UniFi MCP
Leverage agents and agentic AI workflows to manage your UniFi deployment.
Servers
Network, Protect and Access each connect to a console you name on your network. Site Manager is different: it reads Ubiquiti's cloud Site Manager API at https://api.ui.com with one account-wide key, and has nine read-only tools. It counts its domain tools only, without the meta-tools every server registers.
Plugins
Install these from the Claude Code, Codex or OpenClaw marketplace; Quick Start shows how.
| Plugin | What you get |
|---|
unifi-network | The Network MCP server, its agent skills and guided setup |
unifi-protect | The Protect MCP server, its agent skills and guided setup |
unifi-access | The Access MCP server, its agent skills and guided setup |
unifi-sitemanager | The Site Manager MCP server for a whole UI account, its agent skills and guided key setup |
unifi-intelligence | Cross-product investigations that use Network and Protect together, with every claim cited. Incident Investigation runs locally; Security Patrol and Visitor Audit need the cloud worker. It requires the Network and Protect plugins |
The Agent Skills table lists every skill each plugin ships.
Choose an integration
| What you are building | Use | Why |
|---|
| An AI assistant or another existing MCP client | Network, Protect, or Access MCP server | Standard MCP discovery, tool calls, permissions, and confirmation flows |
| An account-wide view of every console, site and device on a UI account | Site Manager MCP server | Read-only inventory, WAN health and SD-WAN status from Ubiquiti's cloud with one Site Manager API key |
| A custom application, automation service, code-execution runtime, or MCP adapter | unifi-api-server | Your code controls call sequencing, data joins, resource limits, and approval flow |
| Remote access for an MCP client | Cloud Relay | Authenticated remote MCP routing without exposing the local servers directly |
An MCP adapter can expose a small set of tools while using unifi-api-server
as its backend. This keeps application-specific joins, branching, loops, and
code isolation out of the general-purpose MCP servers.
Cloud Relay
Cloud Relay pairs the Cloudflare-hosted Worker gateway with the Relay sidecar on your LAN. The Worker provides the authenticated edge MCP endpoint, Durable Object broker, multi-location routing, token boundary, and deployment/management CLI. The Relay sidecar is a local MCP HTTP client and forwarder: it discovers configured local MCP servers over HTTP and maintains an outbound WebSocket to the Worker. Remote requests follow MCP client → Worker gateway → outbound WebSocket → Relay sidecar → local MCP servers over HTTP; the API server is not in this path. Read-only tools support annotation-based multi-location fan-out, while writes require explicit location targeting. Deploy the Worker with npm install -g unifi-mcp-worker && unifi-mcp-worker install, then see the Relay sidecar README to connect local servers.
REST + GraphQL API
unifi-api-server is an independent HTTP service for custom applications,
automation, and adapters. It provides typed REST resources, read-only GraphQL
queries, SSE streams, scoped API keys and administration, plus a REST action
endpoint for supported controller operations. It shares unifi-core managers
with the MCP servers but does not proxy or require them.
This is the beginning of the README. Read the rest at the original. Read the full README ↗
