safe-omada-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| OMADA_SITE_ID | No | Optional default site ID | |
| OMADA_TIMEOUT | No | HTTP timeout in milliseconds | 30000 |
| OMADA_BASE_URL | Yes | Base URL of the Omada controller | |
| OMADA_CLIENT_ID | Yes | OAuth client ID from Omada Platform Integration | |
| OMADA_OMADAC_ID | Yes | Omada controller ID (omadacId) | |
| OMADA_STRICT_SSL | No | Enforce TLS certificate validation | true |
| OMADA_CLIENT_SECRET | Yes | OAuth client secret | |
| MCP_SERVER_LOG_LEVEL | No | debug, info, warn, error, silent | info |
| MCP_SERVER_LOG_FORMAT | No | plain, json, or gcp-json | plain |
| OMADA_TOOL_CATEGORIES | No | Explicit category override | |
| OMADA_CAPABILITY_PROFILE | No | Built-in profile: safe-read, ops-write, admin, compatibility | safe-read |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
| resources | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| listDevicesA | List all provisioned (adopted) network devices in a site: gateways, switches, and access points. Returns MAC address, model, firmware version, IP, uptime, CPU/memory usage, and status for each device. Use MAC addresses from this response as input to getGatewayDetail, getSwitchDetail, getApDetail, etc. |
| getDeviceC | [DEPRECATED] Use listDevices instead. Filters the site device list in-process. No dedicated per-device detail endpoint exists in the spec. Fetch detailed information for a specific Omada device. |
| listPendingDevicesA | List devices discovered on the network but not yet adopted into this site. Returns device type, MAC, IP, and model. These are devices waiting to be provisioned. |
| searchDevicesC | Search for devices globally across all sites the user has access to. Returns devices matching the search key. |
| listDevicesStatsA | Query statistics for global adopted devices with pagination and filtering. Supports fuzzy search by MAC address, name, model, or serial number, and filtering by tag or device series type (0: basic, 1: pro). |
| getAllDeviceBySiteA | Get all devices in a site including offline and disconnected devices. Unlike listDevices which may filter to active-only, this returns the full device inventory. Useful for auditing what hardware is registered to a site. |
| getFirmwareInfoB | Get the latest available firmware information for a device. Returns current firmware version, latest available version, and whether an upgrade is available. Use listDevices to get deviceMac values. |
| getGridAutoCheckUpgradeC | Get the auto-check upgrade plan list showing scheduled firmware upgrade checks across devices. Useful for auditing upgrade schedules and identifying devices due for automatic firmware updates. |
| getUplinkWiredDetailA | Get wired uplink detail for an access point. Returns the AP's Ethernet uplink port information including connected switch, port number, link speed, and PoE status. Useful for mapping physical network topology. |
| getDownlinkWiredDevicesA | Get wired downlink devices connected to an access point's LAN port. Returns a list of devices using the AP as a wired switch, including their MAC addresses and connection details. Useful for APs with built-in switch ports (e.g. EAP615-Wall). |
| getSpeedTestResultsA | Get the last speed test results for an access point. Returns upload/download throughput measurements from the most recent speed test. Use triggerSpeedTest first to initiate a new test; this returns stored results. |
| getFirmwareUpgradePlanC | Get the firmware upgrade plan list for devices managed by the controller. |
| getUpgradeLogsB | Get firmware upgrade logs showing the history of upgrade operations performed on devices. |
| getDeviceTagListB | Get the list of device tags defined in a site. |
| getUpgradeOverviewCriticalB | Get the number of critical firmware upgrades available across managed devices. |
| getUpgradeOverviewTryBetaC | Get the try-beta firmware switch status for the controller. |
| listUpgradeFirmwaresC | List uploaded firmware files available for manual upgrade. |
| listUpgradeOverviewFirmwaresC | List firmware pool entries in the upgrade overview. |
| listSitesStacksB | List switch stacks in a site. |
| getSitesDeviceWhiteListC | Get the device whitelist for a site. |
| getSwitchStackDetailC | Fetch detailed information for a specific switch stack. |
| getSwitchDetailA | Fetch full configuration and status for a specific switch: model, firmware, CPU/memory, all port states, PoE usage, VLAN config, and STP status. Use listDevices to get the switchMac. |
| getStackPortsC | Get all port information for a switch stack. |
| listSwitchNetworksA | List VLAN network assignments for a switch. Returns which VLANs are assigned to which ports, including tagged and untagged configurations. Use listDevices to get switchMac values. |
| getSwitchGeneralConfigB | Get general configuration for a switch including device name, LED settings, LLDP settings, flow control, and other global switch parameters. Use listDevices to get switchMac values. |
| getCableTestLogsB | Get cable test logs for a switch. Returns history of cable diagnostics including per-port test results, cable length estimates, and fault detection. Useful for diagnosing physical layer connectivity issues. |
| getCableTestFullResultsA | Get full cable test results for all ports on a switch. Returns detailed per-port diagnostic data including cable status (OK/open/short), estimated cable length, and fault location. More detailed than getCableTestLogs. |
| getOswStackLagListA | Get Link Aggregation Group (LAG) list for a switch stack. Returns configured LAG/trunk groups including member ports, load balancing mode, and status. Use getSwitchStackDetail to get the stackId. |
| getStackNetworkListA | Get the VLAN network list for a switch stack. Returns VLAN interface assignments across all stack members. Use getSwitchStackDetail to get the stackId. |
| getSwitchDot1xSettingA | Get the 802.1X switch port authentication setting. Controls port-based network access control on managed switches. |
| getSitesSwitchesEsC | Get easy managed switch info. |
| getSitesSwitchesEsGeneralConfigB | Get easy managed switch general config. |
| listSitesCableTestSwitchesPortsB | List ports available for cable test on a switch. |
| listSitesCableTestSwitchesIncrementResultsC | Get cable test incremental results for a switch. |
| getApDetailA | Fetch full configuration and status for a specific access point: model, firmware, CPU/memory, connected clients count, SSIDs, uptime, and mesh status. Use listDevices to get the apMac. |
| getApRadiosA | Get radio status for a specific access point: 2.4GHz and 5GHz band config, channel, TX power, channel utilization, and associated client count per radio. Use listDevices to get the apMac. |
| getApUplinkConfigA | Get the uplink configuration for an access point. Returns uplink mode (wired/wireless mesh), preferred uplink settings, and failover configuration. Useful for understanding mesh topology and wired uplink assignments. |
| getRadiosConfigA | Get per-radio configuration for an access point. Returns settings for each radio (2.4GHz, 5GHz, 6GHz) including band, channel, transmit power, channel width, and enabled SSIDs. Use getApRadios for runtime radio status; this returns configuration. |
| getApVlanConfigA | Get VLAN configuration for an access point. Returns the AP's management VLAN and per-SSID VLAN tagging settings. Useful for verifying network segmentation on wireless infrastructure. |
| getMeshStatisticsA | Get mesh link statistics for an access point. Returns wireless backhaul link quality, signal strength, throughput, and hop count for mesh-connected APs. Useful for diagnosing mesh network performance. |
| getRFScanResultA | [DEPRECATED] Get the last RF scan results for an access point. This endpoint is marked deprecated in the Omada OpenAPI spec. Returns detected neighbouring networks, per-channel utilization, interference levels, and RSSI data. Use triggerRfScan first to initiate a fresh scan; this returns the most recent stored results. |
| getApSnmpConfigA | Get SNMP configuration for an access point. Returns SNMP version, community strings, trap settings, and enabled state. Useful for auditing SNMP-based monitoring configurations on wireless infrastructure. |
| getApLldpConfigB | Get LLDP (Link Layer Discovery Protocol) configuration for an access point. Returns enabled state and advertised TLVs. LLDP allows network devices to advertise identity and capabilities to neighbours. |
| getApGeneralConfigA | Get general configuration for an access point. Returns device name, LED settings, country/region, management VLAN, bandwidth limits, and other global AP parameters. Use getApDetail for runtime status; this returns stored configuration. |
| getApQosConfigA | Get QoS configuration for a specific access point. |
| getApIpv6ConfigB | Get IPv6 configuration for a specific access point. |
| getSitesApsIpSettingC | Get IP settings for an AP. |
| getSitesApsChannelLimitC | Get channel limit config for an AP. |
| getSitesApsAvailableChannelC | Get available channels for an AP. |
| getSitesApsLoadBalanceA | Get load balance config for an AP. |
| getSitesApsOfdmaB | Get OFDMA configuration for an AP. |
| getSitesApsPowerSavingB | Get power saving config for an AP. |
| getSitesApsTrunkSettingC | Get trunk setting for an AP. |
| getSitesApsBridgeC | Get P2P bridge config for an AP. |
| listSitesApsPortsC | List ports on an AP. |
| getGatewayDetailA | Fetch full configuration and status for a specific gateway: model, firmware, CPU/memory, WAN/LAN ports, routing mode, and feature flags. Use listDevices to get the gatewayMac. |
| getGatewayWanStatusA | Get the WAN port status and connectivity information for a specific gateway. Returns WAN IP, DNS, uptime, link speed, TX/RX rates, and connection type for each WAN port. Use listDevices to find the gatewayMac. |
| getGatewayLanStatusB | Get LAN port status for a specific gateway: port link state, speed, duplex, connected device, and VLAN assignment. Use listDevices to get the gatewayMac. |
| getGatewayPortsA | Get all WAN and LAN port details for a specific gateway: link status, speed, IP address, bytes in/out, and port profile. More detailed than getGatewayWanStatus or getGatewayLanStatus. Use listDevices to get the gatewayMac. |
| getSitesGatewaysGeneralConfigC | Get gateway general config. |
| getSitesGatewaysPinC | Get PIN setting for a gateway (LTE model). |
| getSitesGatewaysSimCardUsedC | Get SIM card used by a gateway. |
| getSitesHealthGatewaysWansDetailsC | Get WAN port health details for a gateway. |
| listClientsA | List all network clients (wired and wireless) connected to a site. Returns client details including MAC address, IP, hostname, connected device, SSID (for wireless), signal strength, download/upload traffic, and online status. Use this to audit connected devices or find a specific client by name or MAC. |
| getClientA | [DEPRECATED] Use listClients instead. When you have a client MAC, getClientDetail is also available. This tool filters the site client list in-process to emulate a per-client lookup. Fetch details for a specific Omada client. |
| getClientDetailA | Get full detail for a specific client by MAC address, including connection info, IP, VLAN, signal strength, and traffic stats. |
| getGridKnownClientsB | Get historical known clients list (paginated). Returns clients that have previously connected to the site, with optional time range and search filtering. |
| getGridClientHistoryB | Get per-client connection history (paginated). Returns past connection sessions for a specific client including timestamps, SSID/network, traffic, and authentication type. |
| listMostActiveClientsA | Get the most active clients in a site, sorted by total traffic. Returns client name, MAC address, type, model, wireless status, and total traffic. This is a dashboard endpoint that provides a quick overview of top clients by traffic usage. |
| listClientsActivityA | Get client activity statistics over time from the dashboard. Returns time-series data showing new, active, and disconnected clients (both wireless/EAP and wired/switch) for each time snapshot. Useful for monitoring client connection trends and activity patterns. |
| listClientsPastConnectionsA | Get client past connection list with historical connection data. Returns information about clients that have previously connected to the network, including connection timestamps, traffic data, duration, and device details. Supports pagination, filtering by time range and guest status, sorting by last seen time, and fuzzy search by name/MAC/SSID. |
| getClientsDistributionA | Get client count distribution by connection type and band (wired, 2.4GHz, 5GHz, 6GHz). Useful for understanding the network composition at a glance. |
| getPastClientNumA | Get historical client count trend over a time range. Returns a time-series of client counts to show how connected devices changed over the specified period. Requires start and end as Unix epoch seconds. |
| getAclConfigTypeSettingC | Get the ACL configuration type setting for the site gateway (L2 or L3 mode). Determines how ACL rules are evaluated for traffic. |
| getOsgCustomAclListB | Get the custom gateway ACL rules list (paginated). Custom ACLs extend the standard gateway ACL rules with user-defined traffic policies. |
| getOswAclListA | Get the switch ACL list (paginated). Returns per-port or VLAN-based access control rules applied to managed switches. |
| getGridAllowListB | Get the IPS allow list (paginated). Returns entries that are explicitly allowed to bypass IPS inspection. Supports optional keyword search. |
| getGridBlockListB | Get the IPS block list (paginated). Returns entries that are explicitly blocked by the Intrusion Prevention System. Supports optional keyword search. |
| getGridGatewayRuleC | Get the URL filter gateway rules (paginated). Returns URL-based filtering rules applied to traffic through the gateway. |
| getGridEapRuleB | Get the URL filter AP rules (paginated). Returns URL-based filtering rules applied to wireless clients via access points. |
| getFirewallSettingB | Get the site-global firewall settings returned by the official Omada firewall endpoint. |
| listOsgAclsA | List gateway (OSG) ACL rules for a site: firewall rules controlling traffic between WAN, LAN, and guest networks. Returns rule name, action (allow/deny), source/destination, protocol, and enabled state. |
| listEapAclsB | List EAP (access point) ACL rules for a site: wireless client access control rules. Returns rule name, action (allow/deny), SSID scope, source/destination, protocol, and enabled state. |
| getDot1xConfigB | Get the 802.1X (dot1x) authentication configuration for a site, including enabled state, authentication mode, and RADIUS server settings. |
| getRadiusProxyConfigB | Get the global RADIUS proxy configuration from the controller, including proxy enabled state and server settings. |
| getApplicationAclA | [DEPRECATED] Get application control rules for a site. This is an alias for getAppControlRules — use getAppControlRules instead. |
| getUrlFilterGeneralB | Get the URL filter global setting, including whether URL filtering is enabled and the default action for unmatched requests. |
| getApplicationControlStatusC | Get application control (DPI) status and configuration for a site. |
| getAttackDefenseSettingB | Get the DDoS and attack defense configuration, including flood protection settings and thresholds. |
| getGatewayQosClassRulesB | Get the gateway QoS class rules for a site, including traffic classification rules and DSCP/priority markings. |
| getBandwidthCtrlDetailC | Get gateway bandwidth control detail settings for a site, including per-IP and per-SSID bandwidth limits. |
| getAppControlRulesB | Get application control rules for a site, listing application-level firewall rules that allow or block specific apps or app categories. |
| getAppControlCategoriesA | Get application control categories (families) for a site, listing available app category definitions used in application control rules. |
| getUrlFilterRulesC | Get gateway URL filter rules for a site (paginated), listing URL-based allow/block rules applied on the gateway. |
| getUrlFilterBlacklistB | Get the MAC-based deny (blacklist) filter entries for a site (paginated). Returns MAC addresses blocked from network access. |
| getUrlFilterWhitelistC | Get the MAC-based allow (whitelist) filter entries for a site (paginated). Returns MAC addresses explicitly allowed through MAC filtering. |
| getMacFilterDetailA | Get the MAC filtering global settings for a site, including whether MAC filtering is enabled and the default action for unmatched clients. |
| getQosPolicyB | Get the gateway QoS policy (tag outbound traffic settings) for a site, including DSCP marking rules for outbound traffic. |
| getTrafficPriorityB | Get the gateway VoIP and traffic prioritization settings for a site, including QoS prioritization rules for voice and real-time traffic. |
| getTrafficStatsA | [DEPRECATED] Use getDashboardTrafficActivities instead. Same GET .../dashboard/traffic-activities endpoint. Get traffic activity statistics for a site, including upload/download throughput data from the dashboard traffic activities endpoint. |
| getQosPolicyRuleA | [DEPRECATED] Get gateway QoS policy settings. This is an alias for getQosPolicy — use getQosPolicy instead. |
| getQosMarkingRuleA | [DEPRECATED] Get gateway QoS marking (tag outbound traffic) settings. This is an alias for getQosPolicy — use getQosPolicy instead. |
| getDscpConfigA | [DEPRECATED] Get DSCP/QoS tag outbound traffic configuration. This is an alias for getQosPolicy — use getQosPolicy instead. |
| getNetworkHealthSummaryA | Composite health snapshot — single call that combines dashboard overview (device/client counts, connectivity), internet/WAN status, client distribution, and recent active threats. Use this as the first call when checking if everything is working or when starting any troubleshooting session. Individual sections gracefully degrade if an endpoint is unavailable. |
| getGatewayHealthA | Composite gateway health check — single call that auto-discovers the site gateway then retrieves its full detail (CPU, memory, firmware, ports), WAN port statuses (link state, IP, ISP), and LAN interface statuses. Use when diagnosing internet connectivity issues, WAN failover, or gateway performance problems. Optionally accepts a gatewayMac to skip discovery. |
| diagnoseClientA | Composite client diagnostic — single call that combines a client's current connection status, detailed info (VLAN, signal, rate limit, group policy), and recent connection history (last 10 sessions). Use when troubleshooting why a device can't connect, has poor performance, or keeps disconnecting. Accepts MAC address, IP address, or hostname. |
| getDashboardWifiSummaryB | Get WiFi summary for a site dashboard: total APs, connected AP count, wireless client count, channel utilization per band (2.4GHz/5GHz), and SSID count. |
| getDashboardSwitchSummaryB | Get switch summary for a site dashboard: total switch count, total ports, active ports, PoE budget used vs available, and aggregate bandwidth. |
| getDashboardTrafficActivitiesB | Get traffic activity time-series data for a site, showing upload and download trends over time. |
| getDashboardPoEUsageA | Get PoE (Power over Ethernet) usage statistics for a site, showing power consumption per switch. |
| getDashboardTopCpuUsageA | Get the top devices by CPU usage for a site, useful for identifying overloaded devices. |
| getDashboardTopMemoryUsageA | Get the top devices by memory usage for a site, useful for identifying memory-constrained devices. |
| getDashboardMostActiveSwitchesA | Get the most active switches in a site, sorted by traffic volume. |
| getDashboardMostActiveEapsA | Get the most active access points (EAPs) in a site, sorted by traffic volume. |
| getDashboardOverviewA | Get the site overview topology: device counts (gateways, switches, APs), client counts (wired, wireless, guest), connectivity graph, and overall health status. Good first call to understand what's in the network. |
| getTrafficDistributionB | Get traffic distribution by protocol and application type over a time range. Shows breakdown of traffic by category (video, gaming, web, etc.) helping identify what is consuming bandwidth on the network. start and end are Unix timestamps in seconds. |
| getIspLoadA | Get per-WAN ISP link load over a time range. Shows traffic volume and utilization per internet uplink. Useful for understanding load balancing behaviour, identifying saturated WAN links, and analysing failover events. start and end are Unix timestamps in seconds. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 117 tools
The tool set contains many overlapping and explicitly deprecated aliases that perform the same or nearly the same operation, such as getQosPolicy vs getQosPolicyRule/getQosMarkingRule/getDscpConfig, getApplicationAcl vs getAppControlRules, getDevice vs listDevices, and getClient vs listClients/getClientDetail. While some tools have distinct scopes, the volume of duplicate and near-duplicate endpoints makes misselection likely without reading full descriptions.
All names are camelCase and generally start with a verb such as get/list/search/diagnose, but the conventions are mixed: some use getXxx, some listXxx, and many use site-scoped prefixes like getSitesApsIpSetting or getSitesGatewaysGeneralConfig alongside device-scoped names like getApGeneralConfig. The pattern is readable but inconsistent enough that an agent cannot reliably predict whether a resource uses get, list, or a sites-prefixed form.
With 117 tools, the surface is far too large for an agent to navigate efficiently, especially because many are deprecated aliases, near-duplicates, or narrow single-field configuration getters. The count reflects endpoint-by-endpoint exposure rather than a well-scoped tool set.
The surface is almost entirely read-only get/list/diagnose operations and lacks obvious write/update/delete operations for configuration, which may be intentional for a 'safe' server but is a major capability gap. It also references missing actions such as triggerSpeedTest and triggerRfScan in descriptions, creating dead ends where the tool set cannot perform an instructed prerequisite.