Allows management of UniFi network devices and infrastructure, including querying devices, clients, network stats, managing WiFi, VLANs, firewall rules, creating network configurations, and monitoring network health. Supports both cloud and local Dream Machine controllers via API.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@UniFi MCP Server list all devices on the network"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Control your UniFi network via AI. 2-tool design powered by OpenAPI spec — works with UniFi Cloud API or local Dream Machine.
Query devices, clients, network stats
Manage WiFi, VLANs, firewall rules
Create network configurations
Monitor network health
Related MCP server: unifi-mcp
Go to account.ui.com
Sign in → Settings → API Keys
Create new key → copy it
UNIFI_API_TYPE=cloud-ea UNIFI_API_KEY=your-key-here npx @bakhshb/unifi-mcpOr create a .env file:
UNIFI_API_TYPE=cloud-ea
UNIFI_API_KEY=your-key-hereThen run:
npx @bakhshb/unifi-mcpOpenClaw (~/.openclaw/openclaw.json):
{
"mcp": {
"servers": {
"unifi": {
"command": "npx",
"args": ["@bakhshb/unifi-mcp"],
"env": {
"UNIFI_API_TYPE": "cloud-ea",
"UNIFI_API_KEY": "your-key-here"
}
}
}
}
}Claude Desktop (~/Library/Application Support/Claude/claude_desktop_config.json):
{
"mcpServers": {
"unifi": {
"command": "npx",
"args": ["@bakhshb/unifi-mcp"],
"env": {
"UNIFI_API_TYPE": "cloud-ea",
"UNIFI_API_KEY": "your-key-here"
}
}
}
}Your local UniFi controller (Dream Machine, etc.) also supports API keys, just like the cloud API. Generate an API key in your controller settings:
Go to your UniFi Controller → Settings → API Keys
Create a new key for local access
Use the same env vars as cloud, but with UNIFI_API_TYPE=local
UNIFI_API_TYPE=local
UNIFI_API_KEY=your-local-api-key
UNIFI_LOCAL_HOST=192.168.1.1
UNIFI_LOCAL_VERIFY_SSL=falseOr in openclaw.json:
{
"mcp": {
"servers": {
"unifi": {
"command": "npx",
"args": ["@bakhshb/unifi-mcp"],
"env": {
"UNIFI_API_TYPE": "local",
"UNIFI_API_KEY": "your-local-api-key",
"UNIFI_LOCAL_HOST": "192.168.1.1",
"UNIFI_LOCAL_VERIFY_SSL": "false"
}
}
}
}
}Variable | Required | Default | Description |
| Yes | - | Your UniFi controller URL (e.g., |
| Yes* | - | Your API key (*required if not using username/password) |
| Yes* | - | UniFi username (*required if not using API key) |
| Yes* | - | UniFi password (*required if not using API key) |
| No |
| Your UniFi site identifier |
| No |
| Request timeout in milliseconds |
Note: Set either UNIFI_API_KEY OR (UNIFI_USERNAME + UNIFI_PASSWORD).
Note: For local mode, you can also use session cookies (UNIFI_SESSION_COOKIE + UNIFI_CSRF_TOKEN) instead of API key, but API key is simpler.
UniFi MCP supports three connection modes, set via UNIFI_API_TYPE:
Mode | When to use | Auth required | Rate limit |
| Your Dream Machine / UDM Pro SE on the LAN | API key | None |
| Remote management via Ubiquiti cloud (stable) | API key | 10,000 req/min |
| Remote management via Ubiquiti cloud (Early Access) | API key | 100 req/min |
local — Connect directly to your UniFi controller on the local network. Full access, no external traffic, no rate limits. Requires UNIFI_LOCAL_HOST.
cloud-v1 — Stable cloud API hosted at api.ui.com. Backward compatible with long-term support. Higher rate limit but core feature set only.
cloud-ea — Early Access cloud API at api.ui.com. Newer features before they land in v1, but lower rate limit and may still evolve. The Site Manager API and some newer endpoints live here first.
Which to choose?
Home lab / local network → local (your UDM Pro SE)
Remote management, production stability → cloud-v1
Remote management, want latest features → cloud-ea
unifi-apiExecute any UniFi Integration API call. Examples:
unifi-api with path="/v2/sites" → list all sites
unifi-api with path="/v1/sites/{siteId}/devices" and pathParams={siteId:"default"} → get devices
unifi-api with path="/v1/sites/{siteId}/clients" and pathParams={siteId:"default"} → get clients
unifi-api-schemaDiscover available Integration API operations:
No args → list all tags/operations
tag="sites" → operations for sites
path="/v1/sites/{siteId}/devices" → details for that path
unifi-legacy-client-statsGet per-client bandwidth statistics from the legacy controller API (/api/s/{site}/stat/sta). This endpoint is separate from the Integration API and returns real-time tx/rx bytes and rates per client.
Why a separate tool? The legacy controller API is not covered by the UniFi OpenAPI spec (beezly/unifi-apis). It exists on the same controller but uses different paths (/proxy/network/api/s/) and returns bandwidth data (tx_bytes, rx_bytes, tx_rate, rx_rate) unavailable in the Integration API.
Parameter | Type | Default | Description |
| string |
| Site name or ID |
Example response:
{
"success": true,
"message": "Legacy client stats: 2 active clients on site 'default'",
"data": {
"count": 2,
"site": "default",
"clients": [
{
"hostname": "iPhone",
"ip": "192.168.1.100",
"mac": "aa:bb:cc:dd:ee:ff",
"network": "Home",
"vlan": 1,
"is_wired": false,
"tx_bytes": 1234567890,
"tx_bytes_formatted": "1.15 GB",
"rx_bytes": 987654321,
"rx_bytes_formatted": "941.8 MB",
"tx_rate_bps": 1500,
"tx_rate_formatted": "1.5 Kbps",
"rx_rate_bps": 800,
"rx_rate_formatted": "800 bps",
"uptime": 3600,
"uptime_formatted": "1h 0m",
"signal": -50,
"essid": "MyWiFi",
"ap_name": "UDM-Pro"
},
{
"hostname": "laptop",
"ip": "192.168.1.50",
"mac": "11:22:33:44:55:66",
"network": "Home",
"vlan": 1,
"is_wired": true,
"tx_bytes": 50000000,
"tx_bytes_formatted": "47.7 MB",
"rx_bytes": 100000000,
"rx_bytes_formatted": "95.4 MB",
"tx_rate_bps": 0,
"tx_rate_formatted": "0 B/s",
"rx_rate_bps": 0,
"rx_rate_formatted": "0 B/s",
"uptime": 7200,
"uptime_formatted": "2h 0m",
"ap_name": "Switch"
}
]
}
}"API key required" → Set UNIFI_API_KEY in your environment
"Connection refused" → Check UNIFI_LOCAL_HOST for local mode
SSL errors → Set UNIFI_LOCAL_VERIFY_SSL=false for local
Token savings: Traditional UniFi MCP servers cost ~45,000–60,000 tokens per session. The 2-tool + 1-legacy approach costs ~500–1,500 tokens for the Integration API, plus ~200 tokens for the legacy stats tool — a ~97% reduction.
Approach | Tools | Token Cost | Coverage |
enuno/unifi-mcp-server (explicit) | 148 | ~45,000–60,000 | Fixed |
sirkirby/unifi-mcp (multi-product) | ~82 | ~25,000–35,000 | Network + Protect + Access + Drive |
This server (2-tool + 1-legacy) | 3 tools | ~700–1,700 | 44+ Integration API ops + legacy stats |
3 tools instead of 148 explicit tools → ~97% less context overhead
2 generic tools for Integration API (OpenAPI spec-driven, dynamically scales with API surface)
1 legacy tool for bandwidth stats (not in OpenAPI spec, controller-specific)
Inspired by @dokploy/mcp (tacticlaunch/dokploy-mcp) — first MCP server to demonstrate the 2-tool OpenAPI pattern, covering 463 Dokploy operations in ~500 tokens
OpenAPI specs from beezly/unifi-apis (which traces its API research lineage to sirkirby/unifi-mcp)
MIT License
Execute any UniFi Network API operation. Specify the spec path (e.g. /v1/sites/{siteId}/devices) and optional path params, query params, or body. HTTP method is auto-detected. Use unifi-api-schema to discover available paths.
| Name | Required | Description | Default |
|---|---|---|---|
| body | No | JSON request body | |
| path | Yes | OpenAPI spec path (e.g. /v1/sites/{siteId}/devices) | |
| method | No | HTTP method. Auto-detected if omitted. | |
| pathParams | No | Path parameters to substitute (e.g. { siteId: 'abc' }) | |
| queryParams | No | Query string parameters |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds context about auto-detection of HTTP method and the generic nature of the tool, but beyond annotations (openWorldHint=true, readOnlyHint=false) does not disclose specific behavioral traits like error handling, rate limits, or potential destructive effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the primary purpose, and includes a concrete example and a pointer to the sibling tool. Every sentence adds value with no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (generic API executor, 5 params, no output schema, openWorldHint), the description provides essential usage context but lacks information on return values, error handling, authentication, and potential side effects, making it adequate but not comprehensive.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 100% schema description coverage, the baseline is 3. The description reiterates parameter roles (path, pathParams, queryParams, body, method) but adds minimal new meaning beyond the schema, such as the auto-detection behavior already stated in method description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool executes any UniFi Network API operation, provides an example path, and explicitly directs to the sibling tool unifi-api-schema for path discovery, distinguishing it from alternatives.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description mentions auto-detection of HTTP method and recommends using unifi-api-schema for path discovery, but does not provide explicit guidance on when to use this tool vs unifi-legacy-client-stats or when to avoid it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Discover available UniFi Network API operations from the OpenAPI spec. Call with no args for a tag overview, with tag to list operations in that tag, or with path for full parameter and request body details.
| Name | Required | Description | Default |
|---|---|---|---|
| tag | No | Filter by tag (e.g. 'sites', 'devices', 'networks') | |
| path | No | Get details for a specific path (e.g. /v1/sites/{siteId}/devices) |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations mark it as read-only and open-world. The description adds that results vary by argument (tag overview, path details), providing behavioral context beyond annotations without contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with verb and resource, no wasted words. Every part adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a schema discovery tool, the description covers all three usage modes and expected output, compensating for lack of output schema. Complete for the tool's complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with descriptions for both parameters. The description reiterates the parameter purposes but only adds marginal usage patterns (e.g., 'call with no args'). Baseline is 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'Discover' and resource 'UniFi Network API operations', clearly distinguishing from siblings 'unifi-api' (which likely executes) and 'unifi-legacy-client-stats' (a different domain). It specifies three usage modes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains when to use each parameter (no args, tag, or path), implying this is for exploration. It does not explicitly contrast with alternative tools, but the context makes the purpose clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Get client bandwidth statistics from the legacy UniFi controller API. Returns per-client tx_bytes, rx_bytes, tx_rate, rx_rate for all active clients. Uses the old controller API endpoint (/proxy/network/api/s/{site}/stat/sta) which is not in the Integration API OpenAPI spec. This is the only way to get per-client bandwidth data on UniFi OS devices.
| Name | Required | Description | Default |
|---|---|---|---|
| site | No | Site name (e.g. 'default'). Use site ID UUID for other sites. | default |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint and openWorldHint. Description adds that it uses the legacy API endpoint and returns specific stats, but does not mention auth needs, rate limits, or performance implications.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences with no waste; front-loaded with main action, followed by data fields and context.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only tool with one optional parameter and no output schema, the description covers purpose, data returned, and uniqueness. Could note permissions or data freshness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema has 100% coverage for the single parameter 'site', and the description does not add additional semantic meaning beyond what the schema already provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states 'Get client bandwidth statistics' with specific data fields and distinguishes from siblings as the 'only way to get per-client bandwidth data on UniFi OS devices'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides clear context on when to use (need per-client bandwidth) and why it's unique (legacy endpoint, not in Integration API OpenAPI spec), but does not explicitly state when not to use or direct alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
v1.1.0unifi-apiunifi-api-schemaunifi-legacy-client-statsScored across 3 tools
Each tool has a distinct purpose: unifi-api executes generic API operations, unifi-api-schema discovers available operations, and unifi-legacy-client-stats fetches specific legacy data not covered by the generic tool. No overlap in functionality.
All tool names follow a consistent pattern: prefix 'unifi-', snake_case, with descriptive suffixes ('api', 'api-schema', 'legacy-client-stats'). No mixing of conventions.
With only 3 tools, the server is minimal. While the generic tool can theoretically execute many operations, the count is on the low end of what is typical for a well-scoped server (3-15 tools).
The generic tool covers most API operations, and the schema tool aids discovery. The legacy tool addresses a specific gap (per-client bandwidth data not in the OpenAPI spec). Minor gaps may exist, but the surface is largely complete.
MCP server for AI agents to plan, verify, and deploy Cloudflare-native apps.
Self-hosted MCP gateway: turn any API, database or MCP server into AI connectors — no code.
MCP server for secureFlows: token-free URL builders and integration-linting tools for AI agents.
Zero-setup MCP gateway securely connecting AI to your tools with authentication and workflows