Privacy Policy

Last updated: July 10, 2026

UniFi MCP has several independently operated surfaces. Local MCP servers can keep controller traffic on infrastructure you control. The optional self-hosted API stores operator-managed state, the optional Cloud Relay passes tool traffic through Cloudflare and stores routing metadata, and this documentation site makes limited third-party requests.

Choose the Data Path You Need

UniFi MCP includes local Model Context Protocol servers, an independent self-hosted API, and an optional Cloud Relay. These paths are not interchangeable and do not have the same storage or network boundaries.

Local MCP Servers

The Network, Protect, and Access MCP servers run on an operator-controlled machine and connect directly to configured UniFi controllers. With stdio or local HTTP and no Cloud Relay, the project does not route tool-call payloads through a hosted UniFi MCP service.

MCP client <--stdio or local HTTP--> MCP server <--local network--> UniFi controller

Controller credentials are supplied through operator-managed environment variables or configuration and are used by the local server to authenticate to the controller.
The MCP server applications do not include a database for controller records. Operators can enable diagnostics and choose how local process logs are retained.
Your MCP client or agent provider may receive prompts, tool arguments, and tool results under that product's own privacy and retention terms.
Known secret-bearing response fields are redacted by default at the project response boundary, but operators remain responsible for credential scope, configuration, and log access.

Self-Hosted API Server (Optional)

unifi-api-server is an independent HTTP service for applications and automation. It includes an administrative UI and uses an operator-controlled SQLite state database. The SQLite file itself is not fully encrypted; controller credential values are stored as encrypted controller credentials using application-layer AES-256-GCM.

Persisted API state includes controller registrations, encrypted controller credentials, API-key hashes and scopes, sessions, audit records, and application settings.
API clients send requests and receive controller-derived responses through the API endpoint the operator exposes. Operators choose its bind address, network controls, state volume, encryption-key handling, audit retention, and log settings.
Known secret-bearing response fields are redacted by default. This response policy does not remove the API's need to persist encrypted credentials for registered controllers.

Cloud Relay (Optional)

The Cloud Relay pairs a Cloudflare Worker gateway with a Relay sidecar on the operator's network. Tool-call arguments and results pass through Cloudflare in transit before reaching the sidecar and local MCP server, then return through the same path.

Remote MCP client <--HTTPS--> Worker gateway <--outbound WebSocket--> Relay sidecar <--HTTP--> local MCP server

The Worker uses Durable Object SQLite for operational routing state. Persisted records include location metadata (location ID, name, creation time, and last-seen time), hashed relay tokens, and tool catalogs containing tool names, descriptions, input schemas, annotations, and server-origin metadata.

The Worker does not store controller credentials. Controller authentication remains with the local MCP servers.
Application code does not persist tool-call arguments or results. It keeps pending calls in memory while forwarding a request and resolving its response.
Relay traffic uses HTTPS and WSS/TLS. Transport encryption does not change the fact that Cloudflare handles the payload in transit.
Cloudflare's own platform logging, retention, and privacy behavior is outside this application's storage code. Operators should review the Cloudflare Privacy Policy and their Workers logging and observability settings.

Documentation Site Requests

The documentation site has no first-party account system and does not add analytics or advertising scripts. Loading and using its public pages can still send standard request metadata such as IP address, user agent, requested URL, and referrer information to hosting or content providers:

Provider	When Contacted	Purpose
GitHub Pages	When a documentation page is loaded	Static-site hosting
Google Fonts	When the homepage or sponsor page loads	Font stylesheets and font files
GitHub API	When the homepage or sponsor page loads with JavaScript	Best-effort current repository star count
PyPI	When a page includes live Python version labels	Best-effort Python package version metadata
npm registry	When a page includes a live Worker version label	Best-effort Worker package version metadata

The committed project-statistics snapshot is loaded from this site. Live star and package-version requests are optional enhancements; blocking them leaves the static page and snapshot usable. Following external links, installing packages, or using GitHub Sponsors contacts those providers under their own policies.

Operator Choices and Retention

Retention depends on which components an operator enables. A local MCP-only deployment does not create the API or Worker databases. Enabling the API creates local SQLite state and any configured logs. Enabling Cloud Relay creates Worker routing/catalog records and sends tool traffic through Cloudflare. Operators can remove API state volumes, revoke API keys, rotate relay tokens, destroy the Worker deployment, change audit retention, and disable optional components they do not need.

Changes to This Policy

Policy changes are dated here and committed to the repository. The repository history is the record of changes to these project-specific descriptions.

Contact

For privacy questions, reach the maintainer via the GitHub repository or the email listed on the maintainer's profile.