SZ-MCP

SmartZone MCP connector

Ask your SmartZone questions in plain English.

SZ-MCP gives Claude access to 1,354 SmartZone REST operations, wireless and switch, over a hosted connector. Your controller needs a public address and a publicly trusted TLS certificate.

Connect SmartZone ↗ Read the docs ↗

Privacy

Claude

Which WLANs on this controller are configured with an open security profile?

SZ-MCP Queried the full WLAN list and filtered by security profile. Found open-security WLANs: 'Guest' and 'IoT-Staging'. The remaining WLANs use WPA2-Enterprise or WPA2-Personal. Want the full configuration for either?

Illustrative example

How it works

Connect in three steps

Meet the network requirement

Your SmartZone controller needs a public IP address or hostname and a publicly trusted TLS certificate. SmartZone's default self-signed certificate won't work.

Sign in and save your controller

Sign in with Google. Enter your controller host, port, username, and password. Click Save & detect: SZ-MCP logs in once and stores the API version it finds.

Add to Claude and ask

Copy the connector URL from your dashboard. In Claude, go to Settings → Connectors → Add custom connector. Approve the consent screen and ask in plain English.

How a question travels: Claude, SZ-MCP, your SmartZone.

Capabilities

What SZ-MCP covers

One MCP tool connects Claude to 1,354 SmartZone REST operations across WSG (wireless) and SwitchM (switches). Claude searches, reads schemas, and calls endpoints.

Wireless and switch operations

WSG covers 1,116 wireless operations: zones, AP groups, APs, WLANs, clients, DPSK, rogues, and more. SwitchM covers 238 switch operations: VLANs, ports, firmware, BGP-EVPN, CLI templates.

Plain-English queries

Ask about client counts, open WLAN profiles, AP firmware versions, or switch port states. Claude finds the right endpoint, reads its schema, and calls it.

Search, read, and call

Claude writes a short script to search operations, read endpoint schemas, and call the API. The server runs it in a sandbox; only the result returns to Claude.

Automatic version detection

At setup and on Test connection, SZ-MCP tries API versions v9_0 through v14_1 and stores the first one that responds correctly.

Automatic session handling

Service tickets are minted server-side, cached up to 25 minutes, and renewed automatically on expiry. A failed ticket triggers one re-login and retry.

Switch controllers anytime

Your connector URL is tied to your account, not the controller. Save new host and credentials to switch; the cached session is flushed automatically.

In use

The SZ-MCP dashboard: the MCP URL to add to Claude, and the SmartZone credentials form after a successful connection test. Example values. — Connector URL, credential form, and access-control notice on one page.

Who it's for

Who uses SZ-MCP

SmartZone admin

Get answers about zones, APs, WLANs, and clients without hunting through the SmartZone UI or memorizing which API endpoint covers what.

MSP engineer

Pull current state from a customer's SmartZone quickly. Save new credentials to point the same connector URL at a different controller.

Network engineer

Track down clients roaming badly, APs at capacity, or switch ports with unexpected VLANs without writing one-off scripts.

Pre-sales engineer

Query SmartZone state during assessments. Ask about WLAN security profiles, client distribution, or AP firmware versions across a zone.

Security

Security and data handling

SZ-MCP stores account data, usage events, and controller access details. Here is exactly what is kept, how long, and how it is protected.

Password encrypted at rest

Your controller password is encrypted with AES-256-GCM using a unique per-record salt. Your host, port, and username are stored in plain text.

OAuth 2.1 with mandatory PKCE

The Claude connector uses OAuth 2.1, RFC 7591 dynamic client registration, and PKCE with S256 only. Tokens are stored as SHA-256 hashes, never in plain text.

Scripts run in a sandbox

Short scripts run in a separate V8 isolate with no outbound network access. Hard caps: 20 seconds per run, 15 seconds per upstream request.

Access follows SmartZone roles

SZ-MCP doesn't gate by HTTP method. Claude can do whatever the saved admin account can do. Create a restricted SmartZone admin to limit Claude's reach.

API responses relayed, not stored

SmartZone responses and Claude's scripts are relayed in memory only, not stored. Usage metadata (tool name, time, status, duration) is kept for 90 days.

How it's built

How SZ-MCP is built

A focused Cloudflare connector, about 3,000 lines of Worker TypeScript, written as a compact sibling of R1-MCP.

One tool for 1,354 operations

SmartZone exposes 1,354 REST operations: 1,116 for wireless (WSG) and 238 for switches (SwitchM). Giving Claude a separate MCP tool for each would flood its context window. So I gave it one tool and two small objects, `wifi` and `switches`, each with five functions: search, browse by tag, read a full endpoint schema, and call. Claude writes a short script that chains those calls, the server runs it in a sandboxed V8 isolate, and only the result goes back. Specs are indexed at build time into slim JSON bundled in the Worker; full specs sit in R2 and load on demand when Claude reads a schema.

SZ-MCP is a sibling of R1-MCP, built on the same auth and sandbox pattern. The main work was handling SmartZone's service-ticket auth, detecting the right API version at setup (twelve candidates, v9_0 through v14_1), and routing WSG and SwitchM to their separate base paths. About 3,000 lines of Worker TypeScript, 2,240 lines of React frontend, three test files covering host validation, the retention sweep, and terms acceptance.

Security-first start

Before the first user existed I audited the scaffold and fixed everything it found the same day, in PRs #3 through #8.

Later hardening added canonical IP-literal handling to the SSRF check (PR #15, September 2026), privacy-version re-acceptance on policy changes (#16, #18), and stopped advertising plain PKCE (#17). The deny-list blocks RFC 1918, loopback, link-local, CGNAT, IPv6 ULA and link-local, and reserved hostname patterns.

Two limits worth stating

The controller must be on a public address with a publicly trusted TLS certificate. Cloudflare Workers cannot skip certificate verification, and there is no tunnel or relay. A controller only on a private LAN will not work.

The API catalogue is pinned to v13_1. Version detection at setup picks the correct path prefix, but the spec Claude searches is always v13_1. An endpoint that exists in v13_1 but not on an older controller will return a 404.

FAQ

Common questions

Does my controller need to be reachable from the internet?

Yes. SZ-MCP calls your controller from Cloudflare's network over HTTPS. Your controller needs a public address and a publicly trusted TLS certificate. SmartZone's default self-signed certificate won't work; the docs suggest Let's Encrypt via DNS-01.

Can Claude make changes to my controller, or is it read-only?

Claude can do whatever the SmartZone admin account you save can do, including writes and deletes. SZ-MCP does not add its own permission layer. Use a restricted SmartZone admin with the minimum role and domain scope to limit what Claude can touch.

Which SmartZone versions are supported?

SZ-MCP detects API versions v9_0 through v14_1 at setup. The API catalogue Claude searches is v13_1. If your controller runs an older version and an endpoint changed or didn't exist, you may get a 404.

How is my controller password stored?

Your controller password is encrypted at rest with AES-256-GCM using a unique per-record salt. It is decrypted in memory only when SZ-MCP mints a new service ticket. Your host and username are stored in plain text.

Can I connect multiple controllers?

One controller per account. To switch, save new host and credentials from your dashboard. Your connector URL stays the same; you don't need to update Claude's settings.

How much does SZ-MCP cost?

Free. Open sign-up with any verified Google account. No plans, no tiers, no billing.

How do I delete my account or export my data?

Credential delete is self-service from your dashboard. To delete your account, request a data export, or revoke tokens, email privacy@neuralconfig.com.

Connect SmartZone to Claude

Free, open sign-up with any Google account. Your controller needs a public address and a publicly trusted TLS certificate to connect.

Connect SmartZone ↗

Documentation · Privacy

SZ-MCP is an independent product of NeuralConfig LLC. It is not made, endorsed or supported by RUCKUS Networks. RUCKUS and SmartZone are trademarks of their respective owners; Claude is a trademark of Anthropic.