Security model

R1-MCP holds credentials to your RUCKUS One tenant, so how it handles them is a fair question to ask before you connect it.

Your R1 client secret

• Encrypted at rest with AES-256-GCM using a key derived via HKDF from a Worker secret. The stored value is ciphertext.
• Write-only in the dashboard — once saved, it is never displayed again, not even to you.
• Decrypted only at token-mint time, server-side, to obtain a RUCKUS bearer token.

What Claude can see

Claude writes the program that runs inside code_mode, but that program executes on Cloudflare, not in Claude. It calls call_r1, and R1-MCP attaches the bearer token server-side.

So Claude sees API responses. It does not see your client secret, and it does not see the RUCKUS bearer token.

list_connections returns id, label, tenant id, region, and the default flag — deliberately never secrets.

RUCKUS token lifecycle

Tokens are obtained with the OAuth2 client_credentials grant against your region’s token URL, and cached with a TTL set just under their real expiry. A 401 triggers exactly one refresh-and-retry before the error surfaces.

Caching is keyed per user and per connection, so tokens for different tenants are never interchangeable. See Multiple connections.

Two authentication flows, one identity

• Web dashboard — Google sign-in; the session cookie is stored as a hash, never in the clear.
• MCP connector — OAuth 2.1 with Dynamic Client Registration and PKCE. Claude registers as a client, your Google session authorizes it, and the issued access token is stored hashed and bound to your user id.

Both resolve to the same account. Every MCP request is authenticated per user before anything else happens; R1-MCP never holds a raw copy of a token it issued.

Your R1 permissions are the ceiling

R1-MCP can do exactly what your RUCKUS One API client is allowed to do — no more. If you want a read-only experience, the reliable way to get one is to issue a read-only API client in RUCKUS One, not to hope the model behaves.

Write Guard is a useful second layer on top of that, not a replacement for it.

Code execution

The TypeScript Claude writes runs in a sandboxed V8 isolate on Cloudflare, with no filesystem and no network access beyond the r1 primitives R1-MCP provides. It cannot reach anything you haven’t given it a tool for.

Revoking access

• Remove the connector in Claude, or revoke the token from the dashboard — effective immediately; the next request fails the bearer check.
• Disable or delete a connection to cut off a specific tenant. Deleting removes the stored secret permanently.
• Rotate the R1 client secret in RUCKUS One and update the connection. The old secret stops working wherever it was.

Notes and shared data

Endpoint notes you save with save_endpoint_note are private to your account. An administrator can promote a note to global visibility — so treat notes as API knowledge, not as a place for tenant-specific detail.