UniFi MCP

Get, execute, create, and remove devices for sites

Get, create, update, and delete dns for sites

Endpoints for managing custom firewall zones and policies within a site.

Endpoints for managing guest access via Hotspot vouchers — create, list

Endpoints for creating, updating, deleting, and inspecting network configurations including VLANs, DHCP, NAT

Get radius for sites

Endpoints for managing switching features like Switch Stacking and LAG.

Endpoints for managing port and IP address lists used across firewall policy configurations.

Get vpn for sites

Get wans for sites

Get, create, update, and delete wifi for sites

Run read-only SQL against local database. Use for ad-hoc analysis, aggregations, and joins across synced resources. Requires sync first.

Sync data from the API into a local SQLite database. This API does not declare temporal sync filters, so sync performs full pagination unless an explicit resource declares its own incremental filter. Once synced, use the 'search' command for instant full-text search. Exit codes & warnings: Resources the API denies access to (HTTP 403, or HTTP 400 with an access-policy body) are reported as warnings rather than failing the run. In --json mode each is emitted as a {"event":"sync_warning",...} line carrying status, reason, and message fields, and a final {"event":"sync_summary",...} aggregates the run. Exit 0 when at least one resource synced and no resource flagged in the spec as critical (x-critical: true) failed; non-critical failures emit {"event":"sync_warning","reason":"exit_policy_default_changed", ...} so callers can detect that a partial failure was tolerated. Pass --strict to exit non-zero on any per-resource failure. Exit is always non-zero when every selected resource failed, regardless of --strict. Resource scoping: --resources runs the named top-level resources, plus any parent-keyed dependent whose own name is listed OR whose parent table is listed. Naming a parent therefore cascades to its dependents (so "sync this parent and its children" works without listing every nested resource by hand). There is no flag today to suppress the cascade for a named parent. To run a dependent without re-syncing its parent, list only the dependent by name; the parent table must already be populated from a prior sync.

Record one or more "this query -> this resource" mappings so the next query that matches surfaces the right resources without re-running discovery. This command is designed to be backgrounded by an LLM right before it emits the user-facing response: silent on success, errors only to the CLI state directory's teach.log, safe to fire-and-forget. Disabling: pass --no-learn or set UNIFI_NO_LEARN=true.

Adds one row to entity_lookups. Used by the recall path's pattern engine to substitute values for canonical names at substitution time. Computed kinds (lowercase, uppercase, kebab-case, capitalize-first, slug) cannot be taught — they are derived from the canonical input.

Adds one row to search_patterns. The recall path uses patterns to substitute live query entities into a resource template, so a pattern with query_template="items in {entity}" and resource_template="GROUP-{entity:category}" generalizes one teach into a whole family.

Stores a structured CLI command sequence (with entity slots) and/or free-form gotchas/workarounds, keyed on the structural query family. The recall path surfaces this whenever a future query of the same family fires, so the agent can replay the choreography and read the notes verbatim. At least one of --playbook-json/--playbook-file and --notes/--notes-file must be set. --playbook-json takes the playbook body inline so MCP-only agents can record playbooks without a file on disk.

Groups every synced client under the device it is attached to (via each client's uplinkDeviceId), giving a two-level device→client tree entirely from the local mirror. The API's device-list response does not include device-to-device uplink chaining (that only appears on a per-device detail fetch), so a switch-behind-switch or AP-behind-switch relationship is not shown — every device is listed at the top level. Run 'unifi-network-cli sync' first to populate the mirror.

Execute one unifi API endpoint by its endpoint_id (from unifi_search). Params are passed as a JSON object; path placeholders and query strings are resolved automatically.

Get metadata for one GET endpoint by its endpoint_id (from unifi_search). This registry-only lookup never calls the API.

Search the unifi API for endpoints matching a natural-language query. Returns a ranked list of {endpoint_id, method, path, summary} entries. Call this first to find the endpoint to execute.

Compound workflows that combine multiple API operations

Archive fetches all syncable resources from the API and stores them in a local SQLite database. Supports incremental sync (only new data since last run) and full resync. After archiving, use 'search' for instant full-text search.

Show local archive status and sync state for all resources