A
licenseA
qualityD
maintenanceA Model Context Protocol server that enables AI assistants to read and safely modify TP-Link Omada networks through capability-gated tools, with a default read-only profile and dry-run writes for security.
11
1
MIT
safe-omada-mcp
by gaspareduard
Provides tools for managing TP-Link Omada network infrastructure, including sites, clients, devices, and configuration settings via the Omada Open API.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@safe-omada-mcp show me all access points on my network"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Safe Omada MCP
Security-focused MCP server for TP-Link Omada Open API workflows.
At a Glance
Production-safe baseline uses
stdioOmada credentials are environment-only
Capability profiles and category gating control what tools are exposed
HTTP remains in the codebase only as an explicitly unsafe, lab-only path
Uses documented Open API routes; controller/device validation is operation-specific (see support matrix)
Related MCP server: unifi-mcp
0.19 release candidate
This branch prepares 0.19.0-rc.1. Write previews, compact discovery, diagnostics and reliability changes are described in the migration guide. Stable write-tool release awaits disposable-controller and hardware validation; latest remains the existing stable version.
Quick Start
Option 1: Use with Claude Desktop via Docker
Pull or build an image:
docker pull ghcr.io/gaspareduard/omada-mcp:latestIf you do not publish an image yet, build locally instead:
npm run docker:buildEdit your Claude Desktop MCP config:
macOS:
~/Library/Application Support/Claude/claude_desktop_config.jsonWindows:
%APPDATA%\Claude\claude_desktop_config.json
Add the server entry:
{ "mcpServers": { "safe-omada": { "command": "docker", "args": [ "run", "-i", "--rm", "-e", "OMADA_BASE_URL=https://your-omada-controller.local", "-e", "OMADA_CLIENT_ID=your-client-id", "-e", "OMADA_CLIENT_SECRET=your-client-secret", "-e", "OMADA_OMADAC_ID=your-omadac-id", "-e", "OMADA_SITE_ID=your-site-id", "-e", "OMADA_STRICT_SSL=true", "ghcr.io/gaspareduard/omada-mcp:latest" ] } } }Restart Claude Desktop and verify the server by listing sites or devices.
Option 2: Run the container directly
docker run --rm -it \
--env-file .env \
ghcr.io/gaspareduard/omada-mcp:latestOption 3: Run locally for development
npm install
npm run build
npm startConfiguration
The server reads configuration from environment variables. See .env.example for the complete reference.
Required Omada Variables
Variable | Required | Default | Description |
| Yes | - | Base URL of the Omada controller |
| Yes | - | OAuth client ID from Omada Platform Integration |
| Yes | - | OAuth client secret |
| Yes | - | Omada controller ID ( |
| No | - | Optional default site ID. When omitted and no tool-level site ID is supplied, a single available site is selected automatically; zero or multiple sites return an error. |
| No |
| Enforce TLS certificate validation |
| No | - | PEM private CA bundle path; retains hostname verification. Mount the file read-only in Docker. |
| No |
| HTTP timeout in milliseconds |
Capability and Logging
Variable | Required | Default | Description |
| No |
| Built-in profile: |
| No | profile default | Explicit category override; recovery requires |
| No |
|
|
| No |
| Include deprecated aliases |
| No |
| Expose only bounded |
| No |
|
|
| No |
|
|
Capability Profiles
Profile | Intended use |
| Default read-only operational visibility |
| Client operations and maintenance writes, excluding recovery |
| All implemented categories except recovery |
| Deprecated alias for |
OMADA_TOOL_CATEGORIES replaces profile defaults. Restore tools require explicit recovery:rw; neither admin, compatibility, nor all:rw grants recovery.
Mutation previews and recovery
Writes default to dryRun: true. Review the preview and explicitly pass dryRun: false to apply. submitted means the controller accepted a request; only verified indicates a matching readback. See the 0.19 migration guide for verification limits and partial outcomes.
Restore tools also require confirmDangerous: true. This is an argument check, not enforced human approval or a stateful second-call protocol. Configure approvals in the MCP host and grant recovery:rw only when recovery is intended.
Optional HTTP Lab Mode
HTTP is not part of the supported production baseline.
It only starts when both of these are set:
MCP_SERVER_USE_HTTP=trueMCP_UNSAFE_ENABLE_HTTP=true
Use it only for local lab/debug scenarios.
Variable | Required | Default | Description |
| No |
| Legacy lab-only switch |
| No |
| Explicit acknowledgement required |
| No |
| HTTP port |
| No |
| Loopback bind address only ( |
| No |
| MCP endpoint path |
| No |
| Enable health check |
| No |
| Health check path |
| No |
| Enable CORS |
| No |
| Allowed origins |
| No |
| Legacy placeholder; disabled in safe baseline |
| No | - | Legacy placeholder |
Development and Validation
Common Commands
Task | Command |
Run dev server |
|
Build |
|
Lint + type-check |
|
Unit tests |
|
Coverage gates |
|
Symlink integrity |
|
README/tool sync |
|
Tool/test mapping |
|
Inspector
Use the MCP Inspector when you want to test the built server interactively:
npm run inspector
npm run inspector:buildProject Notes
The safe baseline is
stdiofirst.HTTP remains a legacy, explicitly unsafe lab path.
The repo includes
docs/openapi/as the implementation reference for Omada endpoints.README tool tables below are kept in sync with the registered MCP tools.
Tools
0.19 workflows and discovery
Tool | Description |
| Composes dashboard, channel, interference and retry evidence with timestamps, missing sections and bounded review heuristics. Read-only. |
| Reads recent event, alert and audit pages plus log settings; distinguishes unavailable data from empty results and reports incomplete history. |
| Resolves a camera client and reads its detail/session evidence; reports missing data and network drilldowns without claiming to diagnose Frigate inference. |
| Previews or updates one supported AP band with advertised channel/width validation, preserved sibling settings and bounded readback verification. |
| Previews or updates SSID name, broadcast visibility, guest status or sharing policy while preserving required security fields. Broadcast visibility is not SSID enable/disable. |
| Previews or updates name, status, PoE, profile or override for 1–32 explicit ports. Checks existence, guards known LAG disruption and reports per-port verification/partial completion. |
| Searches only enabled operations by name, description or category. |
| Returns an enabled operation's exact argument schema and permission. |
| Reports version, effective catalog, profile and validation limits. |
| Compact mode only: invokes an enabled operation through its existing schema and handler. |
Each category below is collapsed by default. Click to expand and see the full tool list, split into read and write tools.
Site & Client
Site listing, client monitoring, and client-level operational controls (rate limits, block/unblock, reconnect).
Tool | Description |
| Lists all sites configured on the controller. |
| Get site capacity settings including maximum device and client counts. |
| Get detailed information about a site, including name, region, timezone, and configuration. |
| Get device account settings for a site. |
| Get NTP server status and configuration for a site. |
| Get the remember device setting for a site. |
| Get site specification including device limits and feature capabilities. |
| Get the URL associated with a site for OpenAPI access. |
| Get configuration settings for a site template. Requires |
| Get detailed information about a site template. Requires |
| List all site templates configured on the controller. |
| Lists active client devices for a site. |
| [DEPRECATED] Use |
| Gets the most active clients sorted by traffic usage. |
| Gets client activity statistics over time. |
| Gets past connection history for clients. |
Tool | Description |
| Sets custom bandwidth limits (download/upload) for a specific client. |
| Applies a predefined rate limit profile to a specific client. |
| Disables bandwidth rate limiting for a specific client. |
| Blocks a client from network access with an auditable mutation summary. |
| Restores a blocked client to network access with an auditable mutation summary. |
| Forces a client to reconnect with an auditable mutation summary. |
Tool | Description |
| Reboots a managed device with an auditable mutation summary. |
| Changes a device LED state with an auditable mutation summary. |
Device
Device inventory, per-device detail (switches, gateways, APs), firmware, cable tests, and device configuration.
Tool | Description |
| Lists provisioned devices for a given site. |
| [DEPRECATED] Use |
| Searches for devices globally across all sites the user has access to. |
| Queries statistics for global adopted devices with pagination and filtering. |
| Retrieves detailed configuration and status for a switch stack. |
| Fetches detailed configuration and status for a specific switch. |
| Fetches detailed configuration and status for a specific gateway. |
| Gets WAN port status for a specific gateway. |
| Gets LAN port status for a specific gateway. |
| Gets port information for a specific gateway. |
| Fetches detailed configuration and status for a specific access point. |
| Gets radio information for a specific access point. |
| Gets port information for a switch stack. |
| Lists devices pending adoption in a site. |
| Gets all devices in a site including offline and disconnected devices. |
| Gets the latest available firmware info for a device. Use |
| Gets the auto-check firmware upgrade plan list (paginated). |
| Lists VLAN network assignments for a switch (paginated). Requires |
| Gets general configuration for a switch. Requires |
| Gets cable test history for a switch. Requires |
| Gets full per-port cable diagnostics for a switch. Requires |
| Gets Link Aggregation Group (LAG) list for a switch stack. Requires |
| Gets VLAN network list for a switch stack (paginated). Requires |
| Gets uplink configuration for an AP (wired/mesh mode). Requires |
| Gets per-radio configuration for an AP (channel, power, width). Requires |
| Get VLAN configuration for an access point, including management VLAN and per-SSID VLAN tagging settings. |
| Gets mesh link statistics for an AP. Requires |
| Gets last RF scan results for an AP. Requires |
| Gets last speed test results for an AP. Requires |
| Gets SNMP configuration for an AP. Requires |
| Gets LLDP configuration for an AP. Requires |
| Gets general configuration for an AP (name, LED, country). Requires |
| Get wired uplink detail for an access point: uplink switch, port number, link speed, and PoE status. |
| Gets wired downlink devices on an AP's LAN ports. Requires |
| Get the firmware upgrade plan list for devices managed by the controller. |
| Get firmware upgrade logs showing the history of upgrade operations performed on devices. |
| Get the list of device tags defined in a site. |
| Get QoS configuration for a specific access point. Requires |
| Get IPv6 configuration for a specific access point. Requires |
| Get IP settings for an AP. Requires |
| Get channel limit configuration for an AP. Requires |
| Get list of available channels for an AP. Requires |
| Get load balance configuration for an AP. Requires |
| Get OFDMA configuration for an AP. Requires |
| Get power saving configuration for an AP. Requires |
| Get trunk port setting for an AP. Requires |
| Get bridge configuration for an AP. Requires |
| List ports for an AP. Requires |
| Get ES switch details. Requires |
| Get ES switch general configuration. Requires |
| List cable test port info for a switch. Requires |
| Get incremental cable test results for a switch. Requires |
| Get the number of critical models available for upgrade. |
| Get the current status of the try-beta firmware upgrade switch. |
| List available firmware packages for upgrade (paginated). |
| List firmware overview for upgradeable devices (paginated). |
| List switch stacks in a site (paginated). |
| Get the device adoption whitelist for a site (paginated). |
| Get general configuration for a gateway. Requires |
| Get PIN information for a gateway. Requires |
| Get SIM card usage info for a gateway. Requires |
| Get gateway WAN health details. Requires |
Tool | Description |
| Updates AP power saving configuration with support checks and dry-run preview. Requires |
| Updates AP channel-limit configuration with support checks and dry-run preview. Requires |
| Updates documented AP configuration families with dry-run preview. Covers AP general, IP, IPv6, QoS, radio, service, load-balance, OFDMA, trunk, bridge, WLAN group, port, channel, AFC, and antenna settings. Setter-only families return planned payloads and an explicit warning when controller readback is unavailable. Requires |
| Updates documented gateway configuration families with dry-run preview. Covers general, services, advanced, radios, WLAN, and port settings. Setter-only families return planned payloads and an explicit warning when controller readback is unavailable. Requires |
Network
WAN/LAN configuration, SSIDs, WLAN groups, routing, NAT, DHCP, DNS, firewall settings, bandwidth control, and related network services.
Tool | Description |
| Gets internet configuration information for a site. |
| [DEPRECATED] Use |
| Gets WAN port summary/basic info for the site gateway. |
| Gets WAN load balancing configuration (failover/load balance). |
| Gets per-port WAN configuration including connection type and IP settings. |
| Gets WAN-LAN connectivity status for a site. |
| Gets virtual WAN list (paginated). |
| Gets ISP band scan results for a WAN port. Requires |
| Gets the list of wired networks with NAT disabled (paginated). |
| Gets LTE/cellular WAN port configuration. |
| [DEPRECATED] Use |
| Gets ISP scan profile result for a WAN port. Requires |
| Gets QoS configuration for gateway WAN ports. |
| [DEPRECATED] Alias for the WAN health tool; kept for backward compatibility. Requires |
| [DEPRECATED] Use |
| Gets one-to-one NAT rules (paginated). |
| Gets port forwarding status and rules. Required: |
| [DEPRECATED] Use |
| Get the LAN network list using the v2 API, with richer VLAN and DHCP data (paginated). |
| Gets interface-level LAN network bindings. Optional type filter (0=WAN, 1=LAN). |
| Get interface-level LAN network bindings (v2 API). Returns richer per-interface VLAN and network data. |
| Gets the list of LAN profiles configured in a site. |
| [DEPRECATED] Use |
| [DEPRECATED] Use |
| Get multicast rate limit settings for a site. |
| Gets the list of WLAN groups configured in a site. |
| Gets the list of SSIDs in a WLAN group. |
| Gets detailed information for a specific SSID. Required: |
| Lists wireless SSIDs across all WLAN groups. |
| Gets the site-global firewall settings returned by the official Omada firewall endpoint. |
| Gets VPN settings for a site. |
| Lists site-to-site VPN configurations. |
| [DEPRECATED] Use |
| Lists gateway (OSG) ACL rules. |
| Lists access point (EAP) ACL rules. |
| [DEPRECATED] Use |
| Gets available interfaces for static routing. |
| [DEPRECATED] Use |
| Gets policy routing rules (paginated). |
| Gets OSPF process configuration for the site gateway. |
| Gets OSPF interface configuration for the site gateway. |
| Gets VRRP configuration for OSW devices. |
| Gets OSPF neighbor devices for the site gateway. |
| Gets 1:1 NAT rules (paginated). |
| Gets ALG (Application Layer Gateway) configuration. |
| Gets UPnP setting for the site gateway. |
| Gets DDNS entries (paginated). |
| Gets DHCP reservations (paginated). |
| Gets IP-MAC binding entries (paginated). |
| Gets IP-MAC binding global toggle setting. |
| Gets global bandwidth control configuration. |
| Gets bandwidth control rules (paginated). |
| Gets session limit global setting. |
| Gets per-rule session limit rules (paginated). |
| Gets SNMP configuration (version, community string). |
| Gets LLDP global setting. |
| Gets remote logging (syslog) configuration. |
| Gets the DNS cache data list (paginated). |
| Gets IPTV service configuration for the site. |
| Gets NTP server configuration and synchronisation status. |
| Deprecated; alias of |
| Gets controller access control configuration. |
| Gets DNS cache setting. |
| Gets DNS proxy configuration. |
| Gets IGMP snooping and proxy setting. |
| Gets VLAN interface configuration for a specific switch. Requires |
| Gets LAN DNS rules for the site (paginated). |
| Gets EAP/switch device usage for a LAN profile. Requires |
| Gets client distribution breakdown across LAN segments. |
| Lists RADIUS authentication profiles. |
| Lists group profiles (IP, MAC, or port groups). |
| Gets application control status for a site. |
| Gets SSH settings for a site. |
| Lists time range profiles. |
| Gets the list of available rate limit profiles for bandwidth control. |
Tool | Description |
| Updates site firewall settings with dry-run preview using the official Omada Open API firewall endpoint. |
| Updates the gateway ACL mode ( |
| Creates a gateway ACL rule with dry-run preview using the official Omada Gateway ACL schema. |
| Updates a gateway ACL rule with dry-run preview after confirming the ACL exists. |
| Creates an EAP ACL rule with dry-run preview using the official Omada EAP ACL schema. |
| Updates an EAP ACL rule with dry-run preview after confirming the ACL exists. |
| Creates a switch (OSW) ACL rule with dry-run preview using the official Omada SwitchACLConfig schema. |
| Updates a switch (OSW) ACL rule with dry-run preview after confirming the ACL exists. |
| Deletes an ACL rule with dry-run preview after confirming the ACL exists. |
| Creates a DHCP reservation after validating the target LAN and optional IP address. |
| Updates a DHCP reservation after validating the target LAN and optional IP address. |
| Deletes a DHCP reservation by MAC address with a dry-run preview option. |
| Creates or updates a bandwidth control rule with dry-run preview after validating the target rule id plus referenced LAN and WAN identifiers. |
| Deletes a bandwidth control rule with dry-run preview after confirming the rule exists. |
| Updates portal access control settings with dry-run preview and schema validation for pre-auth and free-auth policy entries. |
| Creates or updates an application control rule with dry-run preview after validating the create/update payload shape, existing rule id, and referenced application ids. |
| Deletes an application control rule with dry-run preview after confirming the rule exists. |
Firewall & ACL
802.1X authentication and RADIUS proxy settings.
Tool | Description |
| Get 802.1X switch port authentication setting. Alias for |
| Get global RADIUS proxy configuration (controller-level, no siteId). |
| [DEPRECATED] Get application control rules. Alias for |
Firewall Traffic & QoS
Traffic shaping, QoS policies, application control, URL filtering, and MAC filtering.
Tool | Description |
| Get gateway QoS class rules (paginated). |
| Get bandwidth control details for a site. |
| Get application control rules (paginated). |
| Get application control category list. |
| Get URL filter gateway rules. Alias for |
| Get URL filter MAC deny list. Alias for |
| Get URL filter MAC allow list. Alias for |
| Get MAC filter general setting. Alias for |
| Get QoS policy configuration for a site. |
| Get traffic priority rules for a site. |
| [DEPRECATED] Use |
| [DEPRECATED] Alias for |
| [DEPRECATED] Alias for |
| [DEPRECATED] Alias for |
Firewall IDS / IPS
Intrusion detection and prevention system configuration.
Tool | Description |
| [DEPRECATED] Use |
Security & Threat Management
Global threat intelligence, IPS alerts, and top-threat summaries.
Tool | Description |
| Gets global threat management list. Required: |
| Gets top threats from the global threat management view. |
Composite Troubleshooting Tools
Single-call tools that internally aggregate multiple Omada API calls in parallel. Use these instead of chaining individual tools when you need a quick overview or are starting a troubleshooting session.
Tool | Description |
| Composite: combines dashboard overview (device/client counts), internet/WAN status, client distribution, and recent active threats into a single response. First call for any troubleshooting session. |
| Composite: auto-discovers the gateway then fetches its detail (CPU, memory, firmware), WAN port statuses, LAN interface statuses, and port list in one call. Use for internet/WAN diagnostics. |
| Composite: given a client MAC, IP, or hostname — fetches current connection status, detailed client info (VLAN, signal, policy), and recent connection history in one call. |
| Composite: combines active threat list (up to 20, newest first) and firewall settings into one response. Use for security posture checks or investigating alerts. |
Dashboard / Monitor
Site dashboard widgets: WiFi and switch summaries, PoE usage, CPU/memory top-N, traffic activities, VPN tunnel stats, and RF analytics.
Tool | Description |
| Gets WiFi summary from the site dashboard. |
| Gets switch summary from the site dashboard. |
| Gets traffic activity data from the site dashboard. |
| Gets PoE usage data from the site dashboard. |
| Gets top CPU usage data from the site dashboard. |
| Gets top memory usage data from the site dashboard. |
| Gets most active switches from the site dashboard. |
| Gets most active access points from the site dashboard. |
| Get the site overview: device counts, client counts, connectivity graph, and overall health status. |
| Gets traffic distribution by protocol/app type over a time range. Requires |
| Gets wireless retry rate and dropped packet rate over a time range. Requires |
| Gets per-WAN ISP link load over a time range. Requires |
| Gets channel distribution and utilization across all APs. |
| Gets top RF interference sources detected by APs. |
| Gets VPN tunnel statistics. Required: |
| Gets IPsec tunnel statistics. |
| Gets OpenVPN tunnel statistics by type. Requires |
Insight
Site-level security insights: threat events, WIDS, rogue AP detection, and VPN tunnel stats.
Tool | Description |
| Lists site-level threat management events. |
| Gets WIDS (Wireless Intrusion Detection) information for a site. |
| Gets rogue access points detected in a site. |
| Gets VPN tunnel statistics for a site. |
VPN
Site-to-site and client-to-site VPN configuration, tunnel details, and user management.
Tool | Description |
| List all site-to-site VPN (IPsec) tunnels. Alias for |
| Get detailed config for a specific IPsec tunnel by ID. Alias for |
| Get advanced VPN configuration settings for a site. Alias for |
| Get VPN users for a site (paginated). |
| Get users for a specific client-to-site VPN server. |
| Get status of client-to-site VPN clients. Alias for |
| [DEPRECATED] Use |
Profiles
RADIUS, PPSK, service, QoS, schedule, group policy, VLAN, user role, and portal profiles.
Tool | Description |
| Get Google LDAP profile configuration for a site. |
| Get built-in RADIUS server user list (paginated). |
| [DEPRECATED] Alias for |
| List PPSK network profiles for a site by type. |
| Get PPSK user group details for a specific profile. |
| [DEPRECATED] Alias for |
| Get service type profiles (paginated). Alias for |
| Get rate limit profiles. Alias for |
| Get time range profiles. Alias for |
| Get group policy profiles filtered by group type. |
| [DEPRECATED] Get IP group profiles. Alias for |
| [DEPRECATED] Get URL/port group profiles. Alias for |
| [DEPRECATED] Get MAC group profiles. Alias for |
| Get LAN/VLAN profiles. Alias for |
| Get user role profiles from the controller (global, no siteId). |
| Get captive portal profiles for a site. |
Logs
Site-level and global event, alert, and audit logs.
Tool | Description |
| Lists site event logs. |
| Lists site alert logs. |
| Lists site audit logs. |
| Lists global event logs across all sites. |
| Lists global alert logs across all sites. |
Controller
Controller-level settings: certificates, ports, data retention, telemetry, and global dashboard.
Tool | Description |
| Get SSL/TLS certificate configuration for the controller. |
| Get the client history data collection enable setting. |
| Get the controller port configuration for device adoption. |
| Get data retention settings for the controller. |
| Get the experience improvement program setting (telemetry). |
| Get global controller dashboard overview without client data. |
| Get portal port configuration for the controller web interface. |
Maintenance
Controller and site backups, restores, and rogue AP exports.
Tool | Description |
| List available controller backup files. |
| Get the result of the most recent controller backup operation. |
| Get the result of the most recent controller restore operation. |
| List available backup files for a site. |
| Get the backup result for a site. |
| Export Rogue AP scan results for a site in CSV or Excel format. |
Tool | Description |
| Trigger a controller configuration backup to the self/cloud server. |
| Trigger a controller configuration backup to an external file server (FTP/SFTP). |
| Restore controller configuration from a backup file on the self/cloud server. |
| Restore controller configuration from a backup file on an external file server. |
| Trigger a multi-site configuration backup to the self/cloud server (up to 300 sites). |
| Trigger a multi-site configuration backup to an external file server (up to 300 sites). |
| Restore multiple site configurations from backup files on the self/cloud server. |
| Restore multiple site configurations from backup files on an external file server. |
Account Users
User and role management for the controller.
Tool | Description |
| List all cloud users on the controller, excluding the root account. |
| List all local users on the controller, excluding the root account. |
| [DEPRECATED] Use |
| List all users (cloud and local) in grid view. |
| List roles available for user assignment. |
| Get detailed information about a specific role. Requires |
Account Cloud
Cloud access, MFA, and remote binding status.
Tool | Description |
| Get cloud access status for the controller. |
| Get cloud user account information. |
| Get global MFA (multi-factor authentication) status. |
| Get remote binding status between controller and cloud. |
Schedules
PoE, port, reboot, and firmware upgrade schedules.
Tool | Description |
| List PoE schedules for a site. |
| List port schedules for a site. |
| List ports with port schedule assignments for a site. |
| List device reboot schedules for a site template. Requires |
| List firmware upgrade schedules for a site. |
Operation ID | Description | Tool |
| List controller sites. |
|
| List devices assigned to a site. |
|
| Search for devices across all accessible sites. |
|
| Query statistics for global adopted devices. |
|
| Retrieve details for a switch stack. |
|
| Get detailed info for a specific switch. |
|
| Get detailed info for a specific gateway. |
|
| Get WAN port status for a specific gateway. |
|
| Get LAN port status for a specific gateway. |
|
| Get port info for a specific gateway. |
|
| Get detailed info for a specific access point. |
|
| Get radio info for a specific access point. |
|
| Get port info for a switch stack. |
|
| List devices pending adoption in a site. |
|
| List active clients connected to a site. |
|
| Get most active clients sorted by traffic. |
|
| Get client activity statistics over time. |
|
| Get client past connection history. |
|
| Set rate limit setting for a client. |
|
| Get rate limit profile list. |
|
| Get global view threat management list. |
|
| Get top threats from global threat management. |
|
| [DEPRECATED] Use |
|
| Get port forwarding status by type. |
|
| Get LAN profile list. |
|
| Get WLAN group list. |
|
| Get SSID list for a WLAN group. |
|
| Get detailed SSID configuration. |
|
| List SSIDs across all WLAN groups. |
|
| Get the site-global firewall settings returned by the official Omada firewall endpoint. |
|
| Update site firewall settings with dry-run support. |
|
| Get VPN settings for a site. |
|
| List site-to-site VPN configurations. |
|
| List NAT port forwarding rules. |
|
| List gateway ACL rules. |
|
| Get gateway ACL config mode for the site gateway. |
|
| Update gateway ACL config mode with dry-run support. |
|
| Create a gateway ACL with dry-run support. |
|
| Update a gateway ACL with dry-run support. |
|
| List access point ACL rules. |
|
| Create an EAP ACL with dry-run support. |
|
| Update an EAP ACL with dry-run support. |
|
| List switch ACL rules. |
|
| Create a switch ACL with dry-run support. |
|
| Update a switch ACL with dry-run support. |
|
| Delete an ACL rule with dry-run support. |
|
| List static routing rules. |
|
| List RADIUS authentication profiles. |
|
| List group profiles (IP, MAC, port groups). |
|
| Get application control status for a site. |
|
| Create an application control rule with dry-run support. |
|
| Update an application control rule with dry-run support. |
|
| Delete an application control rule with dry-run support. |
|
| Get SSH settings for a site. |
|
| List time range profiles. |
|
| Get WAN-LAN connectivity status for a site. |
|
| List site-level threat management events. |
|
| Get WIDS information for a site. |
|
| Get rogue access points detected in a site. |
|
| Get VPN tunnel statistics for a site. |
|
| List site event logs. |
|
| List site alert logs. |
|
| List site audit logs. |
|
| List global event logs across all sites. |
|
| List global alert logs across all sites. |
|
| Disable rate limiting for a specific client, removing any bandwidth.... |
|
| Get controller access control configuration. |
|
| Update portal access control configuration with dry-run support. |
|
| Get ALG (Application Layer Gateway) configuration for the site gateway. |
|
| Get all devices in a site including offline and disconnected devices. |
|
| Fetch full configuration and status for a specific access point: mo.... |
|
| Get general configuration for an access point. |
|
| Get LLDP (Link Layer Discovery Protocol) configuration for an acces.... |
|
| Get radio status for a specific access point: 2.4GHz and 5GHz band .... |
|
| Get SNMP configuration for an access point. |
|
| Get the uplink configuration for an access point. |
|
| Get the global bandwidth control configuration for the site. |
|
| Get cable test logs for a switch. |
|
| Get channel distribution and utilization across all APs. |
|
| [DEPRECATED] Use |
|
| Get PoE (Power over Ethernet) usage statistics for a site, showing .... |
|
| Get switch summary for a site dashboard: total switch count, total .... |
|
| Get the top devices by CPU usage for a site, useful for identifying.... |
|
| Get WiFi summary for a site dashboard: total APs, connected AP coun.... |
|
| Get DDNS (Dynamic DNS) entries for the site gateway. |
|
| [DEPRECATED] Use |
|
| Get DHCP reservations for the site. |
|
| Create a DHCP reservation for the site after LAN/IP validation and duplicate-IP preflight. |
|
| Update an existing DHCP reservation for the site. |
|
| Delete an existing DHCP reservation for the site. |
|
| Get DNS cache setting for the site gateway. |
|
| Get DNS proxy configuration for the site gateway. |
|
| Get the site-global firewall settings returned by the official Omada firewall endpoint. |
|
| Update site firewall settings with dry-run support. |
|
| Get the latest available firmware information for a device. |
|
| Fetch full configuration and status for a specific gateway: model, .... |
|
| Get LAN port status for a specific gateway: port link state, speed,.... |
|
| Get all WAN and LAN port details for a specific gateway: link statu.... |
|
| Get the WAN port status and connectivity information for a specific.... |
|
| Get bandwidth control rules for the site gateway. |
|
| Create a bandwidth control rule with dry-run support. |
|
| Update a bandwidth control rule with dry-run support. |
|
| Delete a bandwidth control rule with dry-run support. |
|
| Get IP-MAC binding entries for the site. |
|
| Get 1:1 NAT rules for the site gateway. |
|
| Get policy routing rules for the site gateway. |
|
| Get per-rule session limit rules for the site gateway. |
|
| Get virtual WAN list for the site gateway. |
|
| Get IGMP (Internet Group Management Protocol) setting for the site. |
|
| Get interface-level LAN network bindings. |
|
| Get top RF interference sources detected by APs. |
|
| [DEPRECATED] Use |
|
| Get WAN port summary / basic info for the site gateway. |
|
| Get internet configuration information for a site, including WAN se.... |
|
| Get WAN load balancing configuration for the site gateway. |
|
| Get ISP band scan results for a WAN port. Requires |
|
| Get per-WAN ISP link load over a time range. |
|
| Get client distribution breakdown across LAN segments (wired, wireless, guest). |
|
| Get LAN DNS rules configured for the site (paginated). |
|
| [DEPRECATED] Use |
|
| Get EAP/switch device usage for a specific LAN profile. Requires |
|
| Get the list of LAN profiles configured in a site. |
|
| Get LTE/cellular WAN port configuration for the site gateway. |
|
| Get LLDP (Link Layer Discovery Protocol) global setting for the site. |
|
| Get mesh link statistics for an access point. |
|
| Get Link Aggregation Group (LAG) list for a switch stack. |
|
| Get a paginated page of NAT port forwarding rules for the site gateway. |
|
| Get port forwarding status and rules for a site. |
|
| [DEPRECATED] Get the last RF scan results for an access point. |
|
| Get per-radio configuration for an access point. |
|
| Get the list of available rate limit profiles for a site. |
|
| Get remote logging (syslog) configuration for the site. |
|
| Get the DNS cache data list for the site (paginated). |
|
| Get the list of wired networks with NAT disabled (paginated). |
|
| Get IPTV service configuration for the site. |
|
| Get NTP server configuration and synchronisation status for the site. |
|
| Get OSPF interface configuration for the site gateway. |
|
| Get OSPF neighbor devices for the site gateway. |
|
| Get OSPF process configuration for the site gateway. |
|
| Get VLAN interface configuration for a specific switch. Requires |
|
| [DEPRECATED] Alias of |
|
| Get VRRP configuration for OSW devices on the site. |
|
| [DEPRECATED] Alias for the WAN health tool; kept for backward compatibility. Requires |
|
| Get ISP scan profile result for a WAN port. Requires |
|
| Get one-to-one NAT configuration (WAN NAT rules) for the site gateway (paginated). |
|
| [DEPRECATED] Use |
|
| Get QoS configuration for gateway WAN ports on the site. |
|
| [DEPRECATED] Use |
|
| Get wireless retry rate and dropped packet rate over a time range. |
|
| Get the list of rogue (unauthorized) access points detected by WIDS.... |
|
| Get the session limit global setting for the site gateway. |
|
| Get SNMP configuration for the site. |
|
| Get the last speed test results for an access point. |
|
| Get AP channel-limit configuration. |
|
| Update AP channel-limit configuration with dry-run support. |
|
| Update AP general configuration with dry-run support. |
|
| Update AP IP settings with dry-run support. |
|
| Update AP IPv6 settings with dry-run support. |
|
| Update AP QoS settings with dry-run support. |
|
| Update AP radio settings with dry-run support. |
|
| Update AP service settings with dry-run support. |
|
| Update AP load-balance settings with dry-run support. |
|
| Update AP OFDMA settings with dry-run support. |
|
| Get AP power saving configuration. |
|
| Update AP power saving configuration with dry-run support. |
|
| Update AP trunk settings with dry-run support. |
|
| Update AP bridge settings with dry-run support. |
|
| Update AP port settings with dry-run support. |
|
| Update AP channel configuration with dry-run support. |
|
| Update AP AFC configuration with dry-run support. |
|
| Update AP antenna gain settings with dry-run support. |
|
| Update AP WLAN group assignment with dry-run support. |
|
| Update gateway general configuration with dry-run support. |
|
| Update gateway config/general settings with dry-run support. |
|
| Update gateway services configuration with dry-run support. |
|
| Update gateway advanced settings with dry-run support. |
|
| Update gateway radio configuration with dry-run support. |
|
| Update gateway WLAN configuration with dry-run support. |
|
| Update a gateway port configuration with dry-run support. |
|
| Update multiple gateway ports with dry-run support. |
|
| Get SSH access settings for a site. |
|
| Get detailed information for a specific SSID (wireless network), in.... |
|
| Get the list of SSIDs (wireless networks) configured in a WLAN group. |
|
| Get the VLAN network list for a switch stack. |
|
| Get all port information for a switch stack. |
|
| Fetch full configuration and status for a specific switch: model, f.... |
|
| Fetch detailed information for a specific switch stack. |
|
| Get the global view threat management list. |
|
| Get the top threats from the global threat management view across a.... |
|
| Get traffic distribution by protocol and application type over a ti.... |
|
| Get UPnP (Universal Plug and Play) setting for the site. |
|
| Get VPN configuration settings for a site. |
|
| Get VPN tunnel statistics for a site (paginated), including active .... |
|
| Get the WAN and LAN connectivity status for a site. |
|
| Get WAN port settings for the site gateway. |
|
| Get Wireless Intrusion Detection System (WIDS) information for a si.... |
|
| Get the list of WLAN groups configured in a site. |
|
| List all wireless SSIDs across all WLAN groups in a site: SSID name.... |
|
| List all network clients (wired and wireless) connected to a site. |
|
| Get client activity statistics over time from the dashboard. |
|
| Get client past connection list with historical connection data. |
|
| List all provisioned (adopted) network devices in a site: gateways,.... |
|
| List EAP (access point) ACL rules for a site: wireless client acces.... |
|
| List alert logs across all sites on the controller: threshold breac.... |
|
| List system event logs across all sites on the controller. |
|
| List group profiles (IP groups, MAC groups, port groups) configured.... |
|
| Get the most active clients in a site, sorted by total traffic. |
|
| List gateway (OSG) ACL rules for a site: firewall rules controlling.... |
|
| List devices discovered on the network but not yet adopted into thi.... |
|
| [DEPRECATED] Use |
|
| [DEPRECATED] Use |
|
| List RADIUS authentication profiles configured for a site: server I.... |
|
| List alert logs for a site: threshold breaches, device failures, se.... |
|
| List admin audit logs for a site: who made what configuration chang.... |
|
| List system event logs for a site: device online/offline, client co.... |
|
| List site-level threat management events detected by IPS, with opti.... |
|
| List site-to-site VPN configurations: tunnel name, remote IP, statu.... |
|
| List all sites configured on the Omada controller. |
|
| [DEPRECATED] Use |
|
| List VLAN network assignments for a switch. |
|
| List time range profiles configured for a site. |
|
| Search for devices globally across all sites the user has access to. |
|
| Set custom rate limit (bandwidth control) for a specific client. |
|
| Get the ACL configuration type setting for the site gateway (L2 or .... |
|
| Get the DDoS and attack defense configuration, including flood prot.... |
|
| Get global audit log notification settings for the controller. |
|
| Get site-level audit log notification settings, including audit eve.... |
|
| Get global audit logs (paginated). |
|
| Get the band steering configuration. |
|
| [DEPRECATED] Use |
|
| Get the beacon control setting, which manages 802.11 beacon transmi.... |
|
| [DEPRECATED] Get the channel limit setting that restricts which cha.... |
|
| Get the client inactivity timeout setting. |
|
| Get full detail for a specific client by MAC address, including con.... |
|
| Get detailed configuration for a specific client-to-site VPN server.... |
|
| Get client count distribution by connection type and band (wired, 2.... |
|
| Get the Omada controller health and status, including running state.... |
|
| Get the device access management settings, controlling which device.... |
|
| Get the 802.1X EAP setting for access points, controlling port-base.... |
|
| Get the global general settings for the Omada controller, including.... |
|
| Get the IPS allow list (paginated). |
|
| Get the MAC address allow-list entries (paginated). |
|
| Get the IPS block list (paginated). |
|
| Get per-client connection history (paginated). |
|
| Get the MAC address deny-list entries (paginated). |
|
| Get the URL filter AP rules (paginated). |
|
| Get the URL filter gateway rules (paginated). |
|
| Get IPsec failover configuration (paginated). |
|
| Get historical known clients list (paginated). |
|
| Get the IPS signature list (paginated). |
|
| Get static routing rules for the site gateway with explicit pagination. |
|
| Get group profiles filtered by type (e.g. |
|
| Get the IPS (Intrusion Prevention System) global configuration, inc.... |
|
| Get IPsec VPN tunnel statistics for a site (paginated), including a.... |
|
| List all LDAP authentication profiles configured on the site. |
|
| Get global log notification settings (v1), including global alert r.... |
|
| Get global log notification settings (v2), with extended notificati.... |
|
| Get site-level log notification settings (v1), including alert reci.... |
|
| Get site-level log notification settings (v2), with extended notifi.... |
|
| Get the controller logging configuration, including log levels and .... |
|
| Get the MAC authentication global setting. |
|
| Get per-SSID MAC authentication settings showing which SSIDs have M.... |
|
| Get the MAC filtering global setting. |
|
| Get the mail server connection status for the controller. |
|
| Get the mesh networking configuration including mesh topology mode .... |
|
| Get the custom gateway ACL rules list (paginated). |
|
| Get the switch ACL list (paginated). |
|
| Get the OUI-based device profile list (paginated). |
|
| List Private PSK (PPSK) profiles for the site by type. |
|
| Get historical client count trend over a time range. |
|
| Get the RF planning configuration for the site, including frequency.... |
|
| Get the RF planning result for the site. |
|
| Get the global RADIUS server configuration for the controller. |
|
| List local RADIUS server users (paginated). |
|
| Get the global syslog/remote logging configuration, including syslo.... |
|
| Get the data retention configuration for the controller, including .... |
|
| Get the client roaming configuration, including 802.11r/k/v setting.... |
|
| Get the live routing table for a site filtered by type. |
|
| Get a summary of service type profiles for the site, including pred.... |
|
| Get detailed information about a specific site-to-site VPN by ID, i.... |
|
| Get a flat SSID list filtered by device type. |
|
| Get the SSL VPN server configuration, including port, protocol, and.... |
|
| Get the 802.1X switch port authentication setting. |
|
| Get the global threat count grouped by severity level (critical, hi.... |
|
| Get detailed information about a specific IPS threat event by its ID. |
|
| Get the UI interface settings for the controller, including timeout.... |
|
| Get the URL filter global setting, including whether URL filtering .... |
|
| Get the global webhook notification settings, including webhook URL.... |
|
| Get webhook dispatch logs (paginated). |
|
| Get the WIPS (Wireless Intrusion Prevention System) rogue AP blackl.... |
|
| Get a summary of WireGuard VPN configurations for the site, includi.... |
|
| List all client-to-site VPN client configurations on the site. |
|
| List all client-to-site VPN server configurations on the site, incl.... |
|
| Query statistics for global adopted devices with pagination and fil.... |
|
| List all Bonjour/mDNS service profiles configured on the site for c.... |
|
| List service type profiles (paginated). |
|
| List WireGuard VPN tunnels (paginated). |
|
| List WireGuard peers (paginated). |
|
| Get the most active access points from the site dashboard by traffic. |
|
| Get top memory usage data for devices from the site dashboard. |
|
| Get traffic activity data and throughput summary from the site dashboard. |
|
| Get VPN tunnel statistics for the grid dashboard view. |
|
| Apply a predefined rate limit profile to a specific client. |
|
| Get gateway QoS class rules (paginated). |
|
| Get bandwidth control details for a site. |
|
| Get application control rules (paginated). |
|
| Get application control category list. |
|
| Get QoS policy configuration for a site. |
|
| Get traffic priority rules for a site. |
|
| Get VPN users for a site (paginated). |
|
| Get users for a specific client-to-site VPN server by ID. |
|
| Get Google LDAP profile configuration for a site. |
|
| Get PPSK user group details for a specific profile ID. |
|
| Get captive portal profiles for a site. |
|
| Get user role profiles from the controller (global). |
|
| Get global RADIUS proxy configuration (controller-level). |
|
| Get site detail. |
|
| Get site URL. |
|
| Get NTP server status for a site. |
|
| Get site specification. |
|
| Get site remember device setting. |
|
| Get site device account setting. |
|
| Get site capacity setting. |
|
| List site templates. |
|
| Get site template detail. |
|
| Get site template configuration. |
|
| Get data retention settings. |
|
| Get controller port setting. |
|
| Get portal port setting. |
|
| Get certificate configuration. |
|
| Get experience improvement setting. |
|
| Get global dashboard overview without client data. |
|
| Get client history data enable setting. |
|
| List controller backup files. |
|
| Get controller backup result. |
|
| Get controller restore result. |
|
| Get site backup result. |
|
| List site backup files. |
|
| List all cloud users excluding root. |
|
| List all local users excluding root. |
|
| [DEPRECATED] Use |
|
| Get role detail. |
|
| List available roles. |
|
| List all users in app grid view. |
|
| Get cloud access status. |
|
| Get cloud user info. |
|
| Get global MFA status. |
|
| Get remote binding status. |
|
| List upgrade schedules for a site. |
|
| List reboot schedules for a site template. |
|
| List PoE schedules for a site. |
|
| List port schedules for a site. |
|
| List ports with port schedules. |
|
| Get multicast rate limit setting. |
|
| Get AP load balance configuration. |
|
| [DEPRECATED] Use |
|
Devcontainer support
The repository includes a ready-to-use devcontainer configuration with a dedicated Omada controller sidecar for local development and testing. See .devcontainer/README.md for details.
License
This project is licensed under the MIT License.
Available Tools
117 toolsdiagnoseClientA
Composite client diagnostic — single call that combines a client's current connection status, detailed info (VLAN, signal, rate limit, group policy), and recent connection history (last 10 sessions). Use when troubleshooting why a device can't connect, has poor performance, or keeps disconnecting. Accepts MAC address, IP address, or hostname.
Inputs: identifier (required), siteId, customHeaders.
getAclConfigTypeSettingC
Get the ACL configuration type setting for the site gateway (L2 or L3 mode). Determines how ACL rules are evaluated for traffic.
Inputs: siteId, customHeaders.
getAllDeviceBySiteA
Get all devices in a site including offline and disconnected devices. Unlike listDevices which may filter to active-only, this returns the full device inventory. Useful for auditing what hardware is registered to a site.
Inputs: siteId, customHeaders.
getApDetailA
Fetch full configuration and status for a specific access point: model, firmware, CPU/memory, connected clients count, SSIDs, uptime, and mesh status. Use listDevices to get the apMac.
Inputs: apMac (required), siteId, customHeaders.
getApGeneralConfigA
Get general configuration for an access point. Returns device name, LED settings, country/region, management VLAN, bandwidth limits, and other global AP parameters. Use getApDetail for runtime status; this returns stored configuration.
Inputs: apMac (required), siteId, customHeaders.
getApIpv6ConfigB
Get IPv6 configuration for a specific access point.
Inputs: apMac (required), siteId, customHeaders.
getApLldpConfigB
Get LLDP (Link Layer Discovery Protocol) configuration for an access point. Returns enabled state and advertised TLVs. LLDP allows network devices to advertise identity and capabilities to neighbours.
Inputs: apMac (required), siteId, customHeaders.
getAppControlCategoriesA
Get application control categories (families) for a site, listing available app category definitions used in application control rules.
Inputs: siteId, customHeaders.
getAppControlRulesB
Get application control rules for a site, listing application-level firewall rules that allow or block specific apps or app categories.
Inputs: page, siteId, pageSize, customHeaders.
getApplicationAclA
[DEPRECATED] Get application control rules for a site. This is an alias for getAppControlRules — use getAppControlRules instead.
Inputs: page, siteId, pageSize, customHeaders.
getApplicationControlStatusC
Get application control (DPI) status and configuration for a site.
Inputs: siteId, customHeaders.
getApQosConfigA
Get QoS configuration for a specific access point.
Inputs: apMac (required), siteId, customHeaders.
getApRadiosA
Get radio status for a specific access point: 2.4GHz and 5GHz band config, channel, TX power, channel utilization, and associated client count per radio. Use listDevices to get the apMac.
Inputs: apMac (required), siteId, customHeaders.
getApSnmpConfigA
Get SNMP configuration for an access point. Returns SNMP version, community strings, trap settings, and enabled state. Useful for auditing SNMP-based monitoring configurations on wireless infrastructure.
Inputs: apMac (required), siteId, customHeaders.
getApUplinkConfigA
Get the uplink configuration for an access point. Returns uplink mode (wired/wireless mesh), preferred uplink settings, and failover configuration. Useful for understanding mesh topology and wired uplink assignments.
Inputs: apMac (required), siteId, customHeaders.
getApVlanConfigA
Get VLAN configuration for an access point. Returns the AP's management VLAN and per-SSID VLAN tagging settings. Useful for verifying network segmentation on wireless infrastructure.
Inputs: apMac (required), siteId, customHeaders.
getAttackDefenseSettingB
Get the DDoS and attack defense configuration, including flood protection settings and thresholds.
Inputs: siteId, customHeaders.
getBandwidthCtrlDetailC
Get gateway bandwidth control detail settings for a site, including per-IP and per-SSID bandwidth limits.
Inputs: siteId, customHeaders.
getCableTestFullResultsA
Get full cable test results for all ports on a switch. Returns detailed per-port diagnostic data including cable status (OK/open/short), estimated cable length, and fault location. More detailed than getCableTestLogs.
Inputs: switchMac (required), siteId, customHeaders.
getCableTestLogsB
Get cable test logs for a switch. Returns history of cable diagnostics including per-port test results, cable length estimates, and fault detection. Useful for diagnosing physical layer connectivity issues.
Inputs: switchMac (required), siteId, customHeaders.
getClientA
[DEPRECATED] Use listClients instead. When you have a client MAC, getClientDetail is also available. This tool filters the site client list in-process to emulate a per-client lookup. Fetch details for a specific Omada client.
Inputs: clientId (required), siteId, customHeaders.
getClientDetailA
Get full detail for a specific client by MAC address, including connection info, IP, VLAN, signal strength, and traffic stats.
Inputs: clientMac (required), siteId, customHeaders.
getClientsDistributionA
Get client count distribution by connection type and band (wired, 2.4GHz, 5GHz, 6GHz). Useful for understanding the network composition at a glance.
Inputs: siteId, customHeaders.
getDashboardMostActiveEapsA
Get the most active access points (EAPs) in a site, sorted by traffic volume.
Inputs: siteId, customHeaders.
getDashboardMostActiveSwitchesA
Get the most active switches in a site, sorted by traffic volume.
Inputs: siteId, customHeaders.
getDashboardOverviewA
Get the site overview topology: device counts (gateways, switches, APs), client counts (wired, wireless, guest), connectivity graph, and overall health status. Good first call to understand what's in the network.
Inputs: siteId, customHeaders.
getDashboardPoEUsageA
Get PoE (Power over Ethernet) usage statistics for a site, showing power consumption per switch.
Inputs: siteId, customHeaders.
getDashboardSwitchSummaryB
Get switch summary for a site dashboard: total switch count, total ports, active ports, PoE budget used vs available, and aggregate bandwidth.
Inputs: siteId, customHeaders.
getDashboardTopCpuUsageA
Get the top devices by CPU usage for a site, useful for identifying overloaded devices.
Inputs: siteId, customHeaders.
getDashboardTopMemoryUsageA
Get the top devices by memory usage for a site, useful for identifying memory-constrained devices.
Inputs: siteId, customHeaders.
getDashboardTrafficActivitiesB
Get traffic activity time-series data for a site, showing upload and download trends over time.
Inputs: siteId, customHeaders.
getDashboardWifiSummaryB
Get WiFi summary for a site dashboard: total APs, connected AP count, wireless client count, channel utilization per band (2.4GHz/5GHz), and SSID count.
Inputs: siteId, customHeaders.
getDeviceC
[DEPRECATED] Use listDevices instead. Filters the site device list in-process. No dedicated per-device detail endpoint exists in the spec. Fetch detailed information for a specific Omada device.
Inputs: deviceId (required), siteId, customHeaders.
getDeviceTagListB
Get the list of device tags defined in a site.
Inputs: siteId, customHeaders.
getDot1xConfigB
Get the 802.1X (dot1x) authentication configuration for a site, including enabled state, authentication mode, and RADIUS server settings.
Inputs: siteId, customHeaders.
getDownlinkWiredDevicesA
Get wired downlink devices connected to an access point's LAN port. Returns a list of devices using the AP as a wired switch, including their MAC addresses and connection details. Useful for APs with built-in switch ports (e.g. EAP615-Wall).
Inputs: apMac (required), siteId, customHeaders.
getDscpConfigA
[DEPRECATED] Get DSCP/QoS tag outbound traffic configuration. This is an alias for getQosPolicy — use getQosPolicy instead.
Inputs: siteId, customHeaders.
getFirewallSettingB
Get the site-global firewall settings returned by the official Omada firewall endpoint.
Inputs: siteId, customHeaders.
getFirmwareInfoB
Get the latest available firmware information for a device. Returns current firmware version, latest available version, and whether an upgrade is available. Use listDevices to get deviceMac values.
Inputs: deviceMac (required), siteId, customHeaders.
getFirmwareUpgradePlanC
Get the firmware upgrade plan list for devices managed by the controller.
Inputs: page, pageSize, customHeaders.
getGatewayDetailA
Fetch full configuration and status for a specific gateway: model, firmware, CPU/memory, WAN/LAN ports, routing mode, and feature flags. Use listDevices to get the gatewayMac.
Inputs: gatewayMac (required), siteId, customHeaders.
getGatewayHealthA
Composite gateway health check — single call that auto-discovers the site gateway then retrieves its full detail (CPU, memory, firmware, ports), WAN port statuses (link state, IP, ISP), and LAN interface statuses. Use when diagnosing internet connectivity issues, WAN failover, or gateway performance problems. Optionally accepts a gatewayMac to skip discovery.
Inputs: siteId, gatewayMac, customHeaders.
getGatewayLanStatusB
Get LAN port status for a specific gateway: port link state, speed, duplex, connected device, and VLAN assignment. Use listDevices to get the gatewayMac.
Inputs: gatewayMac (required), siteId, customHeaders.
getGatewayPortsA
Get all WAN and LAN port details for a specific gateway: link status, speed, IP address, bytes in/out, and port profile. More detailed than getGatewayWanStatus or getGatewayLanStatus. Use listDevices to get the gatewayMac.
Inputs: gatewayMac (required), siteId, customHeaders.
getGatewayQosClassRulesB
Get the gateway QoS class rules for a site, including traffic classification rules and DSCP/priority markings.
Inputs: page, siteId, pageSize, customHeaders.
getGatewayWanStatusA
Get the WAN port status and connectivity information for a specific gateway. Returns WAN IP, DNS, uptime, link speed, TX/RX rates, and connection type for each WAN port. Use listDevices to find the gatewayMac.
Inputs: gatewayMac (required), siteId, customHeaders.
getGridAllowListB
Get the IPS allow list (paginated). Returns entries that are explicitly allowed to bypass IPS inspection. Supports optional keyword search.
Inputs: page, siteId, pageSize, searchKey, +1 more.
getGridAutoCheckUpgradeC
Get the auto-check upgrade plan list showing scheduled firmware upgrade checks across devices. Useful for auditing upgrade schedules and identifying devices due for automatic firmware updates.
Inputs: page, pageSize, customHeaders.
getGridBlockListB
Get the IPS block list (paginated). Returns entries that are explicitly blocked by the Intrusion Prevention System. Supports optional keyword search.
Inputs: page, siteId, pageSize, searchKey, +1 more.
getGridClientHistoryB
Get per-client connection history (paginated). Returns past connection sessions for a specific client including timestamps, SSID/network, traffic, and authentication type.
Inputs: clientMac (required), page, siteId, pageSize, +2 more.
getGridEapRuleB
Get the URL filter AP rules (paginated). Returns URL-based filtering rules applied to wireless clients via access points.
Inputs: page, siteId, pageSize, customHeaders.
getGridGatewayRuleC
Get the URL filter gateway rules (paginated). Returns URL-based filtering rules applied to traffic through the gateway.
Inputs: page, siteId, pageSize, customHeaders.
getGridKnownClientsB
Get historical known clients list (paginated). Returns clients that have previously connected to the site, with optional time range and search filtering.
Inputs: page, guest, siteId, timeEnd, +5 more.
getIspLoadA
Get per-WAN ISP link load over a time range. Shows traffic volume and utilization per internet uplink. Useful for understanding load balancing behaviour, identifying saturated WAN links, and analysing failover events. start and end are Unix timestamps in seconds.
Inputs: end (required), start (required), siteId, customHeaders.
getMacFilterDetailA
Get the MAC filtering global settings for a site, including whether MAC filtering is enabled and the default action for unmatched clients.
Inputs: siteId, customHeaders.
getMeshStatisticsA
Get mesh link statistics for an access point. Returns wireless backhaul link quality, signal strength, throughput, and hop count for mesh-connected APs. Useful for diagnosing mesh network performance.
Inputs: apMac (required), siteId, customHeaders.
getNetworkHealthSummaryA
Composite health snapshot — single call that combines dashboard overview (device/client counts, connectivity), internet/WAN status, client distribution, and recent active threats. Use this as the first call when checking if everything is working or when starting any troubleshooting session. Individual sections gracefully degrade if an endpoint is unavailable.
Inputs: siteId, customHeaders.
getOsgCustomAclListB
Get the custom gateway ACL rules list (paginated). Custom ACLs extend the standard gateway ACL rules with user-defined traffic policies.
Inputs: page, siteId, pageSize, customHeaders.
getOswAclListA
Get the switch ACL list (paginated). Returns per-port or VLAN-based access control rules applied to managed switches.
Inputs: page, siteId, pageSize, customHeaders.
getOswStackLagListA
Get Link Aggregation Group (LAG) list for a switch stack. Returns configured LAG/trunk groups including member ports, load balancing mode, and status. Use getSwitchStackDetail to get the stackId.
Inputs: stackId (required), siteId, customHeaders.
getPastClientNumA
Get historical client count trend over a time range. Returns a time-series of client counts to show how connected devices changed over the specified period. Requires start and end as Unix epoch seconds.
Inputs: end (required), start (required), siteId, customHeaders.
getQosMarkingRuleA
[DEPRECATED] Get gateway QoS marking (tag outbound traffic) settings. This is an alias for getQosPolicy — use getQosPolicy instead.
Inputs: siteId, customHeaders.
getQosPolicyB
Get the gateway QoS policy (tag outbound traffic settings) for a site, including DSCP marking rules for outbound traffic.
Inputs: siteId, customHeaders.
getQosPolicyRuleA
[DEPRECATED] Get gateway QoS policy settings. This is an alias for getQosPolicy — use getQosPolicy instead.
Inputs: siteId, customHeaders.
getRadiosConfigA
Get per-radio configuration for an access point. Returns settings for each radio (2.4GHz, 5GHz, 6GHz) including band, channel, transmit power, channel width, and enabled SSIDs. Use getApRadios for runtime radio status; this returns configuration.
Inputs: apMac (required), siteId, customHeaders.
getRadiusProxyConfigB
Get the global RADIUS proxy configuration from the controller, including proxy enabled state and server settings.
Inputs: customHeaders.
getRFScanResultA
[DEPRECATED] Get the last RF scan results for an access point. This endpoint is marked deprecated in the Omada OpenAPI spec. Returns detected neighbouring networks, per-channel utilization, interference levels, and RSSI data. Use triggerRfScan first to initiate a fresh scan; this returns the most recent stored results.
Inputs: apMac (required), siteId, customHeaders.
getSitesApsAvailableChannelC
Get available channels for an AP.
Inputs: apMac (required), siteId, customHeaders.
getSitesApsBridgeC
Get P2P bridge config for an AP.
Inputs: apMac (required), siteId, customHeaders.
getSitesApsChannelLimitC
Get channel limit config for an AP.
Inputs: apMac (required), siteId, customHeaders.
getSitesApsIpSettingC
Get IP settings for an AP.
Inputs: apMac (required), siteId, customHeaders.
getSitesApsLoadBalanceA
Get load balance config for an AP.
Inputs: apMac (required), siteId, customHeaders.
getSitesApsOfdmaB
Get OFDMA configuration for an AP.
Inputs: apMac (required), siteId, customHeaders.
getSitesApsPowerSavingB
Get power saving config for an AP.
Inputs: apMac (required), siteId, customHeaders.
getSitesApsTrunkSettingC
Get trunk setting for an AP.
Inputs: apMac (required), siteId, customHeaders.
getSitesDeviceWhiteListC
Get the device whitelist for a site.
Inputs: page, siteId, pageSize, customHeaders.
getSitesGatewaysGeneralConfigC
Get gateway general config.
Inputs: gatewayMac (required), siteId, customHeaders.
getSitesGatewaysPinC
Get PIN setting for a gateway (LTE model).
Inputs: gatewayMac (required), siteId, customHeaders.
getSitesGatewaysSimCardUsedC
Get SIM card used by a gateway.
Inputs: gatewayMac (required), siteId, customHeaders.
getSitesHealthGatewaysWansDetailsC
Get WAN port health details for a gateway.
Inputs: gatewayMac (required), siteId, customHeaders.
getSitesSwitchesEsC
Get easy managed switch info.
Inputs: switchMac (required), siteId, customHeaders.
getSitesSwitchesEsGeneralConfigB
Get easy managed switch general config.
Inputs: switchMac (required), siteId, customHeaders.
getSpeedTestResultsA
Get the last speed test results for an access point. Returns upload/download throughput measurements from the most recent speed test. Use triggerSpeedTest first to initiate a new test; this returns stored results.
Inputs: apMac (required), siteId, customHeaders.
getStackNetworkListA
Get the VLAN network list for a switch stack. Returns VLAN interface assignments across all stack members. Use getSwitchStackDetail to get the stackId.
Inputs: stackId (required), page, siteId, pageSize, +1 more.
getStackPortsC
Get all port information for a switch stack.
Inputs: stackId (required), siteId, customHeaders.
getSwitchDetailA
Fetch full configuration and status for a specific switch: model, firmware, CPU/memory, all port states, PoE usage, VLAN config, and STP status. Use listDevices to get the switchMac.
Inputs: switchMac (required), siteId, customHeaders.
getSwitchDot1xSettingA
Get the 802.1X switch port authentication setting. Controls port-based network access control on managed switches.
Inputs: siteId, customHeaders.
getSwitchGeneralConfigB
Get general configuration for a switch including device name, LED settings, LLDP settings, flow control, and other global switch parameters. Use listDevices to get switchMac values.
Inputs: switchMac (required), siteId, customHeaders.
getSwitchStackDetailC
Fetch detailed information for a specific switch stack.
Inputs: stackId (required), siteId, customHeaders.
getTrafficDistributionB
Get traffic distribution by protocol and application type over a time range. Shows breakdown of traffic by category (video, gaming, web, etc.) helping identify what is consuming bandwidth on the network. start and end are Unix timestamps in seconds.
Inputs: end (required), start (required), siteId, customHeaders.
getTrafficPriorityB
Get the gateway VoIP and traffic prioritization settings for a site, including QoS prioritization rules for voice and real-time traffic.
Inputs: siteId, customHeaders.
getTrafficStatsA
[DEPRECATED] Use getDashboardTrafficActivities instead. Same GET .../dashboard/traffic-activities endpoint. Get traffic activity statistics for a site, including upload/download throughput data from the dashboard traffic activities endpoint.
Inputs: siteId, customHeaders.
getUpgradeLogsB
Get firmware upgrade logs showing the history of upgrade operations performed on devices.
Inputs: page, pageSize, customHeaders.
getUpgradeOverviewCriticalB
Get the number of critical firmware upgrades available across managed devices.
Inputs: customHeaders.
getUpgradeOverviewTryBetaC
Get the try-beta firmware switch status for the controller.
Inputs: customHeaders.
getUplinkWiredDetailA
Get wired uplink detail for an access point. Returns the AP's Ethernet uplink port information including connected switch, port number, link speed, and PoE status. Useful for mapping physical network topology.
Inputs: apMac (required), siteId, customHeaders.
getUrlFilterBlacklistB
Get the MAC-based deny (blacklist) filter entries for a site (paginated). Returns MAC addresses blocked from network access.
Inputs: page, siteId, pageSize, customHeaders.
getUrlFilterGeneralB
Get the URL filter global setting, including whether URL filtering is enabled and the default action for unmatched requests.
Inputs: siteId, customHeaders.
getUrlFilterRulesC
Get gateway URL filter rules for a site (paginated), listing URL-based allow/block rules applied on the gateway.
Inputs: page, siteId, pageSize, customHeaders.
getUrlFilterWhitelistC
Get the MAC-based allow (whitelist) filter entries for a site (paginated). Returns MAC addresses explicitly allowed through MAC filtering.
Inputs: page, siteId, pageSize, customHeaders.
listClientsA
List all network clients (wired and wireless) connected to a site. Returns client details including MAC address, IP, hostname, connected device, SSID (for wireless), signal strength, download/upload traffic, and online status. Use this to audit connected devices or find a specific client by name or MAC.
Inputs: siteId, customHeaders.
listClientsActivityA
Get client activity statistics over time from the dashboard. Returns time-series data showing new, active, and disconnected clients (both wireless/EAP and wired/switch) for each time snapshot. Useful for monitoring client connection trends and activity patterns.
Inputs: end, start, siteId, customHeaders.
listClientsPastConnectionsA
Get client past connection list with historical connection data. Returns information about clients that have previously connected to the network, including connection timestamps, traffic data, duration, and device details. Supports pagination, filtering by time range and guest status, sorting by last seen time, and fuzzy search by name/MAC/SSID.
Inputs: page, guest, siteId, timeEnd, +5 more.
listDevicesA
List all provisioned (adopted) network devices in a site: gateways, switches, and access points. Returns MAC address, model, firmware version, IP, uptime, CPU/memory usage, and status for each device. Use MAC addresses from this response as input to getGatewayDetail, getSwitchDetail, getApDetail, etc.
Inputs: siteId, customHeaders.
listDevicesStatsA
Query statistics for global adopted devices with pagination and filtering. Supports fuzzy search by MAC address, name, model, or serial number, and filtering by tag or device series type (0: basic, 1: pro).
Inputs: page, pageSize, filterTag, searchSns, +5 more.
listEapAclsB
List EAP (access point) ACL rules for a site: wireless client access control rules. Returns rule name, action (allow/deny), SSID scope, source/destination, protocol, and enabled state.
Inputs: siteId, customHeaders.
listMostActiveClientsA
Get the most active clients in a site, sorted by total traffic. Returns client name, MAC address, type, model, wireless status, and total traffic. This is a dashboard endpoint that provides a quick overview of top clients by traffic usage.
Inputs: siteId, customHeaders.
listOsgAclsA
List gateway (OSG) ACL rules for a site: firewall rules controlling traffic between WAN, LAN, and guest networks. Returns rule name, action (allow/deny), source/destination, protocol, and enabled state.
Inputs: siteId, customHeaders.
listPendingDevicesA
List devices discovered on the network but not yet adopted into this site. Returns device type, MAC, IP, and model. These are devices waiting to be provisioned.
Inputs: siteId, customHeaders.
listSitesApsPortsC
List ports on an AP.
Inputs: apMac (required), siteId, customHeaders.
listSitesCableTestSwitchesIncrementResultsC
Get cable test incremental results for a switch.
Inputs: switchMac (required), siteId, customHeaders.
listSitesCableTestSwitchesPortsB
List ports available for cable test on a switch.
Inputs: switchMac (required), siteId, customHeaders.
listSitesStacksB
List switch stacks in a site.
Inputs: page, siteId, pageSize, customHeaders.
listSwitchNetworksA
List VLAN network assignments for a switch. Returns which VLANs are assigned to which ports, including tagged and untagged configurations. Use listDevices to get switchMac values.
Inputs: switchMac (required), page, siteId, pageSize, +1 more.
listUpgradeFirmwaresC
List uploaded firmware files available for manual upgrade.
Inputs: page, pageSize, customHeaders.
listUpgradeOverviewFirmwaresC
List firmware pool entries in the upgrade overview.
Inputs: page, pageSize, customHeaders.
searchDevicesC
Search for devices globally across all sites the user has access to. Returns devices matching the search key.
Inputs: searchKey (required), customHeaders.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
TDQS
C2.8/5.0
Scored across 117 tools
Disambiguation2/5
The tool set contains many overlapping and explicitly deprecated aliases that perform the same or nearly the same operation, such as getQosPolicy vs getQosPolicyRule/getQosMarkingRule/getDscpConfig, getApplicationAcl vs getAppControlRules, getDevice vs listDevices, and getClient vs listClients/getClientDetail. While some tools have distinct scopes, the volume of duplicate and near-duplicate endpoints makes misselection likely without reading full descriptions.
Naming Consistency3/5
All names are camelCase and generally start with a verb such as get/list/search/diagnose, but the conventions are mixed: some use getXxx, some listXxx, and many use site-scoped prefixes like getSitesApsIpSetting or getSitesGatewaysGeneralConfig alongside device-scoped names like getApGeneralConfig. The pattern is readable but inconsistent enough that an agent cannot reliably predict whether a resource uses get, list, or a sites-prefixed form.
Tool Count1/5
With 117 tools, the surface is far too large for an agent to navigate efficiently, especially because many are deprecated aliases, near-duplicates, or narrow single-field configuration getters. The count reflects endpoint-by-endpoint exposure rather than a well-scoped tool set.
Completeness2/5
The surface is almost entirely read-only get/list/diagnose operations and lacks obvious write/update/delete operations for configuration, which may be intentional for a 'safe' server but is a major capability gap. It also references missing actions such as triggerSpeedTest and triggerRfScan in descriptions, creating dead ends where the tool set cannot perform an instructed prerequisite.
Maintenance
ActivityMaintained
ResponsivenessLimited data
Related MCP Connectors
An MCP server that provides an API to LLMs to manage their JumpCloud resources.
MCP server for secureFlows: token-free URL builders and integration-linting tools for AI agents.
Secure and manage MCP servers through the Speakeasy AI Control Plane from your agent.
MCP server for Pentest-Tools.com: run scans, manage findings and reports via your preffered LLM.
Related MCP Servers
- AlicenseAqualityDmaintenanceMCP server that turns Claude into a UniFi network specialist. Manage devices, optimize WiFi, audit security, and troubleshoot your network through natural language.3111 npm2MIT
- AlicenseAqualityCmaintenanceRead-only MCP server for TP-Link Omada SDN controllers, enabling querying controller, site, device, and WiFi state.8Apache 2.0
- AlicenseBqualityCmaintenanceA Model Context Protocol server that exposes TP-Link Omada controller APIs to AI copilots and automation workflows, enabling listing sites, devices, clients, and invoking arbitrary Omada endpoints.84MIT