UniFi MCP

Analyze locally synced data with count, group-by, and summary operations. Data must be synced first with the sync command.

Get API domain context: resource taxonomy, auth requirements, query tips, and unique capabilities. Call this first.

Compares the current locally synced state against a snapshot captured the last time 'drift' itself ran for this site, then advances the snapshot forward. The API has no config-versioning or audit-trail endpoint, so this command maintains its own snapshot on disk rather than querying history from the API. The first run for a site has nothing to compare against and reports first_run=true with an empty change list (that captured state becomes the baseline for the next run) — that is expected, not an error. Run 'unifi-network-cli sync' before each 'drift' to pick up the latest config.

Export paginated API data to a local file. Supports JSONL (one JSON object per line, streaming-friendly) and JSON (array). JSONL is recommended for large datasets as it has no memory pressure.

guest subcommands: report

Joins hotspot vouchers with currently synced clients whose access.type is GUEST — no single API response combines these. Local-mirror-only: run 'unifi-network-cli sync' first.

Surface for browsing, filtering, and deleting rows in the search_learnings table that the LLM populates via the 'teach' command.

Lists rows from the learn_candidates table: corrections and playbook shapes the CLI derived from observed usage. Candidates are quarantined until an explicit 'learnings confirm <id>' materializes them; they never alter command behavior or recall's verified results on their own.

Promotes one open candidate into the verified knowledge tables. The full candidate payload is printed before anything is written, so the caller always sees exactly what is being blessed. Materialization is per class: playbook_candidate upserts a playbook row for the candidate's query family (confidence 2, the same floor as a teach) flag_alias appends a timestamped [amend ...] correction note to the query family's playbook notes Usage errors (unknown id, non-open status) exit 2.

Removes rows from the search_learnings table so a bad teach can be undone without dropping the whole DB. Requires at least one of --resource, --action, or --all.

List recorded learnings

Marks a candidate rejected. The rejected row stays as a tombstone on its derivation signature: the identical observation never re-derives a candidate, and recall never resurfaces it. Rejecting a CONFIRMED playbook_candidate tombstones the candidate but leaves the playbook row in place; repair the guidance with 'playbook amend' if needed. A confirmed flag_alias cannot be rejected: its correction note already lives in the family playbook, so repair the guidance with 'playbook amend' instead. Usage errors (unknown id, no-reject-path candidates) exit 2.

Aggregates the local learn_events table into the loop's headline metrics: recall_hit_rate recall hits / (hits + misses) teach_to_reuse fraction of taught learnings later seen in a recall hit (joined by learning row id, with a query-family fallback for older rows) playbook_resolution_rate playbook hits not followed by an amend on the same query family candidates_confirmed/rejected judgment counts on auto-captured candidates Rates are null until their denominator is non-zero. Everything is local-only: events never leave this machine.

Maintains a local 'first seen' record for every device and client, updated each time this command runs against the synced local mirror. On the very first run for a site, every currently synced device/client becomes the baseline (not reported as new) so the whole network isn't dumped as 'newcomers' on day one. --since filters to entities first recorded within that window (default 24h). Run 'unifi-network-cli sync' before each 'newcomer' to pick up devices/clients that joined since the last check.

Inspect or amend stored CLI playbooks

Appends a timestamped note to the matching family's playbook notes_text. If no playbook exists for the family yet, creates a notes-only one. Designed for agents to fire when their debug-protocol response identifies a concrete correction worth persisting (a workaround, an undocumented endpoint shape, a stale field name, observed schema drift). Same fire-and-forget posture as teach: silent on success, errors to teach.log, safe to background with &. Disabling: pass --no-learn or set UNIFI_NO_LEARN=true.

List stored playbooks (query_family, content presence, last observed)

Lists per-port link state and PoE status for every switching- or gateway-capable device on a site. Per-port interface data does not appear in any list/sync response for this API — only a per-device detail fetch returns it — so this command reads the device list from the local mirror (for device ids) but fetches interfaces live, one call per switching/gateway device. Run 'unifi-network-cli sync' first so the device list is available.

Returns prior learnings matching the supplied query by token-set overlap (Jaccard >= 0.6) plus entity-aware validation. The LLM should call this FIRST when starting work on a new user question; if found=true AND results[0].entity_match == "exact" AND confidence >= 2, the LLM can skip discovery and go straight to live fetch for the returned resource IDs. Empty match returns {"found": false, "results": []} with exit 0 — this is an information query, not a not-found error. Disabling: UNIFI_NO_LEARN=true returns the empty shape even when learnings exist.

Walks the locally synced firewall policies in ascending index order (first match wins, matching how the gateway evaluates them) and reports the first enabled policy whose source/destination IP-address filter matches --src/--dst. This is a local simulation against the last synced ruleset, not a live trace on the gateway — it does not guarantee real traffic will be handled the same way if the config has changed since the last sync. Policy sides with no explicit IP filter (zone-wide) or a traffic-matching-list reference this command can't resolve are reported as an uncertain match (certain=false) rather than silently assumed. --port is echoed in output for reference only; protocol/port scope matching is out of scope for this command. Run 'unifi-network-cli sync' first.

Full-text search across all synced data. Faster than paginating list endpoints. Requires sync first.

Get, create, update, and delete acl rules for sites

Endpoints for viewing and managing connected clients (wired, wireless, VPN, and guest).

Get device tags for sites