# MCP tools

> Every tool the WLAN Commander sensor MCP adapter offers, the scope each needs and its parameters.

The adapter offers a tool only when the credential has its scope, so an agent never sees a tool it
cannot use. Set it up with [Connect an AI agent](/developers/agents/). Read-only tools are marked as
read-only to the MCP client.

| Scope | Tool | Parameters |
| --- | --- | --- |
| `health:read` | `sensor_health` (read-only) | none |
| `health:read` | `sensor_capabilities` (read-only) | none |
| `results:read` | `sensor_results` (read-only) | `offset` |
| `scan:run` | `start_scan` | `interface`, `request_id`, `seconds` |
| `capture:run` | `start_capture` | `interface`, `request_id`, `seconds`, optional `frequency` |
| `network:run` | `run_network_test` | `kind` (ping, trace or dns), `target`, `request_id`, `seconds` |
| `radius:read` | `radius_status`, `radius_configuration`, `radius_certificates`, `radius_accounting`, `radius_test_catalog`, `metering_draft_catalog`, `radius_reports`, `radius_report` (all read-only) | `engine`, `offset` or `report_id` where relevant |
| `radius:test` | `analyze_radius_capture`, `start_radius_test`, `radius_password_probe`, `validate_radius_test`, `evaluate_metering_draft` | Artifact, interface, user or test YAML, with a `request_id` |
| `radius:control` | `radius_service`, `radius_session_action` | `enabled`; `session_id` and `action` (CoA or disconnect) |
| `radius:write` | `save_radius_user`, `save_radius_client`, `delete_radius_entry`, `generate_radius_certificate`, `regenerate_radius_pki`, `generate_radius_user_certificate`, `import_radius_certificate`, `delete_radius_certificate`, `save_radius_test`, `delete_radius_test`, `configure_radius`, `delete_radius_reports` | The user, client, certificate identity or test being changed |
| `radius:secrets` | `export_radius_identity`, `create_radius_profile` | Identity and package password; platform, SSID and server names |
| Any credential | `list_jobs`, `job_status`, `cancel_job` | `job_id` |

Export tools return an authenticated download reference, never private-key or profile bytes in the
agent's output. The adapter limits each response to 4 MiB, uses fixed API routes, does not follow
redirects and does not pass the sensor's error text back to the agent.