Spec Driven Development
MCP Server that facilitates spec-driven development workflows, not just Vibe Coding.
Descripción del creador (original en inglés)
Safe-by-default UniFi MCP: Network + Protect + Access, multi-site, dry-run, audit log.
Estos tres nunca se combinan en una sola puntuación: las opiniones, las mediciones y la popularidad son cosas distintas.
Todavía no escribimos un resumen sencillo para este. Abajo están los datos que leímos del registro.
Elige la app de IA que usas y copia la configuración.
STUB_MODE, UNIFI_HOST, UNIFI_API_KEY, UNIFI_SITE, UNIFI_VERIFY_SSL, MCP_UNIFI_CONTROLLERS_FILE, MCP_UNIFI_MODULES_ENABLED, UNIFI_ACCESS_HOST, UNIFI_ACCESS_API_KEY, UNIFI_ACCESS_PORT, MCP_UNIFI_AUDIT_SINK, MCP_UNIFI_AUDIT_PATHLos valores marcados como secretos son llaves de tu cuenta. Nunca los compartas ni los pegues en un chat.
Necesitas
¿Qué app usas?
Elige tu app arriba. La recordamos, así que la próxima vez el botón dirá “Instalar en …”.
Abre Claude Desktop → Settings → Developer → Edit Config y pega esto en claude_desktop_config.json
{
"mcpServers": {
"unifi": {
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"-e",
"STUB_MODE",
"-e",
"UNIFI_HOST",
"-e",
"UNIFI_API_KEY",
"-e",
"UNIFI_SITE",
"-e",
"UNIFI_VERIFY_SSL",
"-e",
"MCP_UNIFI_CONTROLLERS_FILE",
"-e",
"MCP_UNIFI_MODULES_ENABLED",
"-e",
"UNIFI_ACCESS_HOST",
"-e",
"UNIFI_ACCESS_API_KEY",
"-e",
"UNIFI_ACCESS_PORT",
"-e",
"MCP_UNIFI_AUDIT_SINK",
"-e",
"MCP_UNIFI_AUDIT_PATH",
"ghcr.io/pete-builds/mcp-unifi:0.27.0"
],
"env": {
"STUB_MODE": "your-value",
"UNIFI_HOST": "your-value",
"UNIFI_API_KEY": "your-value",
"UNIFI_SITE": "your-value",
"UNIFI_VERIFY_SSL": "your-value",
"MCP_UNIFI_CONTROLLERS_FILE": "your-value",
"MCP_UNIFI_MODULES_ENABLED": "your-value",
"UNIFI_ACCESS_HOST": "your-value",
"UNIFI_ACCESS_API_KEY": "your-value",
"UNIFI_ACCESS_PORT": "your-value",
"MCP_UNIFI_AUDIT_SINK": "your-value",
"MCP_UNIFI_AUDIT_PATH": "your-value"
}
}
}
}Ejecuta esto en tu terminal
claude mcp add unifi --env STUB_MODE=your-value --env UNIFI_HOST=your-value --env UNIFI_API_KEY=your-value --env UNIFI_SITE=your-value --env UNIFI_VERIFY_SSL=your-value --env MCP_UNIFI_CONTROLLERS_FILE=your-value --env MCP_UNIFI_MODULES_ENABLED=your-value --env UNIFI_ACCESS_HOST=your-value --env UNIFI_ACCESS_API_KEY=your-value --env UNIFI_ACCESS_PORT=your-value --env MCP_UNIFI_AUDIT_SINK=your-value --env MCP_UNIFI_AUDIT_PATH=your-value -- docker run -i --rm -e STUB_MODE -e UNIFI_HOST -e UNIFI_API_KEY -e UNIFI_SITE -e UNIFI_VERIFY_SSL -e MCP_UNIFI_CONTROLLERS_FILE -e MCP_UNIFI_MODULES_ENABLED -e UNIFI_ACCESS_HOST -e UNIFI_ACCESS_API_KEY -e UNIFI_ACCESS_PORT -e MCP_UNIFI_AUDIT_SINK -e MCP_UNIFI_AUDIT_PATH ghcr.io/pete-builds/mcp-unifi:0.27.0Completa los valores vacíos antes de ejecutarlo.
Pégalo en .cursor/mcp.json de tu proyecto, o en ~/.cursor/mcp.json
{
"mcpServers": {
"unifi": {
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"-e",
"STUB_MODE",
"-e",
"UNIFI_HOST",
"-e",
"UNIFI_API_KEY",
"-e",
"UNIFI_SITE",
"-e",
"UNIFI_VERIFY_SSL",
"-e",
"MCP_UNIFI_CONTROLLERS_FILE",
"-e",
"MCP_UNIFI_MODULES_ENABLED",
"-e",
"UNIFI_ACCESS_HOST",
"-e",
"UNIFI_ACCESS_API_KEY",
"-e",
"UNIFI_ACCESS_PORT",
"-e",
"MCP_UNIFI_AUDIT_SINK",
"-e",
"MCP_UNIFI_AUDIT_PATH",
"ghcr.io/pete-builds/mcp-unifi:0.27.0"
],
"env": {
"STUB_MODE": "your-value",
"UNIFI_HOST": "your-value",
"UNIFI_API_KEY": "your-value",
"UNIFI_SITE": "your-value",
"UNIFI_VERIFY_SSL": "your-value",
"MCP_UNIFI_CONTROLLERS_FILE": "your-value",
"MCP_UNIFI_MODULES_ENABLED": "your-value",
"UNIFI_ACCESS_HOST": "your-value",
"UNIFI_ACCESS_API_KEY": "your-value",
"UNIFI_ACCESS_PORT": "your-value",
"MCP_UNIFI_AUDIT_SINK": "your-value",
"MCP_UNIFI_AUDIT_PATH": "your-value"
}
}
}
}Tu navegador te pide permiso para abrir la app; luego la app muestra la configuración y te pide confirmar. Los valores de las claves quedan vacíos para que los completes tú.
Pégalo en .vscode/mcp.json de tu proyecto
{
"servers": {
"unifi": {
"type": "stdio",
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"-e",
"STUB_MODE",
"-e",
"UNIFI_HOST",
"-e",
"UNIFI_API_KEY",
"-e",
"UNIFI_SITE",
"-e",
"UNIFI_VERIFY_SSL",
"-e",
"MCP_UNIFI_CONTROLLERS_FILE",
"-e",
"MCP_UNIFI_MODULES_ENABLED",
"-e",
"UNIFI_ACCESS_HOST",
"-e",
"UNIFI_ACCESS_API_KEY",
"-e",
"UNIFI_ACCESS_PORT",
"-e",
"MCP_UNIFI_AUDIT_SINK",
"-e",
"MCP_UNIFI_AUDIT_PATH",
"ghcr.io/pete-builds/mcp-unifi:0.27.0"
],
"env": {
"STUB_MODE": "your-value",
"UNIFI_HOST": "your-value",
"UNIFI_API_KEY": "your-value",
"UNIFI_SITE": "your-value",
"UNIFI_VERIFY_SSL": "your-value",
"MCP_UNIFI_CONTROLLERS_FILE": "your-value",
"MCP_UNIFI_MODULES_ENABLED": "your-value",
"UNIFI_ACCESS_HOST": "your-value",
"UNIFI_ACCESS_API_KEY": "your-value",
"UNIFI_ACCESS_PORT": "your-value",
"MCP_UNIFI_AUDIT_SINK": "your-value",
"MCP_UNIFI_AUDIT_PATH": "your-value"
}
}
}
}Tu navegador te pide permiso para abrir la app; luego la app muestra la configuración y te pide confirmar. Los valores de las claves quedan vacíos para que los completes tú.
Este se ejecuta en tu computadora, y ChatGPT solo puede conectarse a servidores en internet. Elige otra app.
Tu elección se guarda en una cookie en este dispositivo; no necesitas cuenta.
STUB_MODE envUNIFI_HOST envUNIFI_SITE envUNIFI_VERIFY_SSL envMCP_UNIFI_CONTROLLERS_FILE envMCP_UNIFI_MODULES_ENABLED envUNIFI_ACCESS_HOST envUNIFI_ACCESS_PORT envMCP_UNIFI_AUDIT_SINK envMCP_UNIFI_AUDIT_PATH envEsta configuración se genera a partir de la ficha del creador en el registro. Si el README dice otra cosa, sigue el README.
Se ejecuta en tu computadora; la lista de herramientas aparece en tu app de IA después de instalarlo.
Revisamos información que cualquiera puede ver; no hemos leído el código. Las revisiones que no aplican no se cuentan. · Revisado el 8 nov 2026
El nombre en el registro se verificó con la cuenta de GitHub pete-builds, dueña del repo
Todavía no hemos leído este repo en GitHub
Todavía no hemos leído este repo en GitHub
Este se ejecuta en tu computadora; no hay endpoint en internet
Se ejecuta en tu computadora y usa ajustes locales en su lugar
Se ejecuta en tu computadora; solo podemos leer listas de herramientas de endpoints en internet
Comparado con todos los servidores activos de esta categoría en el registro. Las estrellas solo cuentan cuando quien lo publica es dueño del repo.
Superó 1 de 1 revisiones básicas aplicables. No hemos leído el código. Antes de agregar una clave o un token, revisa qué acceso pide el servidor y usa una clave que tenga solo los permisos que necesitas.
Debes completar: UNIFI_API_KEY, UNIFI_ACCESS_API_KEY
Se ejecuta en tu computadora. Tu app de IA lo inicia cuando hace falta, y los datos no pasan por los servidores del creador (a menos que el propio servidor llame a un servicio en línea).
El repo de GitHub cambió por última vez –, y la última versión (0.27.0) llegó al registro hace 18 días.
Las apps compatibles con MCP, como Claude Desktop, Claude Code, Cursor y VS Code. También necesitas Docker en tu computadora.
En la misma categoría: Spec Driven Development, Remote Desktop Commander, Tethered Trust
Servidores de la misma categoría hechos por otros creadores, ordenados por estrellas.
Cómo leer una tarjeta:★ Estrellas de GitHubiTres pilares: reseñas · revisiones · usoiActualizado = fecha en que se publicó la última versión en el registroi
MCP Server that facilitates spec-driven development workflows, not just Vibe Coding.
Remote Desktop Commander: use files, terminal and processes on your own computers from any AI app.
Fit, compatibility and recall checks for AI agents before they buy: verdicts, evidence, receipts.
Copiado tal cual del repo del creador. PopNx MCP no lo ha revisado ni lo respalda. Se quitaron HTML, imágenes y scripts. Los enlaces llevan fuera de este sitio.
Safety-first MCP server for self-hosted UniFi. Dry-run previews, JSONL audit log, composite rollback. Network + Protect + Access.
An MCP server built around the assumption that LLM-driven infrastructure calls need guardrails. Every destructive tool accepts dry_run=True and returns the predicted change set without writing. Composite tools (create_iot_network, create_guest_network, provision_homelab_service, provision_camera) capture pre-state and roll back applied steps on partial failure. Every call — dry-run or real — lands in a JSONL audit log with secrets scrubbed; the included mcp-unifi-replay CLI can re-issue a log against a fresh controller.
Beyond the safety substrate: Network tools for devices, AP radio tuning, VLANs, WLANs, firewall, switch ports, port forwards, DHCP reservations, AP groups, observability, Threat Management / IDS-IPS, Honeypot, and Teleport VPN, plus opt-in Protect (cameras, motion events, smart detections, recording config) and Access (doors, credentials, visitors, badge events, hubs / readers). Every tool accepts a controller parameter so one server instance manages multiple UniFi sites. Speaks both stdio (Claude Desktop, uvx, .dxt) and Streamable HTTP (Docker, Helm). The full, always-current tool list is in the auto-generated Tool Manifest. Works on any UniFi OS gateway running UniFi Network 9.x or newer (UDM, UDM Pro, UDM SE, UCG-Fiber, UCG-Ultra, UDR, UDW, UniFi OS Server), authenticated with a local API key from Settings → Control Plane → Integrations. Verified against a UCG-Fiber on UniFi OS 5.1.33 running UniFi Network 10.6.101 (2026-09-13). Firewall reads cover both the legacy rulesets (list_firewall_rules) and the Zone-Based Firewall (list_firewall_policies, list_firewall_zones), and audit_open_ports checks both, so a site that has migrated to zones is not reported as having no firewall. Legacy firewall writes (create_firewall_rule and friends) target /rest/firewallrule; zone policy writes (create_firewall_policy, update_firewall_policy, delete_firewall_policy) go through the official Integration API only, and the provisioning composites create a zone policy instead of a legacy rule on a zone-based site (ADR 0009). Network and WLAN writes go through the official Integration API where the request maps onto it exactly, and fall back to the private API otherwise; UNIFI_WRITE_API=private keeps every write private (ADR 0008). No Site Manager or cloud account required.
Four supported paths. Pick the one that matches how you run Claude.
Long-running container, Streamable HTTP on port 3714. Best for homelab and multi-client setups.
HTTP transport refuses to start without a bearer token, so supply one:
export MCP_UNIFI_TOKEN=$(openssl rand -hex 32)
docker run --rm -p 3714:3714 \ -e STUB_MODE=true \ -e MCP_UNIFI_AUTH_TOKENS="$MCP_UNIFI_TOKEN" \ ghcr.io/pete-builds/mcp-unifi:latest
Clients then send Authorization: Bearer $MCP_UNIFI_TOKEN. For throwaway local testing on loopback only, -e MCP_UNIFI_AUTH_REQUIRED=false skips auth entirely; never use it on an interface reachable by anything else, because every connected client gets admin-equivalent access to the controller.
Download mcp-unifi- .dxt from the latest release and double-click. Configuration is through a built-in UI in Claude Desktop. The bundle ships the Python runtime; no separate install needed. Uses stdio transport.
helm repo add mcp-unifi https://pete-builds.github.io/mcp-unifi/
helm install unifi mcp-unifi/mcp-unifi \ --set unifi.host=192.168.1.1 \ --set unifi.apiKey= \ --set auth.tokens=$(openssl rand -hex 32)
The chart ships auth.required: true with auth.tokens: "", so the pod will not start until you set a token (or --set auth.required=false, which is only appropriate for a trusted single-tenant cluster).
Quick one-off runs straight from the GitHub repo. Stdio transport.
uvx --from git+https://github.com/pete-builds/mcp-unifi mcp-unifi
Pin a release with @v0.5.0-rc.2 (or any tag) appended to the URL.
Full guides for each install path live in the docs site.
MCP_UNIFI_READONLY=true makes the server structurally unable to change anything: mutating tools are hidden from tools/list *and* refused on tools/call, so naming a hidden tool gets a normal error envelope instead of a write. Classification is declared per tool at registration (@audited("list_networks", mutates=False)), never inferred from tool names — twelve mutating tools, confirm_destructive_action among them, carry no create_/update_/delete_/set_ prefix. Registration fails if a tool has not declared a classification, so a new tool cannot default into being callable. Defense in depth on top of a read-only UniFi API key, not a replacement for it.dry_run=True and returns the predicted change set without writing. Composite tools (create_iot_network, create_guest_network, provision_homelab_service, provision_camera) capture pre-state and roll back applied steps on partial failure. Every tool call lands in a JSONL audit log with secrets scrubbed; the included mcp-unifi-replay CLI can re-issue a log against a fresh controller.controller parameter and a YAML controllers file (MCP_UNIFI_CONTROLLERS_FILE). No need to run a separate process per controller./proxy/network/api endpoint. No username/password storage, no cloud account, no Site Manager dependency.MCP_UNIFI_MODULES_ENABLED=network,protect,access. Access ships read-only (door unlocks and credential issuance require session-token auth and are deferred). UniFi Drive is not in scope.Fastest cold-start: Docker + Claude Code in stub mode, no hardware required.
export MCP_UNIFI_TOKEN=$(openssl rand -hex 32)
docker run -d --rm -p 3714:3714 \ -e STUB_MODE=true \ -e MCP_UNIFI_AUTH_TOKENS="$MCP_UNIFI_TOKEN" \ --name mcp-unifi ghcr.io/pete-builds/mcp-unifi:latest
claude mcp add --transport http --scope user unifi http://localhost:3714/mcp \
--header "Authorization: Bearer $MCP_UNIFI_TOKEN"
claude mcp list
docker run -d --rm -p 3714:3714 \
-e STUB_MODE=false \ -e UNIFI_HOST=192.168.1.1 \ -e UNIFI_API_KEY= \ -e MCP_UNIFI_AUTH_TOKENS="$MCP_UNIFI_TOKEN" \ --name mcp-unifi ghcr.io/pete-builds/mcp-unifi:latest
Generate the API key under Settings → Control Plane → Integrations → Create API Key on the gateway.
All config is read from environment variables (and .env when present). The six most common:
| Variable | Default | Notes |
|---|---|---|
STUB_MODE | true | When false, real-mode controller config is required. |
UNIFI_HOST | (empty) | Gateway IP or hostname. Required in real mode. |
UNIFI_API_KEY | (empty) | Local API key. Required in real mode. |
MCP_UNIFI_READONLY | false | When true, mutating tools are hidden and refused. See the Security guide. |
MCP_UNIFI_MODULES_ENABLED | network | Set to network,protect,access to enable all three modules. |
MCP_UNIFI_CONTROLLERS_FILE | (unset) | YAML file with named controllers for multi-site. |
MCP_UNIFI_OTEL_ENABLED | false | Optional OpenTelemetry tracing, one span per tool call. Off by default and the SDK is not a dependency. See Operations. |
UNIFI_API_KEY_FILE | (unset) | Read the API key from a file (a Docker or Kubernetes secret mount) instead of UNIFI_API_KEY. Wins if both are set, and turns TLS verification on by default. |
UNIFI_ACCESS_API_KEY_FILE | (unset) | File-backed form of UNIFI_ACCESS_API_KEY. |
UNIFI_OS_PASSWORD_FILE | (unset) | File-backed form of UNIFI_OS_PASSWORD. |
MCP_UNIFI_AUTH_TOKEN_FILE | (unset) | File holding one bearer token (or the full MCP_UNIFI_AUTH_TOKENS grammar). Adds to whatever MCP_UNIFI_AUTH_TOKENS defines. |
MCP_UNIFI_CLIENT_ID | (unset) | Client name for the bare token in MCP_UNIFI_AUTH_TOKEN_FILE. |
UNIFI_PINNED_CERT | (unset) | Path to the console's own certificate (PEM) from mcp-unifi-pin-cert. When set, that certificate is the only one the server will accept from this controller. See below. |
Full env var reference and the multi-site YAML schema are in the Configuration docs.
Every secret has a _FILE twin for Docker and Kubernetes secret mounts. The environment-variable form keeps working and is not deprecated by this release; the file form is opt-in and carries the hardened defaults inside it, so a controller configured by api_key_file verifies the gateway's TLS certificate unless you set verify_ssl: false. In a controllers YAML:
- name: lan
host: 192.168.1.1 api_key: # verify_ssl stays false: self-signed console on a LAN
A missing, empty or unreadable secret file fails startup with a message naming the controller and the field, never the contents. On every boot the server logs one line per controller still on the environment-variable shape or running with TLS verification off. That warning is the first step of a dated path (opt-in, then warn, then flip at a major release) recorded in ADR 0007; nothing is refused. docker-compose.yml shows the secret mount.
UniFi consoles present a self-signed certificate whose name list does not i
Solo se muestra el principio; lee el resto en el repo