Open source · MIT licensed

Give agents safe access to your UniFi stack.

Keep your controllers behind the firewall. Preview changes before they run. Build advanced automation on infrastructure you control.

Get started Explore the products
280+ MCP toolsAcross Network, Protect, and Access.
REST + GraphQLA standalone API for apps and automation.
Local firstOptional Cloud Relay for remote MCP access.

Choose an interface

Three product paths, built for different jobs.

Use MCP with an agent, HTTP with an application, or add the Cloud Relay when an MCP client needs a remote route home.

01

MCP for agents

Independent servers share a consistent discovery, confirmation, and policy model. Run one or combine all three.

Network Stable

Inventory, clients, routing, Wi-Fi, firewall policy, traffic, and controlled configuration.

186 toolsunifi-network-mcp

Protect Beta

Cameras, events, detections, recordings, devices, and incident investigation workflows.

61 toolsunifi-protect-mcp

Access Beta

Doors, visitors, credentials, policies, devices, and activity records.

36 toolsunifi-access-mcp

02

HTTP API for applications

unifi-api-server runs independently from the MCP servers while sharing the same unifi-core manager layer.

  • Typed REST reads across Network, Protect, and Access
  • Read-only GraphQL over consumer-facing resource shapes
  • REST actions for supported controller operations
  • SSE streams, scoped API keys, and audit records
  • Encrypted controller credentials and an administrative control-plane UI
API README Container OpenAPI GraphQL

03

Remote MCP through the Cloud Relay

An optional paired path for reaching local MCP servers without opening inbound controller or MCP ports.

Remote MCP client→Worker gateway→outbound WebSocket→Relay sidecar→local MCP servers over HTTP

Worker gateway exposes the authenticated Cloudflare-hosted MCP endpoint, brokers locations, and is managed by the npm CLI.

Relay sidecar discovers configured local servers and maintains the outbound connection.

Reads can fan out across locations; writes require an explicit location target.

unifi-mcp-worker unifi-mcp-relay

Open-source momentum

Used in more places. Improved by more people.

Separate windows keep unlike signals honest. Figures come from a committed snapshot rather than page-view tracking.

Python downloads
—
Trailing 30 days
Container pulls
—
Lifetime across five GHCR images
Community pull requests
—
Merged in the last 90 days

— distinct community contributors in the same 90-day window. Updated . Sources: PyPI Stats and GitHub.

Control and safety

Useful access without giving up the boundary.

UniFi MCP makes the control points explicit. Scope controller credentials appropriately and choose exposure settings that match your environment.

Private by design

Keep controllers local.

Local use needs no inbound public port. The controller can remain private on your network.

Confirmation mode

Review mutations first.

The default mode previews a state-changing operation and waits for confirmation before execution.

Policy gates

Set hard limits.

Disable create, update, or delete behavior globally or at server and category scope.

Response redaction

Protect sensitive fields.

Known secret-bearing values are redacted by default when a response leaves the server boundary.

What users build

Operational work, expressed in plain language.

The tools stay close to real controller capabilities; reusable plugin skills turn them into repeatable workflows.

Network operations

Inventory, health, policy review, and controlled configuration changes.

Protect investigations

Event, detection, recording, and incident workflows grounded in controller data.

Access workflows

Door, visitor, credential, and activity work with explicit mutation controls.

Cross-product context

Join network, camera, and access evidence, with optional remote MCP access.

Plugin skills

Package repeatable operational workflows and domain guidance for an agent.

Typed applications

Build dashboards and integrations on the standalone REST and GraphQL API.

Install

Start with the MCP path that fits your client.

The default route includes the server, agent skills, and guided setup. Direct package and container options are here when you want to configure things yourself.

# Add the marketplace, then install one server plugin
/plugin marketplace add sirkirby/unifi-mcp
/plugin install unifi-network@unifi-plugins

# Run its guided setup
/unifi-network:unifi-network-setup

FAQ

Useful context before you connect.

Is this an official Ubiquiti project?

No. UniFi MCP is an independent, community-maintained open-source project and is not affiliated with Ubiquiti.

Does local use require a cloud service?

No. MCP servers and the API can run on your network with local controller access. The Cloud Relay is optional and only needed for remote MCP clients.

How are changes kept under control?

Confirmation mode previews mutations by default. Operators can add policy gates that prevent create, update, or delete behavior at multiple scopes.

Which controllers are supported?

The project targets supported UniFi Network, Protect, and Access environments, with compatibility varying by product, controller, firmware, and exposed API surface. Check the component README for current requirements.

Can I use my own MCP client?

Yes. Every server exposes stdio. Optional HTTP transport supports clients that connect through Streamable HTTP or SSE-compatible paths.

How can I contribute?

Start with the contributor guide, open an issue, or join a discussion. Documentation, compatibility reports, and focused pull requests all help.