UniFi MCP

Leverage agents and agentic AI workflows to manage your UniFi deployment.

Servers

Server	Status	Tools	Package
Network	Stable	209	unifi-network-mcp
Protect	Stable	62	unifi-protect-mcp
Access	Stable	37	unifi-access-mcp

Choose an integration

What you are building	Use	Why
An AI assistant or another existing MCP client	Network, Protect, or Access MCP server	Standard MCP discovery, tool calls, permissions, and confirmation flows
A custom application, automation service, code-execution runtime, or MCP adapter	unifi-api-server	Your code controls call sequencing, data joins, resource limits, and approval flow
Remote access for an MCP client	Cloud Relay	Authenticated remote MCP routing without exposing the local servers directly

An MCP adapter can expose a small set of tools while using unifi-api-server as its backend. This keeps application-specific joins, branching, loops, and code isolation out of the general-purpose MCP servers.

Cloud Relay

Component	Status	Package
Relay Sidecar	Beta	unifi-mcp-relay
Worker Gateway	Beta	unifi-mcp-worker (CLI)

Cloud Relay pairs the Cloudflare-hosted Worker gateway with the Relay sidecar on your LAN. The Worker provides the authenticated edge MCP endpoint, Durable Object broker, multi-location routing, token boundary, and deployment/management CLI. The Relay sidecar is a local MCP HTTP client and forwarder: it discovers configured local MCP servers over HTTP and maintains an outbound WebSocket to the Worker. Remote requests follow MCP client → Worker gateway → outbound WebSocket → Relay sidecar → local MCP servers over HTTP; the API server is not in this path. Read-only tools support annotation-based multi-location fan-out, while writes require explicit location targeting. Deploy the Worker with npm install -g unifi-mcp-worker && unifi-mcp-worker install, then see the Relay sidecar README to connect local servers.

REST + GraphQL API

Component	Status	Package
API Server	Beta	unifi-api-server · GHCR image

unifi-api-server is an independent HTTP service for custom applications, automation, and adapters. It provides typed REST resources, read-only GraphQL queries, SSE streams, scoped API keys and administration, plus a REST action endpoint for supported controller operations. It shares unifi-core managers with the MCP servers but does not proxy or require them.

See apps/api/README.md for quick-start and deployment patterns.

What is this?

UniFi MCP is a collection of Model Context Protocol servers that let AI assistants and automation tools interact with Ubiquiti UniFi controllers. Each server targets a specific UniFi application (Network, Protect, Access) and exposes its functionality as MCP tools — queryable, composable, and safe by default.

MCP HTTP Access

MCP HTTP is unauthenticated and intended for trusted local clients. HTTP is disabled by default; when enabled, packages bind to loopback. Docker Compose enables it on the container network and publishes ports 3000–3002 on host 127.0.0.1. Use an authenticated TLS proxy or Cloud Relay for remote access, and prevent direct access to the backend. See the transport security model and HTTP setup and migration.

Setting	Default	Purpose
UNIFI_MCP_HTTP_ENABLED	false	Opt into HTTP transport
UNIFI_MCP_HOST	127.0.0.1	Bind address; Compose explicitly uses 0.0.0.0 inside containers
UNIFI_MCP_HTTP_FORCE	false	Allow HTTP outside container PID 1
UNIFI_MCP_ALLOWED_HOSTS	localhost,127.0.0.1	Complete accepted Host-header list; Compose separately adds required internal hosts
UNIFI_MCP_ENABLE_DNS_REBINDING_PROTECTION	true	Validate Host headers to prevent DNS-rebinding requests

MCP Discovery

UniFi MCP keeps the standard MCP path primary: capable clients discover currently registered tools with tools/list and invoke them with tools/call. The default lazy mode keeps initial context small by exposing meta-tools first, while eager mode registers all selected domain tools directly for clients that prefer a full standard tool list.

The lazy-loading meta-tools — *_tool_index, *_execute, *_batch, *_batch_status, and lazy-only *_load_tools — support filtered discovery, indirect execution, batch orchestration, and optional direct registration. They are independent of the protocol-version response compatibility policy below. See MCP Discovery and Lazy-Loading Meta-Tools for mode-by-mode behavior.

MCP response size

For tool results that already provide structured output, adaptive response mode is the default. It classifies each request by the canonical date-based protocolVersion advertised during MCP initialization, not by the client's product name or application version. Requests advertising MCP `2