M
MCP Directory CURATED DIRECTORY
911 MCP servers indexed
中文
← Back to directory
U

UniFi MCP Server

Community
MCP server for managing UniFi network devices, WiFi, and firewalls via the official UniFi API
How to install ↓ Compare GitHub source repository ↗
Category
Other #165 of 230
Stars
★ 296 Very popular
Transport
stdio (local process) · SSE · Streamable HTTP
Runtime
Python 3.10+ · Docker · Node.js
Credentials
API key / credential required
License
Apache-2.0
Last commit
Tools
5
48FMRS · D

Broad feature coverage (devices, networks, WiFi, firewall, QoS, backups, topology), but the server.json manifest and the README's described latest version disagree on packaging, transport, and auth variables, and several enterprise security features remain planned rather than implemented — verify the docs for the specific version installed before relying on it.

Strongest · Maintenance 15/20 Weakest · Reliability 6/20

Reliability
6/20
Security and permissions
10/20
Maintenance
15/20
Documentation
9/20
Setup experience
8/20
Why each score
Reliability 6/20
server.json declares an npm package (stdio transport) with env vars UNIFI_HOST/UNIFI_USERNAME/UNIFI_PASSWORD/UNIFI_PORT/UNIFI_VERIFY_SSL/UNIFI_SITE, while the README describes an entirely different runtime: a PyPI-distributed Python project (pip install unifi-mcp-server, Python 3.10+) using a completely different env-var set (UNIFI_API_KEY, UNIFI_API_TYPE, UNIFI_LOCAL_HOST, etc.), with no mention of UNIFI_USERNAME/PASSWORD anywhere. This is a fundamental mismatch between the manifest and the documented runtime — following the manifest literally would very likely fail to install or authenticate. The README also documents a past critical startup ImportError (issue #42) that broke the server entirely. Tool-count claims are internally inconsistent (74 vs ~220 vs 215+), indicating doc/code drift. With no CI or test files available to verify testing claims, and per the static calibration cap of 12 without such evidence, this is scored low and further reduced by the manifest defect.
Security and permissions 10/20
The README states all mutating operations require explicit confirm=True, a reasonable baseline. However, dry-run mode, audit logging, and RBAC are explicitly marked 'Planned' rather than implemented, so least-privilege and auditability controls are currently incomplete. The documented .env template defaults local-gateway TLS verification to false (UNIFI_LOCAL_VERIFY_SSL=false), i.e., certificate validation is disabled by default rather than opt-in, a real (if network-local) MITM exposure. The credential model itself is contradictory: the manifest requires username+password (password marked secret) while the README's entire security/config narrative is built around an API key with no username/password flow described, so how credentials are actually stored and scoped cannot be verified. No malware/exfiltration or other red-line issue was found, so this stays out of the 0-4 band, but incomplete controls plus a default-off TLS check justify a mid-low score.
Maintenance 15/20
The README shows a genuinely active release cadence (0.2.0 → 0.2.5) with dated changelogs, CI/security workflow badges, Codecov integration, and PyPI/Docker/npm multi-channel publishing, plus structured roadmap docs (DEVELOPMENT_PLAN.md, SPEC.md). Apache-2.0 license is present, SECURITY.md is referenced for vulnerability reporting, and automated issue triage is described. The repo is not archived and has 24 open issues, a manageable volume. This suggests real ownership and process, though commit history itself could not be independently verified from the provided material, so it falls short of a perfect score.
Documentation 9/20
Documentation is extensive and layered (README, API.md, SPEC.md, DEVELOPMENT_PLAN.md, SECURITY.md, docs/ subfolder, skills/), covering install, transports, API modes, and troubleshooting runbooks. But it contains substantive internal contradictions that undercut trust: tool-count claims disagree (74 vs '~220 async tool functions' vs '215+ tools registered', and the project-structure note of '213 tests, 37% coverage' conflicts with the body text's '1,236 tests passing'); more importantly, the documented env vars and package registry (PyPI/Python) directly conflict with the server manifest (npm/username-password). These are not typos but core configuration facts, which under the evidence rules counts as a real documentation-quality defect rather than being offset by sheer volume.
Setup experience 8/20
The README documents multiple install paths (PyPI pip/uv, Docker, Docker Compose, build-from-source) with concrete client config JSON for Claude Desktop and Cursor, which is good practice. However, per the static calibration, setup cannot exceed 15 without verifiable execution evidence, and here the reviewed object itself — server.json (npm package, stdio, UNIFI_HOST/USERNAME/PASSWORD) — contradicts the README's actual install/config guidance (PyPI, UNIFI_API_KEY, UNIFI_LOCAL_HOST). A user following the manifest as written would likely fail to connect or authenticate. This core inconsistency between the manifest under review and its own README is a significant real-world setup risk.

Static review · not runListed 2026-08-26

Read the FMRS scoring method →

Fit and risk

What it can accessUses the networkChanges third-party account data

Best for

  • Home or small-office users running a local UniFi gateway who want AI-assisted network operations
  • Technically comfortable users familiar with UniFi controller concepts who will validate tool behavior incrementally

Not for

  • Users limited to cloud API access who need full device/client-level control (cloud modes are largely read-only)
  • Enterprise deployments requiring production-grade audit logging, RBAC, or dry-run safeguards that are already fully implemented (per the README, these are still planned)

Required permissions

  • UniFi controller address (local gateway IP or cloud API) and login credentials (username/password or API key)
  • Direct network reachability to the controller (local gateway mode requires LAN access)
  • Write access to firewall rules, networks/VLANs, WiFi, and device state if mutating tools are used

Risks and side effects

  • The server can perform broad administrative operations on network infrastructure (restart/upgrade devices, modify firewall and WiFi settings); misconfiguration can disrupt network connectivity
  • Credentials (API key or username/password) are configured as plaintext environment variables and must be handled carefully
  • The README indicates local gateway mode defaults SSL certificate verification to false (UNIFI_LOCAL_VERIFY_SSL), which carries a man-in-the-middle risk
  • The server.json manifest and the README describe different versions, packaging, and auth variables — copying either config verbatim without reconciling may fail to connect
  • Dry-run mode, audit logging, and RBAC are documented as 'planned' rather than shipped, so they cannot be relied on as active safeguards

Setup

Before you start

Runtime：Python 3.10+ · Docker · Node.js

UNIFI_HOST required UniFi Controller hostname or IP address (required by server. manifest).
UNIFI_USERNAME required UniFi Controller username.
UNIFI_PASSWORD requiredsecret UniFi Controller password, secret.
UNIFI_API_KEY requiredsecret API key created in unifi.ui.com under Settings → Control Plane → Integrations; shown only once.
UNIFI_API_TYPE required API mode: local (recommended), cloud-ea, or cloud-v1.
REDIS_PASSWORD optionalsecret Redis password if authentication is required, secret.
WEBHOOK_SECRET optionalsecret Secret for webhook HMAC signature verification, secret.
Other optional settings (16)
UNIFI_PORT optional Controller port, default 443.
UNIFI_VERIFY_SSL optional Whether to verify the SSL certificate, default true.
UNIFI_SITE optional UniFi site name, default 'default'.
UNIFI_LOCAL_HOST optional Local gateway IP (e.g. 192.168.2.1), used in local mode.
UNIFI_LOCAL_PORT optional Local gateway port, default 443.
UNIFI_LOCAL_VERIFY_SSL optional Whether to verify local gateway SSL, default false.
UNIFI_CLOUD_API_URL optional Cloud API URL, default https://api.ui.com.
UNIFI_DEFAULT_SITE optional Default site ID, default 'default'.
UNIFI_SITE_MANAGER_ENABLED optional Enable Site Manager multi-site tools (cloud-ea only), default false.
UNIFI_PROFILE optional Tool exposure profile: network, devices, security, system, or minimal; default loads all tools.
MCP_SERVER_TRANSPORT optional Transport mode: stdio (default), sse, http, or streamable_http.
MCP_SERVER_HOST optional Bind address for HTTP/SSE, default 0.0.0.0.
MCP_SERVER_PORT optional Port for HTTP/SSE, default 3000.
REDIS_HOST optional Optional Redis cache host, default localhost.
REDIS_PORT optional Optional Redis cache port, default 6379.
REDIS_DB optional Optional Redis database number, default 0.

1) Determine which distribution you're actually installing: the repo's server.json manifest corresponds to an npm package (v0.2.0, stdio transport, requiring UNIFI_HOST/UNIFI_USERNAME/UNIFI_PASSWORD), while the README describes the latest stable release (v0.2.5) installed via pip install unifi-mcp-server with a different UNIFI_API_KEY/UNIFI_API_TYPE-based config — the two env-var schemes are not interchangeable, so confirm which one matches your install. 2) For the npm package, launch it in your MCP client with npx -y unifi-mcp-server and set UNIFI_HOST, UNIFI_USERNAME, UNIFI_PASSWORD (optionally UNIFI_PORT, UNIFI_VERIFY_SSL, UNIFI_SITE). 3) For the PyPI package, use the README's UNIFI_API_KEY/UNIFI_API_TYPE/UNIFI_LOCAL_HOST variables instead. 4) Restart your client and test with a read-only tool first before running any mutating operations.

claude_desktop_config.json 
{"mcpServers":{"unifi":{"command":"npx","args":["-y","unifi-mcp-server"],"env":{"UNIFI_HOST":"your-unifi-controller-host","UNIFI_USERNAME":"your-username","UNIFI_PASSWORD":"your-password"}}}}

Shown for Claude Desktop. Other clients may use a different file or key (VS Code uses "servers") — the configurator below converts it.

.vscode/mcp.json
{
  "servers": {
    "unifi": {
      "command": "npx",
      "args": [
        "-y",
        "unifi-mcp-server"
      ],
      "env": {
        "UNIFI_HOST": "your-unifi-controller-host",
        "UNIFI_USERNAME": "your-username",
        "UNIFI_PASSWORD": "your-password"
      }
    }
  }
}

Goes in your project's .vscode/mcp.json (VS Code uses a "servers" key).

Terminal
claude mcp add unifi -e UNIFI_HOST=your-unifi-controller-host -e UNIFI_USERNAME=your-username -e UNIFI_PASSWORD=your-password -- npx -y unifi-mcp-server

Run it in a terminal; replace any <…> placeholders with your own values first.

Generate and validate client config

Check that it works

After starting the server, check that tools like list_devices appear in your MCP client's tool list, then ask it to list devices on a site to confirm the connection.

Troubleshooting

  1. First confirm which version/source is actually installed (npm manifest vs. PyPI/README) and match the corresponding environment variable names
  2. Verify UNIFI_API_TYPE (local/cloud-ea/cloud-v1, if applicable) matches actual network reachability; cloud modes cannot access individual devices or clients
  3. Check that mutating tools are called with the required confirm parameter
  4. If local gateway connections fail, check SSL verification settings and the gateway IP/port
  5. If using SSE/HTTP transport modes, confirm MCP_SERVER_PORT is free and the client URL configuration is correct

Things to try

Once connected, you can ask your AI assistant things like:

  • List all UniFi devices on my default site
  • Create a guest WiFi network named Guest WiFi with VLAN isolation (confirmed)
  • Show the top 5 applications by traffic over the last 24 hours
  • Create an IoT firewall zone and set a policy allowing LAN to access IoT

Tools 5

list_devices read-only
Lists UniFi devices (access points, switches, gateways) and their status for a given site.
create_wlan writes
Creates a new WiFi/SSID network with configurable security, guest mode, and VLAN isolation.
list_top_applications read-only
Returns top bandwidth-consuming applications based on Deep Packet Inspection (DPI) statistics.
create_firewall_zone writes
Creates a Zone-Based Firewall (ZBF) zone for network segmentation.
update_zbf_policy writes
Updates a zone-to-zone firewall policy (e.g., accept or reject traffic between two zones).

Use cases

Let an AI assistant query UniFi devices, clients, and network status
Create or adjust WiFi networks, VLANs, and firewall policies conversationally
Pull DPI stats like top bandwidth applications for troubleshooting
Aggregate analytics across multiple sites (limited functionality in cloud API modes)

Supported clients

Claude Desktop
Cursor

Listed from the project's documentation, not tested by this site.

Overview

UniFi MCP Server is a third-party community project (by enuno) that exposes the UniFi Network Controller's official API to AI agents via the Model Context Protocol. It can list and control devices (APs, switches, gateways), manage clients, create/modify WiFi networks and VLANs, configure firewall rules and Zone-Based Firewall (ZBF) policies, and manage QoS, backups, and multi-site setups. The repository contains two overlapping configuration stories: the published server.json manifest (npm package v0.2.0, stdio transport, authenticating with UNIFI_HOST/UNIFI_USERNAME/UNIFI_PASSWORD) and the README's description of the latest release (PyPI package v0.2.5, authenticating with UNIFI_API_KEY and UNIFI_API_TYPE, and supporting stdio/SSE/HTTP/Streamable HTTP transports). The README also states several 'Phase 5' capabilities (dry-run mode, audit logging, RBAC, A2A) are still planned, not yet implemented — check the docs for the version you actually install.

Similar servers

BioMCP 75 · B

One binary. One grammar. Evidence from the biomedical sources you already trust.

★ 659 · Tools 11 Compare with this →
Compare with other MCP servers

Source revision 820ce435cb54 Data synced 2026-10-19 Read the FMRS scoring method