Report whether this server can reach a UniFi console, which transport and site it uses, what Network version the console runs, and — when something is missing — exactly what to set. Call this FIRST whenever a tool you expected is not in the list: on this API the available endpoints depend on the console's version, so an absent tool usually means an older console or missing configuration rather than a bug.

List the sites on this console with ALL THREE of their identifiers: the id (a UUID, which is what this API's paths take), the internalReference (the legacy 8-character name such as "default", which the unifi_legacy_* tools take) and the display name. Every other tool accepts any of the three for its site argument, so this is mostly useful when a site cannot be resolved or when you need the legacy name.

Report the console's UniFi Network version and which tools it supports. This API gained most of its endpoints in Network 10.0, so on an older console a large part of the tool set simply does not exist. Call this when a tool is missing or returns a 404 — it names the version each capability needs and lists what is gated off here.

List the clients currently connected to a site — the devices on your network right now, not the historical list. Each entry carries the client id (a UUID the other client tools take), its name, type, IP, MAC and when it connected. Filtering happens on the console, so a filtered call is cheaper than reading pages and discarding them here.

Get the full detail of one connected client by its id from unifi_list_clients. Returns everything the console knows about that session, including its uplink device and guest-access state.

List the UniFi devices adopted by a site — access points, switches, gateways — with their state, model, IP, MAC and firmware. Use firmwareUpdatable: true to find what needs upgrading, or state: "OFFLINE" to find what is down. The nested features and interfaces blocks are omitted here; unifi_get_device returns the complete object for one device.

Get one adopted device in full, including its features, interfaces, uplink and adoption timestamps — everything unifi_list_devices trims away.

Get a device's latest telemetry: uptime, CPU and memory utilization, load averages, uplink throughput and per-radio transmit retry rates. This is the current snapshot the console holds, not a time series — there is no history endpoint in this API.

List the hotspot guest vouchers on a site, with their code, name, time and data limits, how many guests have used each, and when it activates and expires. An expired voucher is not deleted automatically — filter with expired: false for the ones still usable.

List the networks (VLANs) configured on a site — their name, VLAN id, subnet, DHCP settings and purpose. Read-only: this server does not create or modify networks, because a wrong subnet or VLAN id disconnects every client on it with no undo. Make those changes in the UniFi UI.

List the WiFi broadcasts (SSIDs) on a site, with the network each is bridged to, its security mode, band and whether it is enabled. Read-only for the same reason as networks: a bad SSID change takes every wireless client offline at once.

List the firewall zones on a site — the named groups of networks that zone-based policies are written between. Read these first: a policy references zones by id, so the ids here are what make unifi_list_firewall_policies readable. This server never creates or modifies firewall configuration; make those changes in the UniFi UI, where a mistake can be undone before it locks you out.

List the zone-based firewall policies on a site, with their action, source and destination zones, matching criteria and whether each is enabled. Policies are evaluated in order, so pass sourceZoneId and destinationZoneId to see the ordering that actually applies between one pair of zones. Read-only, deliberately: a wrong policy can lock you out of the console with no undo.

Escape hatch: call any Integration API endpoint directly, for the parts of the API this server does not wrap — switch stacks, LAG, VPN servers, RADIUS profiles, WAN interfaces, device tags, ACL rules, DNS policies and the DPI reference tables. Paths are relative to the API root, so /sites and /sites/<uuid>/wans, and the site must be a real UUID here — this tool does NOT resolve site names, so get one from unifi_list_sites first. Writes are DISABLED: only GET is permitted. Set UNIFI_ALLOW_WRITES=1 to allow mutations, which also registers the purpose-built write tools.