UniFi Access MCP Server by sirkirby: Setup for Claude, Cursor and Other Apps

• Lists the Access tools you can call

  Shows the Access tools by category so the assistant can pick one without loading them all. It is the first step in the default lazy mode.

  Try: “What Access tools are available for doors?”

  Read · access_tool_index

• Runs any Access tool by name

  Runs an Access tool you name, passing its arguments. Whatever that tool does, this call does, including door control.

  Try: “Use access_execute to list the doors.”

  Runs code · access_execute

• Runs several Access tools in parallel

  Starts a group of tool calls at once and returns job IDs. Each call inside it carries the effects of the tool it names.

  Try: “Check the status of all doors and all devices at once.”

  Runs code · access_batch

• Checks the progress of a batch

  Reports whether a batch job is running, done or failed, with its result.

  Try: “Is my batch finished?”

  Read · access_batch_status

• Adds Access tools to the assistant's tool list

  Registers chosen Access tools so the assistant can call them directly instead of through the runner.

  Try: “Load the door tools.”

  Write · access_load_tools

• Lists every door with lock state

  Returns each door the controller manages with its name, lock state and connection status.

  Try: “Which doors are currently unlocked?”

  Network · access_list_doors

• Shows details for one door

  Returns one door's lock state, settings and connected devices.

  Try: “Show me details for the front door.”

  Network · access_get_door

• Shows just the lock and position of a door

  A lighter check that returns only whether a door is locked and whether it is open.

  Try: “Is the server room door locked?”

  Network · access_get_door_status

• Lists door groups

  Returns the groups used to assign doors to policies. It is only available over the local session.

  Try: “List my door groups.”

  Network · access_list_door_groups

• Locks a door right now

  Locks a door immediately. This is a physical action and needs confirm=true before it runs.

  Try: “Lock the back door.”

  Write · access_lock_door

• Unlocks a door for a set time

  Unlocks a door for the number of minutes you give. This is a physical action and needs confirm=true before it runs.

  Try: “Unlock the lobby door for 5 minutes.”

  Write · access_unlock_door

• Lists readers, hubs, relays and intercoms

  Returns each Access hardware device with its type, connection state and firmware version.

  Try: “Which readers are offline?”

  Network · access_list_devices

• Shows details for one device

  Returns a device's type, state, firmware, MAC and IP address.

  Try: “Show details for the lobby reader.”

  Network · access_get_device

• Shows a device's settings

  Returns the settings that the Access web interface edits for a device, such as the reader's voice greeting.

  Try: “What settings does the lobby reader have?”

  Network · access_get_device_configs

• Changes a device's settings

  Updates named settings on a device from a key and value map, for example the voice greeting. Only the keys you pass change.

  Try: “Change the lobby reader's greeting.”

  Write · access_update_device_config

• Reboots a hub, reader, relay or intercom

  Restarts a hardware device, which goes offline for a short time. It needs confirm=true.

  Try: “Reboot the garage reader.”

  Write · access_reboot_device

• Lists NFC cards, PINs and mobile credentials

  Returns each credential with its type, status and the user it belongs to.

  Try: “Which credentials expire this month?”

  Network · access_list_credentials

• Shows one credential

  Returns a credential's type, status, user and creation date.

  Try: “Show credential 1234.”

  Network · access_get_credential

• Creates a card, PIN or mobile credential for a user

  Creates a new credential and assigns it to a user. It needs confirm=true.

  Try: “Issue a PIN for Sam.”

  Write · access_create_credential

• Permanently removes a credential

  Deletes a credential from the system with no undo. It needs confirm=true.

  Try: “Revoke the lost card for Alex.”

  Delete · access_revoke_credential

• Lists people registered in Access

  Returns users with their credentials and groups, useful for auditing who has physical access.

  Try: “Who has access to the server room?”

  Network · access_list_users

• Lists access policies

  Returns each policy with its doors, schedules and user groups.

  Try: “List my access policies.”

  Network · access_list_policies

• Shows one access policy

  Returns the doors, schedule, user groups and settings of a policy.

  Try: “Show the policy for the server room.”

  Network · access_get_policy

• Changes an access policy

  Updates a policy's name, doors, schedule, user groups or enabled flag. It needs confirm=true.

  Try: “Disable the weekend policy.”

  Write · access_update_policy

• Lists access schedules

  Returns the time-based schedules configured on the controller.

  Try: “What schedules do we have?”

  Network · access_list_schedules

• Lists visitor passes

  Returns visitor passes from the Access Developer API.

  Try: “Who is expected as a visitor today?”

  Network · access_list_visitors

• Shows one visitor pass

  Returns a single pass. The ID must come from the list tool.

  Try: “Show the pass for John Smith.”

  Network · access_get_visitor

• Creates a visitor pass

  Creates a time-bounded visitor pass through the Access Developer API.

  Try: “Create a pass for John Smith for tomorrow 9 to 5.”

  Write · access_create_visitor

• Deletes a visitor pass

  Deletes a pass and revokes its access. The controller keeps a cancelled record.

  Try: “Cancel the pass for John Smith.”

  Delete · access_delete_visitor

• Searches the access event history

  Queries door unlocks, denied attempts and system events with filters.

  Try: “Show failed badge attempts this week.”

  Network · access_list_events

• Shows one access event

  Returns the type, door, user, time and result of one event.

  Try: “Show details for event 5678.”

  Network · access_get_event

• Shows the latest events from a live buffer

  Returns recent events from an in-memory buffer without calling the API, filtered by type and door.

  Try: “What just happened at the front door?”

  Network · access_recent_events

• Explains how to stream live events

  Returns the resource address of the event stream and guidance for subscribing.

  Try: “How do I watch live door events?”

  Read · access_subscribe_events

• Summarizes access activity for a period

  Counts events over a period, broken down by type, with trends.

  Try: “Summarize door activity for last week.”

  Network · access_get_activity_summary

• Shows controller model, firmware and uptime

  Returns the controller model, firmware, uptime and connected device counts.

  Try: “What firmware is the Access controller on?”

  Network · access_get_system_info

• Checks that the server can reach the controller

  Reports the API client and proxy session status to help diagnose sign-in problems.

  Try: “Is the Access connection healthy?”

  Network · access_get_health

• Builds a cleaned-up report for troubleshooting

  Creates sanitized evidence about the Access setup for you to review, with bounded live checks that are explicitly marked.

  Try: “Make a support bundle for the Access server.”

  Network · access_get_support_bundle

Watch out for

• It can unlock doors

  access_unlock_door opens a door for a set time and access_lock_door closes it. Both need confirm=true, which is the only default barrier. UNIFI_POLICY_ACCESS_DOORS_UPDATE=false blocks them. github.com

• It can delete credentials and visitor passes

  Revoking a credential removes it permanently, and deleting a visitor pass revokes its access. Both are allowed until you set UNIFI_POLICY_ACCESS_CREDENTIALS_DELETE and UNIFI_POLICY_ACCESS_VISITORS_DELETE (or UNIFI_POLICY_ACCESS_DELETE) to false. github.com

• The runner tool can call any other tool

  The execute and batch tools run whatever tool they name, so they carry the same effects, door control included. Approve each call with the named tool in view. github.com

• The docs disagree on whether changes are denied by default

  apps/access/docs/permissions.md says Access denies all mutations by default, but its own Zero config section says every tool works with a confirm step, and the policy code allows an action when no gate variable is set. Treat changes as allowed after confirm=true. To block them set UNIFI_POLICY_ACCESS_CREATE, UNIFI_POLICY_ACCESS_UPDATE and UNIFI_POLICY_ACCESS_DELETE to false, or set UNIFI_ACCESS_READ_ONLY=true. github.com

• It holds an admin login for your controller

  Changes need a local admin username and password in the config, not just an API key. Use a dedicated account with only the rights you need. github.com

• Confirmation can be switched off

  Setting UNIFI_TOOL_PERMISSION_MODE=bypass or UNIFI_ACCESS_TOOL_PERMISSION_MODE=bypass skips the preview and confirm step for every change that policy allows. The deprecated UNIFI_AUTO_CONFIRM=true does the same. Leave these unset unless you run automation. github.com

• The optional HTTP mode is off by default

  The server uses stdio unless HTTP is enabled, and the HTTP host defaults to 127.0.0.1. github.com

• Gate names by category

  Door lock and unlock use UNIFI_POLICY_ACCESS_DOORS_UPDATE, credentials use UNIFI_POLICY_ACCESS_CREDENTIALS_CREATE and UNIFI_POLICY_ACCESS_CREDENTIALS_DELETE, visitors use UNIFI_POLICY_ACCESS_VISITORS_CREATE and UNIFI_POLICY_ACCESS_VISITORS_DELETE. github.com

Security advisories