# SZ-MCP

> MCP server (Claude connector) for the SmartZone WSG and SwitchM APIs. Google sign-in; discovers and calls any wireless or switch controller endpoint.

All of these pages as one Markdown file: https://docs.neuralconfig.com/sz-mcp/llms-full.txt
Support: https://support.neuralconfig.com/sz-mcp

## Pages

- [What is SZ-MCP?](https://docs.neuralconfig.com/sz-mcp/): SZ-MCP is a code-mode MCP server that gives Claude access to the SmartZone WSG and SwitchM APIs — 1,340 endpoints across two namespaces — through a single connector URL.
- [Getting started](https://docs.neuralconfig.com/sz-mcp/setup/getting-started/): Sign in to SZ-MCP with Google, save your SmartZone controller credentials, and add the connector to Claude — including the TLS certificate your controller must present first.
- [Controller requirements](https://docs.neuralconfig.com/sz-mcp/setup/controller-requirements/): What your SmartZone controller must satisfy before SZ-MCP can reach it directly — a publicly trusted TLS certificate, a publicly routable address, and port 8443 or 443 — and the controller tunnel for private or self-signed controllers.
- [SmartZone credentials](https://docs.neuralconfig.com/sz-mcp/setup/smartzone-credentials/): Every field on the SZ-MCP credentials form, how the SmartZone API version is detected and re-detected, and how to test, rotate or delete the credentials you saved.
- [Connecting to Claude](https://docs.neuralconfig.com/sz-mcp/setup/connecting-claude/): Add SZ-MCP to Claude as a custom connector — the MCP URL, the OAuth consent screen, how long the access and refresh tokens last, and how to revoke access.
- [The setup checklist](https://docs.neuralconfig.com/sz-mcp/setup/setup-checklist/): What the SZ-MCP /setup checklist does in each of its six steps — connecting the controller, the privilege check, starting data collection, the first health report and its configuration checks, alerts, and the overview board.
- [Reach a private or self-signed controller](https://docs.neuralconfig.com/sz-mcp/setup/controller-tunnel/): How do I connect SZ-MCP to a SmartZone controller on a private network or with a self-signed certificate? Setting up the controller tunnel, what passes through it, its limits, and its errors.
- [Let's Encrypt certificate for a tunnelled controller](https://docs.neuralconfig.com/sz-mcp/setup/controller-certificate/): How does SZ-MCP issue and renew a Let's Encrypt certificate for a SmartZone controller behind the controller tunnel? Preconditions, the services it covers, staging, renewal, the status chips, and what stops it.
- [How code mode works](https://docs.neuralconfig.com/sz-mcp/concepts/code-mode/): Why SZ-MCP exposes one MCP tool instead of 1,340, how Claude's JavaScript program runs in a sandboxed Cloudflare isolate, and what comes back from a run.
- [The two API surfaces](https://docs.neuralconfig.com/sz-mcp/concepts/api-surfaces/): How the wifi and switches namespaces differ — base paths, the shared detected API version, and exactly what each bundled SmartZone spec index contains.
- [Finding the right endpoint](https://docs.neuralconfig.com/sz-mcp/concepts/discovering-endpoints/): How Claude locates a SmartZone endpoint among 1,340 — check the task helpers, start with list_tags, search by keyword, then read the schema — and where the request body is in the output.
- [Security model](https://docs.neuralconfig.com/sz-mcp/concepts/security/): Where SZ-MCP stores your SmartZone password, how service tickets are minted and cached server-side, what Claude can never see, why the SmartZone account sets the outer access boundary, and how the write guard confirms every change.
- [Searching the SmartZone guides](https://docs.neuralconfig.com/sz-mcp/concepts/searching-the-guides/): How Claude searches the 23 SmartZone 7.2.0 guides with search_docs and read_doc — which guides are included, the arguments and defaults, what a search returns, and the errors.
- [Endpoint notes](https://docs.neuralconfig.com/sz-mcp/concepts/endpoint-notes/): How SZ-MCP endpoint notes work — saving a quirk you proved about a SmartZone API endpoint so your whole organisation sees it, who can save and remove notes, the limits, and the error codes.
- [Code mode primitives](https://docs.neuralconfig.com/sz-mcp/reference/primitives/): Complete reference for the code-mode primitives on the wifi and switches namespaces — arguments, defaults, caps, return shapes, and the error envelopes call returns instead of throwing.
- [Limits and quotas](https://docs.neuralconfig.com/sz-mcp/reference/limits/): Every SZ-MCP timeout, size cap, result cap, cache window and token lifetime in one place — with what each one does when you reach it.
- [Namespaces and helpers](https://docs.neuralconfig.com/sz-mcp/reference/namespaces-and-helpers/): Every function Claude can call in SZ-MCP's code mode — all 12 namespaces and 147 functions, what each does, which are primitives, and which org role each needs.
- [Lint rules](https://docs.neuralconfig.com/sz-mcp/reference/lint-rules/): Every rule the SZ-MCP best-practice config linter checks — 30 rules over WLANs, zones, AP groups, controller settings and ICX switch configs — with each rule's id, what it flags, its severity, why it matters, and whether it has an automatic fix.
- [Built-in prompts](https://docs.neuralconfig.com/sz-mcp/reference/prompts/): The ten starter prompts SZ-MCP adds to Claude's + menu — the exact title of each, what it asks Claude to do, and its optional arguments with their defaults.
- [How alerts work](https://docs.neuralconfig.com/sz-mcp/features/alerts/): How SZ-MCP alerting decides something is a problem — Nagios-style SOFT and HARD states, check attempts, flapping, acknowledgements, downtime and unreachable devices — plus the Alerts page and which roles can do what.
- [Alert rules](https://docs.neuralconfig.com/sz-mcp/features/alert-rules/): The six SZ-MCP alert rule kinds (threshold, nodata, event, presence, rogue, unknown_device), every rule field with its default, the 37-rule SmartZone starter pack, backtesting, and managing rules as YAML.
- [Alert notifications](https://docs.neuralconfig.com/sz-mcp/features/alert-notifications/): Where SZ-MCP sends alert notifications — email contacts (confirmed addresses only) with optional notification hours, a webhook as signed JSON (and how to verify X-SZMCP-Signature), Slack, Microsoft Teams or PagerDuty, Jira issues, escalation levels and a daily or weekly digest — and what each notification carries and explains about SmartZone alarm codes.
- [Monitoring the monitoring](https://docs.neuralconfig.com/sz-mcp/features/self-monitoring/): How to find out when SZ-MCP alerting itself stops working — the Self-monitoring checks, the public GET /health and per-organisation GET /health/org endpoints for your NMS, and the dead-man's-switch heartbeat.
- [Boards](https://docs.neuralconfig.com/sz-mcp/features/boards/): SZ-MCP boards are live dashboards of PromQL charts, alert lists and alarm feeds that Claude builds for you — how to ask for one, panel types, variables, live updates, editing the layout, kiosk mode and turning a panel into an alert rule.
- [Sharing boards](https://docs.neuralconfig.com/sz-mcp/features/sharing-boards/): How to share an SZ-MCP board as a view-only link for a NOC wall or TV — who can create links, expiry choices, revoking, what a viewer can and cannot see, and the limits.
- [Metrics and the scrape endpoint](https://docs.neuralconfig.com/sz-mcp/features/metrics/): What SZ-MCP's API polling collects, how long metrics are kept, how Claude queries them with PromQL, and how to scrape them into Prometheus, VictoriaMetrics, Grafana Alloy or Zabbix from GET /metrics with a scrape token.
- [Inventory, tags and locations](https://docs.neuralconfig.com/sz-mcp/features/inventory/): The SZ-MCP inventory — a map of your controller's zones, APs, switches, ports and links that Claude reads through inventory.* — plus the hourly sync, entity ids, tags, locations, registered critical devices, and which roles can change them.
- [Unknown-device detection](https://docs.neuralconfig.com/sz-mcp/features/unknown-devices/): How SZ-MCP flags a Wi-Fi or wired device that nobody registered — the unknown_device alert rule, where it looks, the allow list, approving a device by registering it, where client data comes from, and the two starter rules.
- [Synthetic reachability checks](https://docs.neuralconfig.com/sz-mcp/features/synthetic-checks/): How to have SZ-MCP ping a gateway, badge server or other IP address from chosen APs on a schedule — the metrics.probes functions, roles, defaults and caps, how offline APs are handled, the probe_* metrics, the two starter rules and the availability report.
- [Switch power supplies, fans and temperature](https://docs.neuralconfig.com/sz-mcp/features/switch-environmentals/): How SZ-MCP watches ICX switch power supplies, fans and temperature — the five switch_psus, switch_fans and switch_temperature_celsius metrics, the 15-minute poll they need, and how the three starter rules differ from SmartZone's own alarms.
- [Availability (SLA) reports](https://docs.neuralconfig.com/sz-mcp/reports/availability-reports/): How SZ-MCP works out how much of a month or period each AP, switch, port, controller node or synthetic check was up against a target, what counts as planned downtime and coverage, and how to get the report as CSV or PDF.
- [Weekly baselines](https://docs.neuralconfig.com/sz-mcp/features/weekly-baselines/): How SZ-MCP knows what is normal for a Tuesday at 10:00 — metrics.baseline and its verdicts, the baseline(), baseline_mad() and baseline_weeks() PromQL functions, the 3-week warm-up, which 11 metrics keep a baseline, and where baselines appear.
- [Capacity forecasts](https://docs.neuralconfig.com/sz-mcp/reports/capacity-forecasts/): How SZ-MCP forecasts when licence pools, switch PoE budgets, port bandwidth, clients per AP and radio airtime will reach their limits, what each verdict means, and why a new organisation shows LEARNING for its first week.
- [Topology diagrams](https://docs.neuralconfig.com/sz-mcp/features/topology-diagrams/): How to get a network diagram of switches, APs and their LLDP links from SZ-MCP — inventory.diagram's options and defaults, grouping, folding APs, how down links and devices are drawn, truncation, and mesh captions.
- [Alert quality report](https://docs.neuralconfig.com/sz-mcp/reports/alert-quality/): How SZ-MCP judges whether each alert rule is worth getting (time to acknowledge and recover, blips, noise and flapping), what the NOISY, IGNORED, SLOW ACK, OK and TOO FEW verdicts mean, and what it suggests changing.
- [Site notes and runbooks](https://docs.neuralconfig.com/sz-mcp/features/site-notes-and-runbooks/): How to give whoever is paged what your team already knows — SZ-MCP site notes on a device, zone, location or the whole organisation, and a rule's runbook — who can write them, limits and expiry, and where they appear.
- [Shift-handover digest](https://docs.neuralconfig.com/sz-mcp/reports/digest/): What SZ-MCP's digest contains, how to read it on demand on the Reports page or from Claude, and how an admin schedules it by email daily or weekly, including who receives it, when a missed digest is skipped and the test-send limit.
- [What comes with a problem: the context pack](https://docs.neuralconfig.com/sz-mcp/features/alert-context/): What SZ-MCP gathers around an alert problem so you don't start from nothing — where it is, what it hangs off, related problems, recent events and changes, its metrics against a usual week and how often it happened before — and how email, Jira, Slack, Teams, PagerDuty, the webhook and the Alerts page show it.
- [Alert post-mortems](https://docs.neuralconfig.com/sz-mcp/reports/post-mortems/): How to get an SZ-MCP post-mortem of one alert episode (what happened step by step, the context when it started, the runbook, site notes and the timeline around it), where it is linked from, and how to download it as Markdown.
- [Audit evidence pack](https://docs.neuralconfig.com/sz-mcp/reports/audit-evidence-pack/): What is in SZ-MCP's audit evidence pack (availability, the controller's admin audit log, changes made through SZ-MCP, configuration changes and baseline, the alert record and rules, best-practice findings), how each file is hashed in manifest.json, and the period, row and rate limits.
- [Approving dangerous changes](https://docs.neuralconfig.com/sz-mcp/changes/approvals/): How SZ-MCP asks for your agreement before Claude changes the controller — a confirm in chat for a write, an authenticator code or a dashboard approval for a dangerous one — and how the Approvals page, its 10-minute expiry and MOP approvals work.
- [Write history and undo](https://docs.neuralconfig.com/sz-mcp/changes/write-history-and-undo/): Where SZ-MCP records every change Claude sends to the controller — the one-year Write history page and the 30-day undoable history — and what history.undo can and cannot reverse.
- [Post-change verification](https://docs.neuralconfig.com/sz-mcp/changes/post-change-verification/): What SZ-MCP watches for 15 minutes after Claude changes the controller — clients, APs, switches, ports and new alert problems — what the verdicts watching, ok, degraded and no_data mean, and why a write may not be verified.
- [Controller audit log and timeline](https://docs.neuralconfig.com/sz-mcp/changes/audit-log-and-timeline/): How to see who changed what on your SmartZone controller with SZ-MCP — the admin audit log (history.audit), the merged change timeline (history.timeline), the polling they depend on, how long rows are kept, and the Overview page's Recent changes card.
- [Config snapshots and drift](https://docs.neuralconfig.com/sz-mcp/changes/config-drift/): How SZ-MCP takes a daily snapshot of your SmartZone configuration — zones, WLANs, AP groups, four system settings and ICX switch configs — and shows what changed field by field with history.config_changes, how secrets are stored, and how long changes are kept.
- [Change procedures (MOPs)](https://docs.neuralconfig.com/sz-mcp/changes/mops/): What a MOP (method of procedure) is in SZ-MCP — a change written as checked API steps, approved once for the whole run, run with pre- and post-checks and a change window, and rolled back as a whole — with the roles, limits and errors of the mop functions.
- [Scheduling a MOP](https://docs.neuralconfig.com/sz-mcp/changes/scheduling-mops/): How to run an SZ-MCP change procedure (MOP) at a set time or on a daily or weekly schedule with mop.schedule — the standing approval it creates, its limits, why an occurrence is skipped or missed, and how to cancel a schedule or stop a scheduled run.
- [MOP documents and branding](https://docs.neuralconfig.com/sz-mcp/changes/mop-documents/): How to turn an SZ-MCP change procedure (MOP), or one run of it, into a document for a change board — Word, Markdown or a printable page — what the document contains, and how an admin sets the company name, logo, accent colour and footer on the Document branding card.
- [Best-practice config linter](https://docs.neuralconfig.com/sz-mcp/changes/config-linter/): How SZ-MCP checks your SmartZone and ICX configuration against best practice with lint.run — what it reads, who can run it, how to waive a finding, how fixable findings become a MOP with lint.to_mop, and the limits and errors.
- [Switch config backup and restore](https://docs.neuralconfig.com/sz-mcp/changes/switch-backup-restore/): How Claude lists, reads, takes and restores ICX switch configuration backups through SZ-MCP — switches.backups, config, backup and restore — including the dry run, the fresh-backup rule, why a restore counts as dangerous, and why it only takes effect when the switch reboots.
- [Client journey](https://docs.neuralconfig.com/sz-mcp/tools/client-journey/): What wifi.client_journey shows about one Wi-Fi client — joins, roams, failures, IP updates and disconnects in time order — how much of that is available without Northbound streaming, its arguments and defaults, and its errors.
- [Switch port lookup](https://docs.neuralconfig.com/sz-mcp/tools/switch-port-lookup/): How switches.port_lookup finds the ICX switch port a device or AP is plugged into — the inputs it takes, how it tells a device's own port from an uplink (direct, edge, behind), what it reports about the port, how many calls it costs, and its errors.
- [Ping, traceroute and routing tables](https://docs.neuralconfig.com/sz-mcp/tools/ping-and-traceroute/): How Claude runs ping and traceroute from a RUCKUS AP or an ICX switch, and reads an ICX switch's routing table — IP-only targets, how long each takes, what comes back, and the errors.
- [Send alert state to Nagios or Icinga](https://docs.neuralconfig.com/sz-mcp/integrations/nagios-icinga/): How to send SZ-MCP's alert problems to Nagios (NRDP) or Icinga 2 (API) as passive check results, with one service per rule and an SZ-MCP summary, the generated config with its freshness check, and the rules every SZ-MCP integration follows.
- [Send alert state to Zabbix](https://docs.neuralconfig.com/sz-mcp/integrations/zabbix/): How to send SZ-MCP's per-rule alert state to Zabbix through the API (Zabbix 7.0 or later) or the sender protocol, import the SZ-MCP alerts template that discovers a service per rule, and fix the errors Zabbix returns.
- [Forward logs to Splunk or syslog](https://docs.neuralconfig.com/sz-mcp/integrations/splunk-and-syslog/): How SZ-MCP forwards alert changes, controller alarms and events, the controller's admin activity and changes made through SZ-MCP to Splunk's HTTP Event Collector or a syslog receiver (CEF or JSON over TCP, TLS by default), what is forwarded by default, and how delivery and catch-up work.
- [Open ServiceNow incidents](https://docs.neuralconfig.com/sz-mcp/integrations/servicenow/): How SZ-MCP opens a ServiceNow incident for each unhandled HARD alert problem, adds work notes as it changes and resolves it on recovery, the authentication options and field defaults, and the caps on new and open incidents.
- [Sync with NetBox](https://docs.neuralconfig.com/sz-mcp/integrations/netbox/): How SZ-MCP keeps NetBox and its inventory in step, pulling NetBox sites, locations and racks in as locations and placing APs and switches by serial number, and optionally pushing APs, switches and switch ports out as NetBox devices and interfaces, with adoption, placement rules, caps and errors.
- [Examples](https://docs.neuralconfig.com/sz-mcp/examples/): Worked SZ-MCP code-mode programs — listing zones, discovering an endpoint and reading its schema, paginating safely inside the run budget, and querying the switch surface.
- [Teams, organisations and roles](https://docs.neuralconfig.com/sz-mcp/organization/team-and-roles/): How do I share an SZ-MCP controller with my team? Personal and team organisations, the five roles and exactly what each can do, invites, ownership transfer, and switching organisations.
- [Privacy controls](https://docs.neuralconfig.com/sz-mcp/organization/privacy-controls/): How long does SZ-MCP keep data that names wireless clients, and can it pseudonymise them? The three privacy settings, their defaults and ranges, what changing them deletes or rewrites, and what they don't cover.
- [Configuration bundle](https://docs.neuralconfig.com/sz-mcp/organization/org-bundle/): How do I export an SZ-MCP organisation's setup as one YAML file and import it into another? The twelve sections, dry runs and prune, who can apply, why integrations are never written, partial failures, and the limits.
- [Troubleshooting](https://docs.neuralconfig.com/sz-mcp/troubleshooting/): Diagnose SZ-MCP failures — certificate refusals, failed connection tests, forbidden hosts, connector authorization loops, 401 retries, and the errors that arrive inside an HTTP 200.