UniFi Gateway MCP Server

UniFi Gateway is an MCP integration. Safe-by-default UniFi MCP: Network + Protect + Access, multi-site, dry-run, audit log.

Packages and local setup

The published oci package is ghcr.io/pete-builds/mcp-unifi:0.25.0. Its declared MCP transport is streamable-http.

The package declares STUB_MODE: When true, the server returns realistic mock data and requires no UniFi hardware. Defaults to true so the image is functional out of the box.; UNIFI_HOST: IP address or hostname of the UniFi OS gateway (UCG-Fiber, UDM Pro, etc). Required when STUB_MODE=false and MCP_UNIFI_CONTROLLERS_FILE is unset.; UNIFI_API_KEY: Local API key generated under Settings -> Control Plane -> Integrations on the gateway. Required when STUB_MODE=false and MCP_UNIFI_CONTROLLERS_FILE is unset.; UNIFI_SITE: UniFi controller site name. Defaults to 'default'.; UNIFI_VERIFY_SSL: Whether to verify the gateway's TLS certificate. Defaults to false because most home gateways use a self-signed cert.; MCP_UNIFI_CONTROLLERS_FILE: Path to a YAML file describing multiple named controllers for multi-site management. When set, the legacy UNIFI_HOST / UNIFI_API_KEY env vars are ignored. Each entry needs name, host, api_key, and optionally port, site, verify_ssl.; MCP_UNIFI_MODULES_ENABLED: Comma-separated list of modules to load. Known values: 'network', 'protect', 'access'. Defaults to 'network'. Set to 'network,protect,access' to enable Protect and Access tools alongside Network. Access currently ships read-only; door unlocks and credential issuance require session-token auth and are deferred.; UNIFI_ACCESS_HOST: UniFi Access hub IP or hostname. Required when the access module is enabled and STUB_MODE=false. Often the same host as UNIFI_HOST.; UNIFI_ACCESS_API_KEY: UniFi Access API key. Separate from the Network API key; generated on the Access controller's developer settings. Required when the access module is enabled and STUB_MODE=false.; UNIFI_ACCESS_PORT: HTTPS port for the Access hub. Defaults to 12445 (the direct Access app port).; MCP_UNIFI_AUDIT_SINK: Audit log sink. One of 'file' (default), 'stdout', or 'syslog'. Every tool call is recorded to a JSONL stream with secrets scrubbed.; MCP_UNIFI_AUDIT_PATH: Path for the audit log file when MCP_UNIFI_AUDIT_SINK=file. Defaults to audit.jsonl in the process CWD..

Before connecting

Check the maintainer’s instructions for account access, authentication and the supported client configuration. Once connected, inspect the tools your client receives and try a small task that matches the server’s stated purpose. The registry description does not include a verified, complete tool list.

Project and source

View the publisher’s registry entry · Project repository · Project website. This profile uses version 0.25.0 from the registry. Registration identifies the publisher namespace; it does not establish that this is a first-party integration for every service it connects.

Browse related security & identity MCP servers for tools that cover the same kind of work.