Namespaces and helpers
SZ-MCP’s one MCP tool, code_mode, gives Claude 147 functions on 12
namespaces. This page lists every one, with the first sentence of the
description Claude reads, and the organisation role it needs. You don’t call
these yourself: you ask in plain language, and Claude picks them.
| Namespace | Functions | What it covers |
|---|---|---|
wifi | 20 | The SmartZone WSG (wireless) API |
switches | 22 | The SmartZone SwitchM (ICX switch) API |
stream | 3 | Data the controller pushes to SZ-MCP by Northbound streaming, which is not available on the hosted service yet |
inventory | 14 | Your organisation’s map of the controller |
metrics | 12 | Time series queried with PromQL, weekly baselines, availability reports, capacity forecasts, synthetic reachability checks and the polling switch |
alerts | 23 | Alert rules, current problems, acknowledgements, downtime, history, notification channels, and the context, post-mortem and quality reports |
boards | 11 | Live boards |
history | 13 | Who changed what |
notes | 5 | What your team knows about its own site, as notes on devices, locations or the whole organisation |
mop | 16 | Methods of procedure |
lint | 6 | The best-practice config linter over the daily config snapshot, its waivers, and fixes turned into a MOP |
org | 2 | Your organisation’s setup as one YAML document, exported and imported with a plan |
How to read these tables
Section titled “How to read these tables”The Role column is the lowest organisation role that may use the function.
Roles rank owner > admin > engineer > operator > viewer, and any means every
role, viewers included. A function refused for your role returns write_blocked
with a message naming the role that can.
- “to apply” means the function is a dry run by default (a plan or a preview), which every role can see; only applying it needs the role shown.
- Any request that writes to your controller —
call,switches.backup,switches.restore,history.undo, a MOP run with writes — also needs the engineer role and goes through the write guard. - Primitives are the eight functions
wifiandswitchesshare for finding and calling API endpoints. They are documented in full in Code mode primitives. Everything else is a task helper: a shortcut that does the joins, pagination and known quirks for one job.
Every function, by namespace
Section titled “Every function, by namespace”The SmartZone WSG (wireless) API: the eight primitives, plus task helpers for zones, APs, clients, alarms, events, AP ping and traceroute, and the SmartZone guides.
| Function | What it does | Role |
|---|---|---|
wifi.list_tags (primitive) | List SmartZone WSG (wireless) API tags (endpoint categories). | any |
wifi.search_endpoints (primitive) | Keyword-search the SmartZone WSG (wireless) API OpenAPI spec. | any |
wifi.list_endpoints_by_tag (primitive) | List all SmartZone WSG (wireless) API endpoints under a given tag. | any |
wifi.get_endpoint_details (primitive) | Fetch full OpenAPI details (parameters, request body schema, responses) for a specific SmartZone WSG (wireless) API endpoint. | any |
wifi.save_endpoint_note (primitive) | Save a short note on a SmartZone WSG (wireless) API endpoint (operator and up): a quirk you proved by calling it that the spec, its caveats and the guides don’t say (a field the spec omits, a filter that is refused, a… | operator |
wifi.remove_endpoint_note (primitive) | Remove an endpoint note by its id (from get_endpoint_details notes): your own, or any of the organisation’s if you are an org admin. | the note’s author, or admin |
wifi.call (primitive) | Execute an authenticated SmartZone WSG (wireless) API call. | engineer for a write |
wifi.await_approval (primitive) | Wait (up to 15 s) for the user to approve or deny a dangerous action on the dashboard, given the approvalId from an approval_required response. | any |
wifi.list_all | Fetch every item of a list endpoint, paging in whatever style that endpoint uses (listSize/index, body page/limit, query page/limit). | any |
wifi.query (not in TASK HELPERS) | Search APs, clients, WLANs, wired clients or recent ended client sessions through the Query API, paging for you. | any |
wifi.overview | One-call controller health: nodes and cluster state, firmware, AP/switch counts and capacity, per-zone AP and client counts, alarm counts by severity, licences, and upgrade state. | any |
wifi.alarms | List controller alarms, newest first, optionally within the last N hours, by severity/category/zone/AP, or outstanding only. | any |
wifi.events | List controller events from the REST event log, newest first, by time window, severity, category, zone or AP. | any |
wifi.zone_tree | Map the wireless hierarchy: zones (optionally in one domain) with their AP and client counts, WLANs (name, SSID), AP groups and WLAN groups. | any |
wifi.client_journey | One client’s story, oldest first: joins, authorisations, roams (a band steer on one AP counts as a roam; summary.bandSteers says how many), IP (DHCP) updates, authentication and connection failures (with the 802.11… | any |
wifi.ap_ping | Ping an IP address from an AP (GET /tool/ping: 5 packets from the AP itself, so it tests the AP’s own path, e.g. to its gateway, DHCP or RADIUS server). | any |
wifi.ap_traceroute | Traceroute from an AP to an IP address (GET /tool/traceRoute: up to 30 hops). | any |
wifi.get_reference | Read a bundled SmartZone reference note: query-api, pagination, alarms-events, switch-config, data-sources. | any |
wifi.search_docs | Full-text search over the SmartZone 7.2.0 guides (no controller call): how a feature works, where it is in the web UI, requirements and limits, CLI commands, SNMP MIB objects, the GPB/MQTT streaming schema, upgrade… | any |
wifi.read_doc | Read one guide section found by search_docs: { id, doc, docTitle, title, path, page, text, totalChars, nextOffset?, prevId?, nextId? }. | any |
switches
Section titled “switches”The SmartZone SwitchM (ICX switch) API: the same eight primitives, plus task helpers for the switch fleet, config backups and restore, port lookup, routing tables, ping and traceroute.
| Function | What it does | Role |
|---|---|---|
switches.list_tags (primitive) | List SmartZone SwitchM (switch) API tags (endpoint categories). | any |
switches.search_endpoints (primitive) | Keyword-search the SmartZone SwitchM (switch) API OpenAPI spec. | any |
switches.list_endpoints_by_tag (primitive) | List all SmartZone SwitchM (switch) API endpoints under a given tag. | any |
switches.get_endpoint_details (primitive) | Fetch full OpenAPI details (parameters, request body schema, responses) for a specific SmartZone SwitchM (switch) API endpoint. | any |
switches.save_endpoint_note (primitive) | Save a short note on a SmartZone SwitchM (switch) API endpoint (operator and up): a quirk you proved by calling it that the spec, its caveats and the guides don’t say (a field the spec omits, a filter that is refused, a… | operator |
switches.remove_endpoint_note (primitive) | Remove an endpoint note by its id (from get_endpoint_details notes): your own, or any of the organisation’s if you are an org admin. | the note’s author, or admin |
switches.call (primitive) | Execute an authenticated SmartZone SwitchM (switch) API call. | engineer for a write |
switches.await_approval (primitive) | Wait (up to 15 s) for the user to approve or deny a dangerous action on the dashboard, given the approvalId from an approval_required response. | any |
switches.list_all | Fetch every item of a list endpoint, paging in whatever style that endpoint uses (listSize/index, body page/limit, query page/limit). | any |
switches.overview | One-call ICX fleet summary: switch counts by status, model, firmware and group, the offline switches, health (online/flagged/offline), and port counts by speed. | any |
switches.config_diff | Diff two ICX config backups: give a switchId (its MAC) to compare that switch’s two newest successful backups, or configIds [older, newer]. | any |
switches.backups | ICX config backups per switch, newest first: { switches: [{ mac, switchName, latest (newest successful), ageHours, master, latestDiffFromMaster, failedSince (failed backups newer than latest), lastRestore, backups (up… | any |
switches.config | One ICX config backup as text, secrets shown as <secret>: give backupId, or switchId (its MAC) for that switch’s newest successful backup. | any |
switches.backup | Take a config backup of up to 50 switches now (POST /switchconfig/backup). | engineer |
switches.restore | Restore an ICX config backup to its switch. | engineer to apply |
switches.port_lookup | Where a device plugs into the switches, and everything about that port. | any |
switches.routing_table | An ICX switch’s IP routing table (sh ip route on the switch, via GET /switch/troubleshooting/routingtable/{serialNumber}; ~6 s). | any |
switches.ping | Ping an IP address from an ICX switch (the UI’s switch ping, POST /switch/troubleshooting/ping: 5 packets from the switch’s management interface; ~8 s, run one per code_mode call). | any |
switches.traceroute | Traceroute from an ICX switch to an IP address (the UI’s switch traceroute, POST /switch/troubleshooting/traceroute: up to 30 hops; 5–8 s to the internet on vsz36, run one per code_mode call). | any |
switches.get_reference | Read a bundled SmartZone reference note: query-api, pagination, alarms-events, switch-config, data-sources. | any |
switches.search_docs | Full-text search over the SmartZone 7.2.0 guides (no controller call): how a feature works, where it is in the web UI, requirements and limits, CLI commands, SNMP MIB objects, the GPB/MQTT streaming schema, upgrade… | any |
switches.read_doc | Read one guide section found by search_docs: { id, doc, docTitle, title, path, page, text, totalChars, nextOffset?, prevId?, nextId? }. | any |
stream
Section titled “stream”Data the controller pushes to SZ-MCP by Northbound streaming, which is not available on the hosted service yet. alarm, rogue and audit rows also come from metric polling.
| Function | What it does | Role |
|---|---|---|
stream.status | Streaming health: whether the controller is connected, last message age, row counts per kind, payload types and MQTT topics seen, recent connections, decode failures and pre-auth diagnostics. | any |
stream.kinds | List the queryable stream kinds with a one-line description of each. | any |
stream.query | Query data the controller streamed to us (near-real-time, no controller API call). | any |
inventory
Section titled “inventory”Your organisation’s map of the controller: every zone, AP group, AP, switch, port and client, with tags, locations, links and a change feed.
| Function | What it does | Role |
|---|---|---|
inventory.sync | Refresh the inventory from the controller: cluster and nodes, domains, zones, AP groups, APs and radios, switch groups, switches, ports, LLDP links (port → AP, port → port, port → other device) and, unless clients… | any |
inventory.status (not in TASK HELPERS) | Inventory size by entity type, link counts, tagged entities, and how the last sync went (when, counts, errors, what was complete). | any |
inventory.find | Find entities by type, container (within), tags, text, or status. | any |
inventory.describe | Everything known about one entity: its path (cluster → domain → zone → AP group → AP), effective location and tags (with where each came from), attributes, children by type, links, upstream (what it physically depends… | any |
inventory.neighbors | The entities around one: its container, its children (up to 100 each) and its links, out to depth hops (1–3). | any |
inventory.diagram | Draw the network as a Mermaid flowchart from the inventory: switches and APs (grouped by domain → zone → AP group and switch group, or by location), LLDP neighbours, and one edge per pair of linked devices labelled with… | any |
inventory.changes | The inventory change feed, newest first: added, removed, returned, renamed, moved (new container), changed (model/serial/ip/firmware), linked/unlinked (topology), tagged, located, labelled. | any |
inventory.locations | The location tree (campus → building → hall → room → rack, or whatever levels the org uses), with how many entities are placed in each and their tags. | any |
inventory.add_location | Create a location, optionally under a parent location. | engineer |
inventory.remove_location | Delete an empty location (no sub-locations). | engineer |
inventory.set_location | Place entities in a location (location: null unplaces them). | engineer |
inventory.tag | Set tags (key → value) on entities, or clear one with null. | engineer |
inventory.add_device | Register a critical device (badge reader, camera, BMS controller…) by MAC, with a name, tags and location. | engineer |
inventory.remove_device | Unregister a device added with add_device. | engineer |
metrics
Section titled “metrics”Time series queried with PromQL, weekly baselines, availability reports, capacity forecasts, synthetic reachability checks and the polling switch.
| Function | What it does | Role |
|---|---|---|
metrics.catalog | The metrics you can query: name, kind (gauge or counter: use rate()/increase() on counters), unit, entity type, sources (stream, api), meaning, and baseline: true when a weekly baseline is kept (see query). | any |
metrics.query (not in TASK HELPERS) | Run PromQL over the org’s metrics. | any |
metrics.baseline | Is it normal for this hour of the week? An entity’s metrics now against their weekly baselines: for an AP, switch or controller node each of its (and its radios’) baseline metrics per series; for a zone, AP group… | any |
metrics.availability | An availability (SLA) report: how much of a period each cluster / node / ap / switch / port / probe was up, from its up gauge (cluster_in_service, node_in_service, ap_up, switch_up, port_up, probe_up) rolled up per hour… | any |
metrics.forecast | Capacity forecasts: when something fills up at its current trend (“full in N weeks”). | any |
metrics.status (not in TASK HELPERS) | What the metric store holds: per family (ap, switch, cluster) the last sample and its age, reports in the last hour by source, the hourly and daily rollups, retention; plus the stream freshness and the API polling… | any |
metrics.poll | Take one sample from the controller API now (reads only): cluster state, every AP and radio (POST /query/ap), every switch, and the outstanding alarms (which alarm rules in alerts.* then see); plus ports and controller… | any |
metrics.probes | Synthetic reachability checks: the targets chosen APs ping on a schedule (a gateway, a badge server, a BMS head end), and each one’s last run. | any |
metrics.set_probe | Add or change a synthetic check target (engineer and up): chosen APs ping targetIp every intervalMinutes (GET /tool/ping from the AP: a read, ~7 s, ~15 s when nothing answers) and the results become probe_* metrics. | engineer |
metrics.remove_probe | Remove a synthetic check target (engineer and up). | engineer |
metrics.run_probes | Run a synthetic check target now (operator and up): its APs ping it (at most 4 here, 4 at a time, 7–15 s), the results are stored as a scheduled run’s would be, and returned: { name, targetIp, at, results: [{ ap, name… | operator |
metrics.set_polling | Turn background API polling on or off for the organisation (metrics, and the outstanding alarms for alarm rules): every 5 min (15 min for ports and controller statistics), slower if the controller is slow, and skipped… | admin |
alerts
Section titled “alerts”Alert rules, current problems, acknowledgements, downtime, history, notification channels, and the context, post-mortem and quality reports.
| Function | What it does | Role |
|---|---|---|
alerts.status (not in TASK HELPERS) | The tactical overview: rule counts (and failing rules), a summary (critical, warning, unknown, soft, unhandled = HARD problems not acknowledged, in downtime or unreachable; acknowledged, inDowntime, flapping… | any |
alerts.rules | Every rule with its full definition, version, current problem counts, last run, last error and next run. | any |
alerts.get_rule | One rule; versions: true adds its change history (each version, who, when, and the rule as it was). | any |
alerts.create_rule | Create an alert rule. | engineer to apply |
alerts.update_rule | Change a rule: changes are merged into the current definition (set a field to null to drop it back to its default), or give the whole rule. | engineer to apply |
alerts.delete_rule | Delete a rule and its current problems (engineer or admin). | engineer |
alerts.export_rules | Every rule (or the named ones) as one YAML document, each rule in its shortest form (defaults left out) with a fixed field order, so it diffs cleanly in git. | any |
alerts.import_rules | Rules as code: make the org’s rules match a YAML document (as export_rules writes it: version: 1 and rules:; a bare list works too). | engineer to apply |
alerts.starter_pack | The SmartZone starter checks (controller cluster/node down, CPU/memory/disk, controller and stream silent, Critical and Major SZ alarms, AP offline and flapping, AP CPU/memory, radio airtime and noise, switch offline… | engineer to apply |
alerts.backtest | Replay a rule (a saved rule’s name, or a definition) over stored history without saving anything: threshold rules over the metrics (each step one check; default step 5m), event rules over the stream’s log. | any |
alerts.ack | Acknowledge current problems (operator and up): a rule and an instance, a rule and an entity, or every problem on an entity. | operator |
alerts.unack | Remove acknowledgements (operator and up), selected as for ack. | operator |
alerts.downtime | Schedule downtime (operator and up): problems it covers are still tracked but not notified. | operator |
alerts.downtimes | Scheduled and active downtime; includeEnded adds the last 200 including ended and cancelled ones. | any |
alerts.cancel_downtime | Cancel a downtime by id (operator and up). | operator |
alerts.history | The alert log, newest first: state changes (kind ‘state’, with the transition and any suppression), flapping, acknowledgements, downtime and rule changes (who and what). | any |
alerts.channels | Where the organisation’s alert notifications go (one contact list per org): email addresses (emailStatus per address: member = an org member’s sign-in email, confirmed, pending/expired = a confirmation email was sent… | any |
alerts.health | Is the monitoring itself working (not the network)? { status: ‘OK’ | ‘WARNING’ | ‘CRITICAL’, summary, checks: [{ name, state, message }] } over: rules (enabled, none overdue, none failing), data (a stream or API polling… | any |
alerts.context | The investigation bundle for a problem (the same context pack its notifications carry), with no model: for each current problem matching rule/instance/entity, { rule, instance, entity, name, state, since, runbook?… | any |
alerts.postmortem | One alert episode written up for a review, with no model: { title, postmortem: { rule, ruleDescription?, instance, entity, name, worst, firstSign (the first non-OK state, SOFT included), start (HARD), end (recovery… | any |
alerts.quality | How well each rule’s alerts work, from the engine’s own history (no model, no controller call): over the HARD problem episodes that began in the period, per rule { rule, verdict (‘noisy’ | ‘ignored’ (nobody… | any |
alerts.explain | What SmartZone alarm and event codes mean, from the 7.2.0 Alarms and Events Reference Guide (bundled; no controller call): { code, kind (‘alarm’ | ‘event’), name, type (the alarmType/eventType), severity, category… | any |
alerts.check_now | Evaluate one rule (or every enabled rule) now instead of waiting for its interval. | any |
boards
Section titled “boards”Live boards: PromQL panels, alert lists and event feeds on a page that follows every change.
| Function | What it does | Role |
|---|---|---|
boards.list | The organisation’s boards: { boards: [{ id, name, description?, panels, version, updatedAt, updatedBy, url }] }. | any |
boards.get | One board’s full spec (panels with their ids) and its url. | any |
boards.create | Create a board, optionally with its panels, and return it with its url: tell the user to open the url on their second monitor; the page follows every later change within seconds. | engineer |
boards.update | Change a board’s name, description, range or variables (the fields given replace those stored). | engineer |
boards.delete_board | Delete a board. | engineer |
boards.add_panel | Add a panel (at the end, or at position at, 0-based). | engineer |
boards.update_panel | Change a panel: the fields in patch replace the stored ones, a field set to null is removed. | engineer |
boards.remove_panel | Remove a panel. | engineer |
boards.move_panel | Move a panel to position to (0-based; panels flow left to right, top to bottom). | engineer |
boards.data | What the board shows now, per panel: a time series as { label, points, last, min, max } per series; stat/gauge/bar/table as { label, value, ageSec }; alerts as the summary and problems; events as the newest 20; or {… | any |
boards.to_alert | Turn a metric panel into a threshold alert rule: its expr (with the board’s variables filled in: vars, else their defaults) and its thresholds (op, warn, crit). | engineer to apply |
history
Section titled “history”Who changed what: the admin audit log, a merged timeline, writes made through SZ-MCP and their undo, post-change verification, config drift, the evidence pack and the shift digest.
| Function | What it does | Role |
|---|---|---|
history.audit | The controller’s admin audit log (Administration › Admin Activities), newest first: { total, returned, rows: [{ at, id, user, ip, category, object, action, message, ok, logon, entities? }] }. | any |
history.timeline | What happened, newest first, from every source kept here: admin changes on the controller (source ‘audit’), writes made through sz-mcp (‘write’, with the sz-mcp user), inventory changes (‘inventory’: added, removed… | any |
history.writes | Writes sent through sz-mcp (every surface, every user in the organisation), newest first, kept 30 days: { writes: [{ writeId, at, userId, surface, method, path, status, ok, hasBefore, undo: { undoable, reason? }… | any |
history.get_write | One write in full: the body sent, the state of the target just before it (before), the response of a create, the undo plan and its post-change verification (as history.verification). | any |
history.verification | Post-change verification of a write (by writeId) or of one verification (by id): after a write through sz-mcp (a call, an undo, a MOP step) the zone, AP group, AP, switch group or switch it touched (a WLAN’s zone) is… | any |
history.verifications | Post-change verifications, newest first (see history.verification): { verifications: […] }. | any |
history.undo | Reverse a write sent through sz-mcp. | engineer to apply |
history.config_changes | What changed in the controller’s configuration between daily snapshots, field by field, newest first: { total, items: [{ at, key, kind (‘zone’ | ‘wlan’ | ‘apgroup’ | ‘system’ | ‘switchconfig’), name, parent?, change… | any |
history.config | One configuration object as of the last snapshot ({ key, kind, name, parent?, data, takenAt }), e.g. config({ key: 'wlan:<zone>:<id>' }); secrets are digests. | any |
history.snapshot_config | Take a config snapshot now (engineer and up): every zone, its WLANs and AP groups, and four system settings, read in full (about 3 calls per zone plus one per WLAN and AP group). | engineer |
history.evidence | The audit evidence pack for a period (UTC month or from/to, at most 400 days): what an auditor asks for, from what sz-mcp already keeps, with no controller calls. | any |
history.digest | The shift-handover digest for a period (default the last 24 h, at most 8 days), from what sz-mcp keeps, with no controller calls: { headline, text (ready to read out or paste), digest: { problems (now: counts… | any |
history.status (not in TASK HELPERS) | How fresh the audit copy is: { newestAuditAt, newestAuditAgeMin, polling: { enabled, lastFinishedAt, lastError } }. | any |
What your team knows about its own site, as notes on devices, locations or the whole organisation.
| Function | What it does | Role |
|---|---|---|
notes.list | Site notes, newest first: { total, returned, notes: [{ id, target, targetName?, text, createdAt, createdBy, updatedAt, updatedBy, expiresAt?, expired? }] }. | any |
notes.for_entity | Every note that applies to an entity, nearest first: on the entity itself (via ‘self’), on its containers (its AP group, zone, switch…: ‘container’), on its placed location and the locations above it (‘location’), and… | any |
notes.add | Add a note (operator and up). | operator |
notes.update | Change a note’s text or expiry (operator and up). | operator |
notes.remove | Delete a note (operator and up). | operator |
Methods of procedure: a change written as API steps, approved once, run with checks, scheduled, rolled back and exported as a document.
| Function | What it does | Role |
|---|---|---|
mop.list | The org’s MOPs, newest change first: { total, mops: [{ id, title, version, steps, params, updatedAt, updatedBy, lastRun? }] }. | any |
mop.get | One MOP: { id, version, spec, createdAt, createdBy, updatedAt, updatedBy }, plus its recent runs with runs: true. | any |
mop.save | Create a MOP, or replace one with id (engineer and up; a new version each save; a run in progress keeps the version it started with). | engineer |
mop.remove | Delete a MOP and its run history (engineer and up); refused while a run of it is active. | engineer |
mop.preview | Lint a MOP and show what a run would do, sending nothing: { ready, missingParams?, tier (‘read’ | ‘write’ | ‘dangerous’), writes, errors, warnings, window?, plan: [{ seq, phase, name, surface, method, path, summary… | any |
mop.start | Start a run of a MOP (the steps run with mop.run). | engineer for a MOP with writes |
mop.run | Run a started run’s next steps until it ends, a step fails, maxSteps, or the code-mode budget is nearly spent (then call again; it continues). | any |
mop.step | Run exactly one step (or one forEach element) of a started run; the same result as mop.run. | any |
mop.status (not in TASK HELPERS) | A run as it stands: status, progress, the evidence of every step so far, its writes and their rollback, its downtime ids, and verification (Phase 30d): the post-change verification of its writes ({ status… | any |
mop.schedule | Schedule runs of a MOP: once at an instant, or daily/weekly at a time in a time zone, until until (default 30 days, at most 90; a once at most 30 days ahead). | engineer for a MOP with writes, else operator |
mop.document | A MOP, or one run of it, as a document for a change board: purpose and parameters, every step (request, body with secrets masked, checks, captures, rollback), the rollback plan newest write first, the linter’s notes and… | any |
mop.schedules | The org’s MOP schedules, newest first: { schedules: [{ id, mopId, version, title, label?, recurrence, nextRunAt, until, status (‘active’ | ‘done’ | ‘cancelled’), tier, onFail, params, by, runs, activeRunId?, lastRunAt?… | any |
mop.unschedule | Cancel a schedule (the person who made it, or an engineer and up): nothing further fires. | the schedule’s creator, or engineer |
mop.runs | Recent runs, newest first, of one MOP (id) or all. | any |
mop.abort | Stop a run (engineer and up): nothing more is sent and its change window closes. | engineer |
mop.rollback | Reverse what a finished, failed or aborted run changed, newest write first (engineer and up; only the person who armed the run, since it sends under that approval): each write’s declared rollback, or its recorded undo… | engineer, and only the person who started the run |
The best-practice config linter over the daily config snapshot, its waivers, and fixes turned into a MOP.
| Function | What it does | Role |
|---|---|---|
lint.rules | The linter’s rules: [{ id, title, severity (critical | warning | info), kinds (zone | wlan | apgroup | system | switchconfig: the newest SwitchM backup of an ICX switch), why, fixable (a finding comes with a request… | any |
lint.run | Lint the controller’s configuration against best practice, from the last daily config snapshot (no controller calls): WLAN security (WEP, WPA1/TKIP, open without a portal, WPA3 without PMF, a passphrase from the… | any |
lint.to_mop | Turn fixable findings into a MOP: per finding a pre-check that the object still reads as the snapshot saw it (so a fix is never built on stale config), the PATCH, and a post-check that it reads back as fixed; a change… | engineer to save |
lint.waivers | Waived findings: [{ rule, key (an object, or * for all), reason, by, at, expiresAt }]. | any |
lint.waive | Accept a finding (engineer and up): the rule on one object (key, e.g. 'wlan:<zone>:<id>'), or on everything when key is left out. | engineer |
lint.unwaive | Remove a waiver (engineer and up); the finding shows again. | engineer |
Your organisation’s setup as one YAML document, exported and imported with a plan.
| Function | What it does | Role |
|---|---|---|
org.export_bundle | The organisation’s setup as one YAML document (kind: sz-mcp-bundle, version: 1), for git, review or another org: sections rules, boards, notes, locations, devices, placements, tags, lintWaivers, mops, probes… | any |
org.import_bundle | Make this organisation match a bundle (as export_bundle writes it). | engineer to apply (escalation levels: admin) |
Next steps
Section titled “Next steps” Code mode primitives Arguments, return shapes and error envelopes for the eight primitives.
Built-in prompts The ten starter prompts in Claude's + menu, and what each runs.
Limits and quotas The run budget, result size and per-function caps.
How code mode works Where these functions run, and what comes back from a run.