Provides read-only access to Ubiquiti UniFi network data, including connected clients, device health, WiFi SSIDs, networks/VLANs, and ISP/WAN status through Ubiquiti's cloud API.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@mcp-ubiquiti who is currently connected to my network and how's the WAN looking?"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
A remote MCP connector that lets Claude observe your UniFi network — who's connected, device health, throughput, and ISP/WAN status — through Ubiquiti's own cloud API.
There is no local proxy, tunnel, or always-on box in your house. The
connector runs as a Cloudflare Worker and talks to api.ui.com, which relays
to your console over the link it already maintains. Works behind CGNAT.
Claude ──OAuth──▶ Cloudflare Worker ──X-API-KEY──▶ api.ui.com ──▶ your UniFi console
(via Cloudflare Access) (this repo) (Ubiquiti cloud)Mostly observation. The writes are deliberately narrow: rename_client sets a
display label, and the traffic-rule tools manage scheduled block rules (for
example, keeping a child's console offline during school hours):
Tool | What it returns |
| Device/client counts, ISP, WAN uptime, tx-retry |
| Connected clients: IP, MAC, VLAN, SSID, live throughput, plus (wifi) which AP they're on, signal in dBm, SNR, band, channel, and the negotiated PHY (Wi-Fi generation, channel width, spatial streams, link rate) |
| Gateways/switches/APs: online state, model, firmware, client count |
| Configured SSIDs, security mode, VLAN mapping (no passphrases) |
| Networks/VLANs and their VLAN IDs |
| Traffic over time for a client, or a ranked list of the busiest. 5-min buckets ~1 day, hourly ~1 week, daily ~30 days |
| Association history: when clients joined and left, which AP, duration, and roam count |
| (write) Sets a client's display name, by MAC. Returns the previous name so the change can be reversed. |
| Traffic rules: what each blocks, who it applies to (by client and network name), when it runs, and whether it's on |
| (write) Creates or edits a rule that blocks the whole internet, DPI app categories (e.g. |
| (write) Deletes a rule and returns it in full so it can be recreated |
| A child's screen-time rules right now: blocking or not, schedule, any active pause and when it ends |
| (write) Pause the rules for N minutes or until HH:MM; they come back by themselves |
| (write) End a pause early |
| (write) Cut whatever is open right now without changing schedules |
| Today per device: first online, time online, download, traffic kinds, timeline |
The archie_* tools talk to a policy engine running at home
(archie-control) through a Cloudflare
Tunnel and Access service token; they appear only when the HOME_* secrets are set.
Related MCP server: UniFi MCP Server
Access is bound to one identity. Login is delegated to Cloudflare Access,
whose policies perform the real identity check. The Worker then rejects any
authenticated email that isn't ALLOWED_EMAIL, so nobody else can complete
the flow even with the URL.
All secrets live as encrypted Cloudflare secrets, never in the repo. The
.gitignore also blocks .dev.vars and any *.rtf key-scratch files.
The UniFi key never reaches Claude — it stays server-side in the Worker.
Writes are narrow. rename_client sets a display label; the traffic-rule
tools manage block rules and nothing else. There is no code path to SSID,
VLAN, firewall-zone or DHCP settings. Write tools carry MCP annotations
(readOnlyHint: false, and destructiveHint on delete) so clients can ask
before running them.
A UniFi console (firmware ≥ 5.0.3) adopted into Site Manager.
A Cloudflare account (free tier is fine).
Cloudflare Zero Trust (Access) enabled on that account, with at least one identity provider configured.
git clone https://github.com/<you>/mcp-ubiquiti.git
cd mcp-ubiquiti
npm installAt unifi.ui.com → Settings → API Keys → Create New API Key. Give it Site Manager + Network scope. Copy the key (shown once).
Find your console's host id (you'll set it as a secret in step 5):
curl -s -H "X-API-KEY: <your-key>" https://api.ui.com/v1/hosts | jq '.data[].id'Login is delegated to Cloudflare Access, so it uses whichever identity providers you've already configured there (Google, Entra, one-time PIN) — there is no third-party developer console to set up.
In Cloudflare Zero Trust → Access →
Applications → Add an application → SaaS, choose OIDC and set the
redirect URL to your Worker's callback (printed during wrangler deploy, of
the form https://mcp-ubiquiti.<subdomain>.workers.dev/callback).
Note the client ID, client secret, and your team domain
(your-team.cloudflareaccess.com). Add an Access policy restricting the app to
the identity you want. ALLOWED_EMAIL (step 5) is then a second, local check
so the connector stays bound to one person even if the policy is later widened.
npx wrangler kv namespace create OAUTH_KVPaste the returned id into wrangler.jsonc under kv_namespaces[0].id.
npx wrangler secret put UNIFI_API_KEY # the Site Manager API key
npx wrangler secret put UNIFI_HOST_ID # console id from step 2
npx wrangler secret put ALLOWED_EMAIL # the one identity allowed in
npx wrangler secret put ACCESS_TEAM_DOMAIN # your-team.cloudflareaccess.com
npx wrangler secret put ACCESS_CLIENT_ID
npx wrangler secret put ACCESS_CLIENT_SECRETnpm run deployIn Claude → Settings → Connectors → Add custom connector, paste your
Worker URL (https://mcp-ubiquiti.<subdomain>.workers.dev/mcp). Claude will
walk you through the Cloudflare Access login; only ALLOWED_EMAIL succeeds.
cp .dev.vars.example .dev.vars # fill in real values (gitignored)
npm run devAdmin change events (stat/event is not relayed by the cloud proxy; it
404s on both GET and POST, so connect/disconnect is served from
client_sessions instead).
WAN latency trends over time.
Further write tools (SSID, firewall zones) behind an explicit confirmation flag.
MIT
This server cannot be deployed
Connect Claude to your Platform7n workspaces — chat, links, and tasks. One-click OAuth.
WHOOP recovery, strain, sleep and workouts in Claude via official WHOOP OAuth. Free, open source.
GA4, Google Ads and Search Console in Claude. Read-only OAuth, multi-account for agencies.
Manage your IoT device fleet directly from Claude. Create device templates with datastreams and events, provision new devices, read live sensor data, and control outputs. The Blynk connector integrates with the Blynk IoT platform, enabling direct configuration and monitoring of connected devices and infrastructure.
