — things on the LAN that RUCKUS One does not
manage. The default filter shows alive infrastructure-role devices only and is
capped; ask for all rogues, or none, if the default isn’t what you want.
Verifying a write
Section titled “Verifying a write”The probe’s other use is confirming that a change to R1 actually took effect on
the wire. The probe-verify reference doc maps each
class of write to the check that verifies it — auth_sessions for WLAN and AAA
changes, port_diag and poe_status for port configuration, probe_reconcile
for anything that affects inventory, and topology / syslog / SNMP for the rest.
Error envelopes
Section titled “Error envelopes”Probe MCP’s errors pass through verbatim — R1-MCP never rewrites them — so they can be acted on directly:
| Error | What to do |
|---|---|
not_linked (with link_url) | Open the link once in a browser to consent |
probe_offline | The probe itself isn’t reachable; check it before retrying |
tool_failed | The probe tool ran and failed; the probe’s own message says why |
companion_unavailable | This deployment has no probe integration wired |
See also
Section titled “See also”- Features and feature flags — unlocking Early Access
- Test beds — the probe also serves TFTP config restore for an evicted switch
- Bundled reference docs — the
probe-verifyplaybook