UniFi Gateway

Name: UniFi Gateway
Author: pete-builds

by pete-buildsversion 0.27.0i★ –iRuns on your computer

Registry nameio.github.pete-builds/unifi

Install

Overview

Description from the maker (original English)

Safe-by-default UniFi MCP: Network + Protect + Access, multi-site, dry-run, audit log.

PopNx MCP’s three pillars

These three are never merged into one score: opinions, measurements and popularity are different things.

User voiceiNo reviews yetReviews open together with accounts in a later step
Our basic checksi1 of 1 passedChecked from public information; code not scanned yet
UsageiVery new★ –

What you can do with it

We have not written a plain-language summary for this one yet. Below are the facts we read from the registry.

Connection: Runs on your computer
Transport: Streamable HTTP
Category: Other
You need to fill in: UNIFI_API_KEY, UNIFI_ACCESS_API_KEY

Install

Pick the AI app you use, then copy the settings.

Before you install

Basic checks: 1 of 1 passed
Runs on your computer with your user’s permissions (files, network, apps).
You fill in yourself: STUB_MODE, UNIFI_HOST, UNIFI_API_KEY, UNIFI_SITE, UNIFI_VERIFY_SSL, MCP_UNIFI_CONTROLLERS_FILE, MCP_UNIFI_MODULES_ENABLED, UNIFI_ACCESS_HOST, UNIFI_ACCESS_API_KEY, UNIFI_ACCESS_PORT, MCP_UNIFI_AUDIT_SINK, MCP_UNIFI_AUDIT_PATH

Values marked secret are keys to your account. Never share them or paste them into a chat.

You need

DockerDocker installed

Which app do you use?

ClaudeClaude CodeCursorVS CodeChatGPT

Pick your app above. We remember it, so next time the button says “Install in …”.

Open Claude Desktop → Settings → Developer → Edit Config, and paste this into claude_desktop_config.json

{
  "mcpServers": {
    "unifi": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-e",
        "STUB_MODE",
        "-e",
        "UNIFI_HOST",
        "-e",
        "UNIFI_API_KEY",
        "-e",
        "UNIFI_SITE",
        "-e",
        "UNIFI_VERIFY_SSL",
        "-e",
        "MCP_UNIFI_CONTROLLERS_FILE",
        "-e",
        "MCP_UNIFI_MODULES_ENABLED",
        "-e",
        "UNIFI_ACCESS_HOST",
        "-e",
        "UNIFI_ACCESS_API_KEY",
        "-e",
        "UNIFI_ACCESS_PORT",
        "-e",
        "MCP_UNIFI_AUDIT_SINK",
        "-e",
        "MCP_UNIFI_AUDIT_PATH",
        "ghcr.io/pete-builds/mcp-unifi:0.27.0"
      ],
      "env": {
        "STUB_MODE": "your-value",
        "UNIFI_HOST": "your-value",
        "UNIFI_API_KEY": "your-value",
        "UNIFI_SITE": "your-value",
        "UNIFI_VERIFY_SSL": "your-value",
        "MCP_UNIFI_CONTROLLERS_FILE": "your-value",
        "MCP_UNIFI_MODULES_ENABLED": "your-value",
        "UNIFI_ACCESS_HOST": "your-value",
        "UNIFI_ACCESS_API_KEY": "your-value",
        "UNIFI_ACCESS_PORT": "your-value",
        "MCP_UNIFI_AUDIT_SINK": "your-value",
        "MCP_UNIFI_AUDIT_PATH": "your-value"
      }
    }
  }
}

Run this in your terminal

claude mcp add unifi --env STUB_MODE=your-value --env UNIFI_HOST=your-value --env UNIFI_API_KEY=your-value --env UNIFI_SITE=your-value --env UNIFI_VERIFY_SSL=your-value --env MCP_UNIFI_CONTROLLERS_FILE=your-value --env MCP_UNIFI_MODULES_ENABLED=your-value --env UNIFI_ACCESS_HOST=your-value --env UNIFI_ACCESS_API_KEY=your-value --env UNIFI_ACCESS_PORT=your-value --env MCP_UNIFI_AUDIT_SINK=your-value --env MCP_UNIFI_AUDIT_PATH=your-value -- docker run -i --rm -e STUB_MODE -e UNIFI_HOST -e UNIFI_API_KEY -e UNIFI_SITE -e UNIFI_VERIFY_SSL -e MCP_UNIFI_CONTROLLERS_FILE -e MCP_UNIFI_MODULES_ENABLED -e UNIFI_ACCESS_HOST -e UNIFI_ACCESS_API_KEY -e UNIFI_ACCESS_PORT -e MCP_UNIFI_AUDIT_SINK -e MCP_UNIFI_AUDIT_PATH ghcr.io/pete-builds/mcp-unifi:0.27.0

Fill in the empty values before running it.

Open in Cursor

Or copy the settings yourself

Paste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json

{
  "mcpServers": {
    "unifi": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-e",
        "STUB_MODE",
        "-e",
        "UNIFI_HOST",
        "-e",
        "UNIFI_API_KEY",
        "-e",
        "UNIFI_SITE",
        "-e",
        "UNIFI_VERIFY_SSL",
        "-e",
        "MCP_UNIFI_CONTROLLERS_FILE",
        "-e",
        "MCP_UNIFI_MODULES_ENABLED",
        "-e",
        "UNIFI_ACCESS_HOST",
        "-e",
        "UNIFI_ACCESS_API_KEY",
        "-e",
        "UNIFI_ACCESS_PORT",
        "-e",
        "MCP_UNIFI_AUDIT_SINK",
        "-e",
        "MCP_UNIFI_AUDIT_PATH",
        "ghcr.io/pete-builds/mcp-unifi:0.27.0"
      ],
      "env": {
        "STUB_MODE": "your-value",
        "UNIFI_HOST": "your-value",
        "UNIFI_API_KEY": "your-value",
        "UNIFI_SITE": "your-value",
        "UNIFI_VERIFY_SSL": "your-value",
        "MCP_UNIFI_CONTROLLERS_FILE": "your-value",
        "MCP_UNIFI_MODULES_ENABLED": "your-value",
        "UNIFI_ACCESS_HOST": "your-value",
        "UNIFI_ACCESS_API_KEY": "your-value",
        "UNIFI_ACCESS_PORT": "your-value",
        "MCP_UNIFI_AUDIT_SINK": "your-value",
        "MCP_UNIFI_AUDIT_PATH": "your-value"
      }
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

Open in VS Code

Or copy the settings yourself

Paste into .vscode/mcp.json in your project

{
  "servers": {
    "unifi": {
      "type": "stdio",
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-e",
        "STUB_MODE",
        "-e",
        "UNIFI_HOST",
        "-e",
        "UNIFI_API_KEY",
        "-e",
        "UNIFI_SITE",
        "-e",
        "UNIFI_VERIFY_SSL",
        "-e",
        "MCP_UNIFI_CONTROLLERS_FILE",
        "-e",
        "MCP_UNIFI_MODULES_ENABLED",
        "-e",
        "UNIFI_ACCESS_HOST",
        "-e",
        "UNIFI_ACCESS_API_KEY",
        "-e",
        "UNIFI_ACCESS_PORT",
        "-e",
        "MCP_UNIFI_AUDIT_SINK",
        "-e",
        "MCP_UNIFI_AUDIT_PATH",
        "ghcr.io/pete-builds/mcp-unifi:0.27.0"
      ],
      "env": {
        "STUB_MODE": "your-value",
        "UNIFI_HOST": "your-value",
        "UNIFI_API_KEY": "your-value",
        "UNIFI_SITE": "your-value",
        "UNIFI_VERIFY_SSL": "your-value",
        "MCP_UNIFI_CONTROLLERS_FILE": "your-value",
        "MCP_UNIFI_MODULES_ENABLED": "your-value",
        "UNIFI_ACCESS_HOST": "your-value",
        "UNIFI_ACCESS_API_KEY": "your-value",
        "UNIFI_ACCESS_PORT": "your-value",
        "MCP_UNIFI_AUDIT_SINK": "your-value",
        "MCP_UNIFI_AUDIT_PATH": "your-value"
      }
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

This one runs on your computer, and ChatGPT can only connect to servers on the internet. Pick another app.

Your choice stays on this device in a cookie; no account needed.

Values you fill in

STUB_MODE env
When true, the server returns realistic mock data and requires no UniFi hardware. Defaults to true so the image is functional out of the box.
UNIFI_HOST env
IP address or hostname of the UniFi OS gateway (UCG-Fiber, UDM Pro, etc). Required when STUB_MODE=false and MCP_UNIFI_CONTROLLERS_FILE is unset.
UNIFI_API_KEY secret env
Local API key generated under Settings -> Control Plane -> Integrations on the gateway. Required when STUB_MODE=false and MCP_UNIFI_CONTROLLERS_FILE is unset.
UNIFI_SITE env
UniFi controller site name. Defaults to 'default'.
UNIFI_VERIFY_SSL env
Whether to verify the gateway's TLS certificate. Defaults to false because most home gateways use a self-signed cert.
MCP_UNIFI_CONTROLLERS_FILE env
Path to a YAML file describing multiple named controllers for multi-site management. When set, the legacy UNIFI_HOST / UNIFI_API_KEY env vars are ignored. Each entry needs name, host, api_key, and op…
MCP_UNIFI_MODULES_ENABLED env
Comma-separated list of modules to load. Known values: 'network', 'protect', 'access'. Defaults to 'network'. Set to 'network,protect,access' to enable Protect and Access tools alongside Network. Acc…
UNIFI_ACCESS_HOST env
UniFi Access hub IP or hostname. Required when the access module is enabled and STUB_MODE=false. Often the same host as UNIFI_HOST.
UNIFI_ACCESS_API_KEY secret env
UniFi Access API key. Separate from the Network API key; generated on the Access controller's developer settings. Required when the access module is enabled and STUB_MODE=false.
UNIFI_ACCESS_PORT env
HTTPS port for the Access hub. Defaults to 12445 (the direct Access app port).
MCP_UNIFI_AUDIT_SINK env
Audit log sink. One of 'file' (default), 'stdout', or 'syslog'. Every tool call is recorded to a JSONL stream with secrets scrubbed.
MCP_UNIFI_AUDIT_PATH env
Path for the audit log file when MCP_UNIFI_AUDIT_SINK=file. Defaults to audit.jsonl in the process CWD.

These settings are generated from the maker’s registry entry. If the README says otherwise, follow the README.

What it can do

Runs on your computer; the tool list appears in your AI app after you install it.

Basic checksi

We check information anyone can see; we have not read the code. Checks that do not apply are left out of the count. · Checked Nov 8, 2026

✓ Pass
Maker matches the repo
The registry name was verified with the GitHub account pete-builds, which owns the repo
… Not checked yet
Still maintained
We have not read this repo from GitHub yet
… Not checked yet
Has a licence
We have not read this repo from GitHub yet
– Not applicable
Endpoint responds
This one runs on your computer; there is no internet endpoint
– Not applicable
Sign-in with OAuth
Runs on your computer and uses local settings instead
… Not checked yet
No hidden instructions in tool descriptions
Runs on your computer; we can only read tool lists from internet endpoints

Compared with others in Otheri

More stars than 0% of the other 18584 servers in this category
Published to the registry more recently than 69% of the other 18584 servers in this category
Basic checks equal to or better than 100% of the other 18584 servers in this category

Compared with every active server in this category in the registry. Stars count only when the publisher owns the repo.

Common questions

Is UniFi Gateway safe?

It passed 1 of 1 applicable basic checks. We have not read the code. Before adding a key or token, see what access the server asks for and use a key with only the permissions you need.

What keys or codes does it need?

You need to fill in: UNIFI_API_KEY, UNIFI_ACCESS_API_KEY

Does it run on my computer or in the cloud?

It runs on your computer. Your AI app starts it when needed, and data does not pass through the maker’s servers (unless it calls an online service itself).

Is it still maintained?

The GitHub repo last changed –, and the latest version (0.27.0) reached the registry 18 days ago.

Which apps can use it?

Apps that support MCP, such as Claude Desktop, Claude Code, Cursor and VS Code. You also need Docker on your computer.

What can I use instead?

In the same category: Spec Driven Development, Remote Desktop Commander, aamio rendezvous

Alternatives

Servers in the same category from other makers, sorted by stars.

Reading a card:↓ Downloads per weeki★ GitHub starsiThree pillars: reviews · checks · usageiUpdated = latest version published to the registryi

Spec Driven Development

MCP Server that facilitates spec-driven development workflows, not just Vibe Coding.

by formulahendryEarly↓ 66/wk★ 440Updated 14 months ago

Runs on your computer

Install

Remote Desktop Commander

Remote Desktop Commander: use files, terminal and processes on your own computers from any AI app.

by desktop-commanderGrowing★ 211Updated 3 days ago

Runs in the cloud✓ desktopcommander.app

Install

aamio rendezvous

Meet an agent you have not met, exchange messages that expire, and prove it happened. No account.

by aamio.atEarlyUpdated today

Runs in the cloud✓ aamio.at

Install

README from the maker

Open the README

Copied from the maker’s repo as written. PopNx MCP has not reviewed or endorsed it. HTML, images and scripts are removed. Links lead off this site.

mcp-unifi

Safety-first MCP server for self-hosted UniFi. Dry-run previews, JSONL audit log, composite rollback. Network + Protect + Access.

An MCP server built around the assumption that LLM-driven infrastructure calls need guardrails. Every destructive tool accepts dry_run=True and returns the predicted change set without writing. Composite tools (create_iot_network, create_guest_network, provision_homelab_service, provision_camera) capture pre-state and roll back applied steps on partial failure. Every call — dry-run or real — lands in a JSONL audit log with secrets scrubbed; the included mcp-unifi-replay CLI can re-issue a log against a fresh controller.

Beyond the safety substrate: Network tools for devices, AP radio tuning, VLANs, WLANs, firewall, switch ports, port forwards, DHCP reservations, AP groups, observability, Threat Management / IDS-IPS, Honeypot, and Teleport VPN, plus opt-in Protect (cameras, motion events, smart detections, recording config) and Access (doors, credentials, visitors, badge events, hubs / readers). Every tool accepts a controller parameter so one server instance manages multiple UniFi sites. Speaks both stdio (Claude Desktop, uvx, .dxt) and Streamable HTTP (Docker, Helm). The full, always-current tool list is in the auto-generated Tool Manifest. Works on any UniFi OS gateway running UniFi Network 9.x or newer (UDM, UDM Pro, UDM SE, UCG-Fiber, UCG-Ultra, UDR, UDW, UniFi OS Server), authenticated with a local API key from Settings → Control Plane → Integrations. Verified against a UCG-Fiber on UniFi OS 5.1.33 running UniFi Network 10.6.101 (2026-09-13). Firewall reads cover both the legacy rulesets (list_firewall_rules) and the Zone-Based Firewall (list_firewall_policies, list_firewall_zones), and audit_open_ports checks both, so a site that has migrated to zones is not reported as having no firewall. Legacy firewall writes (create_firewall_rule and friends) target /rest/firewallrule; zone policy writes (create_firewall_policy, update_firewall_policy, delete_firewall_policy) go through the official Integration API only, and the provisioning composites create a zone policy instead of a legacy rule on a zone-based site (ADR 0009). Network and WLAN writes go through the official Integration API where the request maps onto it exactly, and fall back to the private API otherwise; UNIFI_WRITE_API=private keeps every write private (ADR 0008). No Site Manager or cloud account required.

Install

Four supported paths. Pick the one that matches how you run Claude.

Docker

Long-running container, Streamable HTTP on port 3714. Best for homelab and multi-client setups.

HTTP transport refuses to start without a bearer token, so supply one:

export MCP_UNIFI_TOKEN=$(openssl rand -hex 32)

docker run --rm -p 3714:3714 \ -e STUB_MODE=true \ -e MCP_UNIFI_AUTH_TOKENS="$MCP_UNIFI_TOKEN" \ ghcr.io/pete-builds/mcp-unifi:latest

Clients then send Authorization: Bearer $MCP_UNIFI_TOKEN. For throwaway local testing on loopback only, -e MCP_UNIFI_AUTH_REQUIRED=false skips auth entirely; never use it on an interface reachable by anything else, because every connected client gets admin-equivalent access to the controller.

Claude Desktop (.dxt) — one-click

Download mcp-unifi- .dxt from the latest release and double-click. Configuration is through a built-in UI in Claude Desktop. The bundle ships the Python runtime; no separate install needed. Uses stdio transport.

Helm

helm repo add mcp-unifi https://pete-builds.github.io/mcp-unifi/

helm install unifi mcp-unifi/mcp-unifi \ --set unifi.host=192.168.1.1 \ --set unifi.apiKey= \ --set auth.tokens=$(openssl rand -hex 32)

The chart ships auth.required: true with auth.tokens: "", so the pod will not start until you set a token (or --set auth.required=false, which is only appropriate for a trusted single-tenant cluster).

uvx / pipx

Quick one-off runs straight from the GitHub repo. Stdio transport.

uvx --from git+https://github.com/pete-builds/mcp-unifi mcp-unifi

Pin a release with @v0.5.0-rc.2 (or any tag) appended to the URL.

Full guides for each install path live in the docs site.

Design

Read-only mode. MCP_UNIFI_READONLY=true makes the server structurally unable to change anything: mutating tools are hidden from tools/list *and* refused on tools/call, so naming a hidden tool gets a normal error envelope instead of a write. Classification is declared per tool at registration (@audited("list_networks", mutates=False)), never inferred from tool names — twelve mutating tools, confirm_destructive_action among them, carry no create_/update_/delete_/set_ prefix. Registration fails if a tool has not declared a classification, so a new tool cannot default into being callable. Defense in depth on top of a read-only UniFi API key, not a replacement for it.
Safety primitives. Every destructive tool accepts dry_run=True and returns the predicted change set without writing. Composite tools (create_iot_network, create_guest_network, provision_homelab_service, provision_camera) capture pre-state and roll back applied steps on partial failure. Every tool call lands in a JSONL audit log with secrets scrubbed; the included mcp-unifi-replay CLI can re-issue a log against a fresh controller.
Single image, multi-controller. One container runs Network, Protect, and Access together. The same process manages multiple UniFi sites in parallel via the controller parameter and a YAML controllers file (MCP_UNIFI_CONTROLLERS_FILE). No need to run a separate process per controller.
API-key-first auth. Uses the local API key from Settings → Control Plane → Integrations against the /proxy/network/api endpoint. No username/password storage, no cloud account, no Site Manager dependency.
Multi-channel distribution. Docker, .dxt one-click for Claude Desktop, Helm chart, uvx. Listed on the official MCP Registry. Container images are cosign-signed (keyless OIDC) with a CycloneDX SBOM attached to each release.
Network + Protect + Access. Network on by default; Protect and Access opt-in via MCP_UNIFI_MODULES_ENABLED=network,protect,access. Access ships read-only (door unlocks and credential issuance require session-token auth and are deferred). UniFi Drive is not in scope.

Quick start

Fastest cold-start: Docker + Claude Code in stub mode, no hardware required.

Start the container. Auth is on by default, so mint a token first:

   export MCP_UNIFI_TOKEN=$(openssl rand -hex 32)

docker run -d --rm -p 3714:3714 \ -e STUB_MODE=true \ -e MCP_UNIFI_AUTH_TOKENS="$MCP_UNIFI_TOKEN" \ --name mcp-unifi ghcr.io/pete-builds/mcp-unifi:latest

   claude mcp add --transport http --scope user unifi http://localhost:3714/mcp \

--header "Authorization: Bearer $MCP_UNIFI_TOKEN"

Verify the connection:

   claude mcp list

In a Claude Code session, ask: *"list my UniFi devices"*. You'll get two stubbed devices back.

When you're ready to point at a real gateway, drop stub mode:

   docker run -d --rm -p 3714:3714 \

-e STUB_MODE=false \ -e UNIFI_HOST=192.168.1.1 \ -e UNIFI_API_KEY= \ -e MCP_UNIFI_AUTH_TOKENS="$MCP_UNIFI_TOKEN" \ --name mcp-unifi ghcr.io/pete-builds/mcp-unifi:latest

Generate the API key under Settings → Control Plane → Integrations → Create API Key on the gateway.

Configuration

All config is read from environment variables (and .env when present). The six most common:

Variable	Default	Notes
`STUB_MODE`	`true`	When `false`, real-mode controller config is required.
`UNIFI_HOST`	(empty)	Gateway IP or hostname. Required in real mode.
`UNIFI_API_KEY`	(empty)	Local API key. Required in real mode.
`MCP_UNIFI_READONLY`	`false`	When `true`, mutating tools are hidden and refused. See the Security guide.
`MCP_UNIFI_MODULES_ENABLED`	`network`	Set to `network,protect,access` to enable all three modules.
`MCP_UNIFI_CONTROLLERS_FILE`	(unset)	YAML file with named controllers for multi-site.
`MCP_UNIFI_OTEL_ENABLED`	`false`	Optional OpenTelemetry tracing, one span per tool call. Off by default and the SDK is not a dependency. See Operations.
`UNIFI_API_KEY_FILE`	(unset)	Read the API key from a file (a Docker or Kubernetes secret mount) instead of `UNIFI_API_KEY`. Wins if both are set, and turns TLS verification on by default.
`UNIFI_ACCESS_API_KEY_FILE`	(unset)	File-backed form of `UNIFI_ACCESS_API_KEY`.
`UNIFI_OS_PASSWORD_FILE`	(unset)	File-backed form of `UNIFI_OS_PASSWORD`.
`MCP_UNIFI_AUTH_TOKEN_FILE`	(unset)	File holding one bearer token (or the full `MCP_UNIFI_AUTH_TOKENS` grammar). Adds to whatever `MCP_UNIFI_AUTH_TOKENS` defines.
`MCP_UNIFI_CLIENT_ID`	(unset)	Client name for the bare token in `MCP_UNIFI_AUTH_TOKEN_FILE`.
`UNIFI_PINNED_CERT`	(unset)	Path to the console's own certificate (PEM) from `mcp-unifi-pin-cert`. When set, that certificate is the only one the server will accept from this controller. See below.

Full env var reference and the multi-site YAML schema are in the Configuration docs.

File-backed secrets

Every secret has a _FILE twin for Docker and Kubernetes secret mounts. The environment-variable form keeps working and is not deprecated by this release; the file form is opt-in and carries the hardened defaults inside it, so a controller configured by api_key_file verifies the gateway's TLS certificate unless you set verify_ssl: false. In a controllers YAML:

- name: lan

host: 192.168.1.1 api_key: # verify_ssl stays false: self-signed console on a LAN

name: datacenter host: unifi.example.com api_key_file: /run/secrets/unifi_api_key # verify_ssl defaults to true here

A missing, empty or unreadable secret file fails startup with a message naming the controller and the field, never the contents. On every boot the server logs one line per controller still on the environment-variable shape or running with TLS verification off. That warning is the first step of a dated path (opt-in, then warn, then flip at a major release) recorded in ADR 0007; nothing is refused. docker-compose.yml shows the secret mount.

Certificate pinning

UniFi consoles present a self-signed certificate whose name list does not i

Only the beginning is shown; read the rest in the repo

UniFi Gateway

Overview

PopNx MCP’s three pillars

What you can do with it

Install

Before you install

Values you fill in

What it can do

Basic checksi

Maker matches the repo

Still maintained

Has a licence

Endpoint responds

Sign-in with OAuth

No hidden instructions in tool descriptions

Compared with others in Otheri

Common questions

Alternatives

Spec Driven Development

Remote Desktop Commander

aamio rendezvous

README from the maker

mcp-unifi

Install

Docker

Claude Desktop (.dxt) — one-click

Helm

uvx / pipx

Design

Quick start

Configuration

File-backed secrets

Certificate pinning