UniFi Gateway

pete-builds/mcp-unifi

Connects to self-hosted UniFi controllers (UDM, UCG, UDR) via local API keys to manage network devices, VLANs, firewall rules, switch ports, and DHCP reservations, plus Protect cameras and Access doors. Every destructive operation supports dry run mode with change previews, and composite tools like create_iot_network or provision_camera automatically roll back on partial failure. All calls land in a JSONL audit log you can replay against a fresh controller. Ships with 86 tools across Network, Protect, and Access modules. Multi-site support lets one instance manage multiple controllers. Reach for this when you want LLM-driven UniFi automation with guardrails baked in at the tool level.

GitHub stars: 31
tool: 1
auth: Secret needed
transport: HTTP
env vars: 16
last updated: Nov 11, 2026

View on GitHub

Tools

1 tools

Public tool metadata for what this MCP can expose to an agent.

confirm_destructive_actionConfirms a destructive action before it is executed.

Confirms a destructive action before it is executed.

No parameter schema in public metadata yet.

Configuration

STUB_MODEdefault: true

When true, the server returns realistic mock data and requires no UniFi hardware. Defaults to true. Set to false to manage a real gateway, which then needs UNIFI_HOST plus UNIFI_API_KEY (or UNIFI_API_KEY_FILE), or MCP_UNIFI_CONTROLLERS_FILE. In either mode the HTTP transport will

MCP_UNIFI_AUTH_TOKENS*secret

Bearer tokens that HTTP clients must present. Required: the streamable-http transport exits at startup with 'HTTP transport requires MCP_UNIFI_AUTH_TOKENS' when it is empty. Comma-separated; each entry is a bare token (named client-N automatically) or a 'name:token' pair. Generat

MCP_UNIFI_READONLYdefault: false

When true, every tool that changes state is hidden from tools/list and refused on tools/call; read tools are unaffected. Defense in depth on top of a read-only UniFi API key. Defaults to false.

UNIFI_HOST

IP address or hostname of the UniFi OS gateway (UCG-Fiber, UDM Pro, etc). Required when STUB_MODE=false and MCP_UNIFI_CONTROLLERS_FILE is unset.

UNIFI_API_KEYsecret

Local API key generated under Settings -> Control Plane -> Integrations on the gateway. Required when STUB_MODE=false and MCP_UNIFI_CONTROLLERS_FILE is unset, unless UNIFI_API_KEY_FILE is used instead.

UNIFI_API_KEY_FILE

Path to a file inside the container that holds the local API key, for a Docker or Kubernetes secret mount. Wins over UNIFI_API_KEY when both are set. A controller configured this way verifies the gateway's TLS certificate unless UNIFI_VERIFY_SSL is set to false.

UNIFI_PINNED_CERT

Path to a file inside the container that holds the gateway's own certificate in PEM, recorded with mcp-unifi-pin-cert. When set, that certificate is the only one the server accepts from the gateway, and a mismatch fails every request. Do not set UNIFI_VERIFY_SSL to false alongsid

UNIFI_SITEdefault: default

UniFi controller site name. Defaults to 'default'.

UNIFI_VERIFY_SSLdefault: false

Whether to verify the gateway's TLS certificate. Defaults to false because most home gateways use a self-signed cert.

MCP_UNIFI_CONTROLLERS_FILE

Path to a YAML file describing multiple named controllers for multi-site management. When set, the legacy UNIFI_HOST / UNIFI_API_KEY env vars are ignored. Each entry needs name, host, api_key, and optionally port, site, verify_ssl.

MCP_UNIFI_MODULES_ENABLEDdefault: network

Comma-separated list of modules to load. Known values: 'network', 'protect', 'access'. Defaults to 'network'. Set to 'network,protect,access' to enable Protect and Access tools alongside Network. Access currently ships read-only; door unlocks and credential issuance require sessi

UNIFI_ACCESS_HOST

UniFi Access hub IP or hostname. Required when the access module is enabled and STUB_MODE=false. Often the same host as UNIFI_HOST.

UNIFI_ACCESS_API_KEYsecret

UniFi Access API key. Separate from the Network API key; generated on the Access controller's developer settings. Required when the access module is enabled and STUB_MODE=false.

UNIFI_ACCESS_PORTdefault: 12445

HTTPS port for the Access hub. Defaults to 12445 (the direct Access app port).

MCP_UNIFI_AUDIT_SINKdefault: file

Audit log sink. One of 'file' (default), 'stdout', or 'syslog'. Every tool call is recorded to a JSONL stream with secrets scrubbed.

MCP_UNIFI_AUDIT_PATHdefault: audit.jsonl

Path for the audit log file when MCP_UNIFI_AUDIT_SINK=file. Defaults to audit.jsonl in the process CWD.

Readme

mcp-unifi

Safety-first MCP server for self-hosted UniFi. Dry-run previews, JSONL audit log, composite rollback. Network + Protect + Access.

Install in Claude

Paste this into Claude Desktop's config file, put in your gateway's address and API key, then fully quit and reopen Claude Desktop. It runs the v0.29.0 release through uvx (install uv first), reads your own network, and cannot change anything on it.

View the full README on GitHub

Details

Repository: github.com/pete-builds/mcp-unifi
Website: pete-builds.github.io/mcp-unifi
Category: Monitoring & Observability
Package: ghcr.io/pete-builds/mcp-unifi:0.28.0
Transport: HTTP
Auth: Required
Registry: MCP registry, active

Related Monitoring & Observability MCP servers

View all

MCP Registry Monitornirholas/mcp-notifyMonitor MCP registry for new servers - Discord Slack notifications alerts26stars

Nslookupnslookup-io/nslookup-mcpDNS lookups, health reports, SSL certs, security scans, GEO scoring, uptime checks23stars

Mcp Zuulimatza-rh/mcp-zuulZuul CI — build failure analysis, log search, pipeline status, and job configuration21stars

ZulipChat MCP Serverakougkas/zulipchat-mcpZulipChat MCP: Connect AI to Zulip with 60+ tools for messaging, streams, events, and analytics18stars

Attestorbolnet/attestorSelf-hosted memory for agent teams. Bi-temporal replay, deterministic retrieval, audit log.13stars

Scholar Feedygao2005/scholar-feed-mcpRank CS/AI/ML papers by citations, forecast impact, or code adoption; trace 23.2M citation edges.13stars