Connecting to Claude
SZ-MCP is added to Claude as a custom connector. There is one URL, the same for everybody, and the OAuth token Claude obtains is what binds it to your account.
Add the connector
Section titled “Add the connector”-
Copy the MCP URL from your dashboard:
https://sz-mcp.lanpulse.com/mcp/ -
In Claude, open Settings → Connectors → Add custom connector.
-
Paste the URL and give it a name — “SmartZone”, or anything you like.
-
Claude opens a sign-in and consent page. Sign in with the same Google account you used on the dashboard.
-
The consent screen names the client requesting access and the account it will act as, and lists what it may do. Choose Allow.
Save your credentials on the dashboard before connecting. The connector will
register and authorize either way, but every call returns no_credentials
until a controller is saved.
What the consent screen grants
Section titled “What the consent screen grants”Two things, and nothing else:
- Call the SmartZone WSG and SwitchM APIs on your behalf using your stored credentials
- Search and read the SmartZone OpenAPI specs
There is a single scope, sz:call. The connector cannot read your other
SZ-MCP settings, cannot see your password, and cannot act for any other account.
If this is your first authorization, the screen also asks you to accept the Terms of Service and Privacy Policy. Submitting without ticking the box returns you to the same screen with “Please accept the Terms and Privacy Policy to continue.”
How the connection is authenticated
Section titled “How the connection is authenticated”SZ-MCP implements OAuth 2.1 with Dynamic Client Registration (RFC 7591) and PKCE, which is what lets Claude connect without you creating an app registration by hand.
-
Claude registers itself as a client, receiving a generated
client_id. -
Claude sends you to the authorize endpoint with a PKCE challenge.
-
Your Google session identifies you; Allow issues a short-lived authorization code.
-
Claude exchanges the code — proving possession of the PKCE verifier — for an access token and a refresh token.
PKCE is mandatory, and the S256 challenge method is the only one accepted. An
authorization request without a challenge is rejected with code_challenge required (PKCE).
Token lifetimes
Section titled “Token lifetimes”| Token | Lifetime | Notes |
|---|---|---|
| Authorization code | 10 minutes | Single use |
| Access token | 30 days | Prefixed szmk_. Stored hashed, never in plaintext |
| Refresh token | 90 days | Rotated on every use — the old one is revoked as the new one is issued |
| Client registration | 30 days | Claude re-registers automatically when it lapses |
Claude refreshes the access token on its own. You do not need to reconnect every 30 days.
Revoking access
Section titled “Revoking access”Deleting your SmartZone credentials stops the connector working but leaves it registered. To cut Claude off entirely, remove the connector in Claude’s settings.
| Goal | Do this |
|---|---|
| Stop Claude reaching the controller, keep the connector | Delete your credentials on the dashboard |
| Stop Claude reaching SZ-MCP at all | Remove the connector in Claude → Settings → Connectors |
| Rotate the controller password | Update it in SmartZone, then save the new one on the dashboard — no reconnect needed |
| Move to a different controller | Save the new host and credentials — no reconnect needed |
When the connector misbehaves
Section titled “When the connector misbehaves”If Claude reports the connector as unavailable, or you end up looping through sign-in without landing on the consent screen, see Troubleshooting.