What is SZ-MCP?

SZ-MCP is a hosted MCP server that connects Claude to your RUCKUS SmartZone controller. You sign in with Google, save your SmartZone admin credentials, and add one URL to Claude as a custom connector. From then on you can ask Claude about your wireless and switch estate in plain language, and it works against the live controller on your behalf.

It covers both of SmartZone’s API surfaces: the WSG wireless API and the SwitchM switch API.

Your controller needs a publicly trusted TLS certificate

SmartZone ships with a self-signed certificate, and Cloudflare Workers reject those on outbound calls with no way to skip verification. Until your controller presents a certificate from a public CA, nothing here will connect. This is the single most common reason a new setup fails — see Controller requirements.

The idea: one tool, two API surfaces

Most MCP servers expose one MCP tool per API operation. SmartZone’s two specs define 1,354 operations between them — no model can pick sensibly from a list that long, and the tool definitions alone would swamp the context window.

SZ-MCP instead exposes exactly one MCP tool, code_mode. Inside it, Claude writes small TypeScript programs against two objects that can discover endpoints and call them:

Namespace	API surface	Operations
wifi	SmartZone WSG (wireless)	1,116 across 119 tags
switches	SmartZone SwitchM (switch)	238 across 42 tags

Both objects expose the same five primitives. So instead of choosing from 1,354 tools, Claude searches the API index, reads the endpoint’s schema, and calls it — the same way you would with the API reference open.

That code runs in a sandboxed V8 isolate on Cloudflare, with your credentials applied server-side. Read How code mode works for the mechanics.

What you can ask for

• “List every AP zone on this controller and how many APs are in each.”
• “Which WLANs are configured with an open security profile?”
• “Show me the switches in the Charleston group and their firmware versions.”
• “Find the endpoint that creates a DHCP profile and tell me what it needs.”
• “What’s the port configuration on switch X?”

Access is delegated to SmartZone, deliberately

SZ-MCP reaches every WSG and SwitchM endpoint your saved admin account is permitted to call — GET, POST, PUT, PATCH and DELETE alike. It does not layer its own role model on top of SmartZone’s, and it does not gate by method.

The account you save is therefore the whole access boundary. Create a dedicated SmartZone admin scoped to the minimum role and domain your use case needs. See Security model.

Getting started

1. Sign in and save your SmartZone credentials
2. Connect it to Claude
3. Try an example

Explore the docs

Set up

Getting started The three steps end to end: sign in with Google, save your controller credentials, and add the connector to Claude.

Controller requirements The publicly trusted TLS certificate your controller must present, which addresses are refused, and which port to expose.

SmartZone credentials Every field on the credentials form, how the API version is detected, and how to rotate or delete what you saved.

Connecting to Claude Add SZ-MCP as a custom connector — the MCP URL, the consent screen, how long the tokens last, and how to revoke them.

How it works

How code mode works Why SZ-MCP exposes one MCP tool instead of 1,354, and how Claude's program runs in a sandboxed isolate.

The two API surfaces What separates wifi from switches — base paths, the shared API version, and what each bundled index contains.

Finding the right endpoint The discovery path that works on these specs, and the Swagger 2.0 quirks to expect.

Security model Where your controller password lives, how service tickets are minted server-side, and what Claude can never see.

Reference

Code mode primitives All five primitives on both namespaces — arguments, defaults, return shapes, and the Swagger 2.0 quirks in their output.

Limits and quotas Every timeout, size cap, token lifetime and cache window, and what each one does when you reach it.

More

Examples Worked code-mode programs — listing zones, paginating safely, and reading an endpoint's schema before calling it.

Troubleshooting Certificate refusals, failed connection tests, forbidden hosts, 401 loops and the errors that arrive inside a 200.

How your credentials are handled

Your SmartZone password is encrypted at rest with AES-256-GCM, decrypted only when a service ticket needs minting, and never sent to Claude or included in any model context. The service ticket is attached to upstream URLs server-side and redacted from everything the model sees. See Security model.