UniFi Network MCP Server by sirkirby: Setup for Claude, Cursor and Other Apps

• Shows one MAC access rule

  Returns the full settings of one MAC access rule by ID. A MAC access rule is a layer 2 rule that decides which devices on a VLAN may talk to each other.

  Try: “Show the details of a MAC access rule.”

  Read · unifi_get_acl_rule_details

• Shows recent controller alerts

  Returns the recent alerts raised by the controller.

  Try: “Show me recent alerts.”

  Read · unifi_get_alerts

• Shows network anomalies

  Returns anomaly events the controller detected on the network.

  Try: “Has the controller flagged any anomalies?”

  Read · unifi_get_anomalies

• Shows one access point group

  Returns the full settings of one access point group by ID. An access point group is a set of access points that broadcast chosen Wi-Fi names.

  Try: “Show the details of a access point group.”

  Read · unifi_get_ap_group_details

• Shows auto-backup settings

  Returns whether automatic backups are on, plus schedule, retention and cloud backup settings.

  Try: “Are automatic backups enabled?”

  Read · unifi_get_autobackup_settings

• Shows everything about one client

  Looks up a single client by MAC address. By default it returns the full record, or a short summary if you ask.

  Try: “Show me the details for the client with MAC AA:BB:CC:DD:EE:FF.”

  Read · unifi_get_client_details

• Shows which apps one client uses

  Returns traffic for one client broken down by application or category, using the controller deep packet inspection data.

  Try: “Which apps is my TV using the most bandwidth on?”

  Read · unifi_get_client_dpi_traffic

• Shows one client group

  Returns the full settings of one client group by ID. A client group is a named set of devices, listed by MAC address, that policies can target.

  Try: “Show the details of a client group.”

  Read · unifi_get_client_group_details

• Shows guest login sessions

  Returns the session history of hotspot and captive portal logins. It does not track normal connections.

  Try: “Show the guest portal sessions for this week.”

  Read · unifi_get_client_sessions

• Shows a client traffic history

  Returns upload and download totals over time for one client from the controller report.

  Try: “How much data did this phone upload yesterday?”

  Read · unifi_get_client_stats

• Shows Wi-Fi quality for one client

  Returns signal, noise, satisfaction score and transmit and receive rates for a wireless client.

  Try: “Why is the laptop in the study getting a weak Wi-Fi signal?”

  Read · unifi_get_client_wifi_details

• Shows one content filter profile

  Returns the full settings of one content filter profile by ID. A content filter profile is a DNS-based block list by category, with optional safe search.

  Try: “Show the details of a content filter profile.”

  Read · unifi_get_content_filter_details

• Shows the site dashboard

  Returns the controller summary view for the site. It is a compact summary unless you ask for the full data.

  Try: “Give me the site dashboard.”

  Read · unifi_get_dashboard

• Shows everything about one device

  Looks up one UniFi device by MAC address and returns its full record or a short summary.

  Try: “Show me the details for the access point in the hallway.”

  Read · unifi_get_device_details

• Shows radio settings and stats

  Returns channel, power and live statistics for each radio on an access point or a gateway with Wi-Fi.

  Try: “What channel is the living room access point on?”

  Read · unifi_get_device_radio

• Shows a device traffic history

  Returns received and sent bytes and client counts over time for one device.

  Try: “Show traffic for the main switch over the last day.”

  Read · unifi_get_device_stats

• Shows one static DNS record

  Returns the full settings of one static DNS record by ID. A static DNS record is a hostname that your network resolves to a fixed address.

  Try: “Show the details of a static DNS record.”

  Read · unifi_get_dns_record_details

• Shows app usage across the site

  Returns deep packet inspection totals by application and category.

  Try: “Which app categories use the most data?”

  Read · unifi_get_dpi_stats

• Shows one dynamic DNS entry

  Returns the full settings of one dynamic DNS entry by ID. A dynamic DNS entry is a provider entry that keeps a hostname pointed at your changing WAN address.

  Try: “Show the details of a dynamic DNS entry.”

  Read · unifi_get_dynamic_dns_entry_details

• Lists the event types you can filter by

  Returns the exact event keys the controller has seen recently, so a later events query can filter on a real key.

  Try: “What event types has my controller logged lately?”

  Read · unifi_get_event_types

• Shows one firewall group

  Returns the full settings of one firewall group by ID. A firewall group is a reusable list of addresses or ports for firewall policies.

  Try: “Show the details of a firewall group.”

  Read · unifi_get_firewall_group_details

• Shows one firewall policy

  Returns the full settings of one firewall policy by ID. A firewall policy is a zone-based rule that allows, blocks or rejects traffic.

  Try: “Show the details of a firewall policy.”

  Read · unifi_get_firewall_policy_details

• Shows firewall policy order

  Returns the order of user-defined policies for one pair of source and destination zones.

  Try: “What order do the IoT to LAN policies run in?”

  Read · unifi_get_firewall_policy_ordering

• Shows gateway security settings

  Returns gateway options such as GeoIP filtering, SYN cookies, ICMP redirects, DNS verification and NAT settings.

  Try: “Is GeoIP filtering turned on for my gateway?”

  Read · unifi_get_gateway_settings

• Shows gateway load and WAN history

  Returns bandwidth, CPU and memory history for the gateway.

  Try: “How busy was my gateway overnight?”

  Read · unifi_get_gateway_stats

• Collects event evidence for a time window

  Gathers a bounded set of event records for one incident window and reports what each source covered, so you can tell an empty result from an incomplete one.

  Try: “Collect the evidence for the outage between 2 and 3 pm.”

  Read · unifi_get_incident_evidence

• Shows intrusion detection events

  Returns intrusion detection and prevention alerts from the controller.

  Try: “Were there any IPS alerts today?”

  Read · unifi_get_ips_events

• Shows what each switch port connects to

  Returns the neighbor table a switch learned over LLDP, listing the device seen on each port.

  Try: “What is plugged into each port of the rack switch?”

  Read · unifi_get_lldp_neighbors

• Shows mDNS settings

  Returns site-wide mDNS service settings and the networks they cover.

  Try: “Is mDNS on across my VLANs?”

  Read · unifi_get_mdns_settings

• Shows device management settings

  Returns device SSH state and user name, key counts, auto-upgrade and debug tool settings. For stored secrets it reports only that they exist.

  Try: “Is SSH enabled on my devices?”

  Read · unifi_get_mgmt_settings

• Shows one NAT rule

  Returns the full settings of one NAT rule by ID. A NAT rule is a rule that rewrites source or destination addresses (DNAT, SNAT or masquerade).

  Try: “Show the details of a NAT rule.”

  Read · unifi_get_nat_rule

• Shows one network

  Returns the full settings of one network by ID. A network is a LAN or VLAN with its subnet and DHCP settings.

  Try: “Show the details of a network.”

  Read · unifi_get_network_details

• Shows health of WAN, LAN, Wi-Fi and VPN

  Returns a status for each subsystem along with counts of gateways, switches, access points and clients.

  Try: “Is my network healthy?”

  Read · unifi_get_network_health

• Shows network statistics

  Returns traffic statistics from the controller.

  Try: “Show me network statistics.”

  Read · unifi_get_network_stats

• Shows one OON policy

  Returns the full settings of one OON policy by ID. A OON policy is a policy that schedules internet access, blocks apps or limits bandwidth for chosen devices.

  Try: “Show the details of a OON policy.”

  Read · unifi_get_oon_policy_details

• Shows power strip outlets

  Returns the state of each outlet on a UniFi smart power strip, with power readings where the device reports them.

  Try: “Which outlets on the rack power strip are on?”

  Read · unifi_get_pdu_outlets

• Shows one port forward

  Returns the full settings of one port forward by ID. A port forward is a rule that sends outside traffic on a port to a device inside your network.

  Try: “Show the details of a port forward.”

  Read · unifi_get_port_forward

• Shows one switch port profile

  Returns the full settings of one switch port profile by ID. A switch port profile is a saved port setup with VLAN, isolation and PoE settings.

  Try: “Show the details of a switch port profile.”

  Read · unifi_get_port_profile_details

• Shows live switch port stats

  Returns link speed, duplex and PoE draw for each port of a switch.

  Try: “How much PoE power is the switch using per port?”

  Read · unifi_get_port_stats

• Shows one QoS rule

  Returns the full settings of one QoS rule by ID. A QoS rule is a rule that prioritizes or limits traffic for chosen devices.

  Try: “Show the details of a QoS rule.”

  Read · unifi_get_qos_rule_details

• Shows Wi-Fi channel interference

  Returns per-channel interference and utilization from the last RF scan of an access point.

  Try: “Which Wi-Fi channel is least crowded?”

  Read · unifi_get_rf_scan_results

• Shows one static route

  Returns the full settings of one static route by ID. A static route is a manual route to another network through a next hop.

  Try: “Show the details of a static route.”

  Read · unifi_get_route_details

• Shows site-wide traffic by app

  Returns real bandwidth use per application or category for the whole site.

  Try: “What are the top apps by traffic this week?”

  Read · unifi_get_site_dpi_traffic

• Shows site settings

  Returns the site name, country code, timezone and connectivity monitor settings.

  Try: “What timezone is my site set to?”

  Read · unifi_get_site_settings

• Shows SNMP settings

  Returns whether SNMP v1/v2c and v3 are on, plus the v3 user name. The community string and password come back redacted.

  Try: “Is SNMP enabled on my site?”

  Read · unifi_get_snmp_settings

• Shows past speed tests

  Returns download, upload and latency results from earlier gateway speed tests. On multi-WAN sites each connection is reported.

  Try: “What were my last speed test results?”

  Read · unifi_get_speedtest_results

• Checks a running speed test

  Reports whether a speed test started on the gateway has finished.

  Try: “Is the speed test done?”

  Read · unifi_get_speedtest_status

• Builds a support report for review

  Collects sanitized evidence about the controller for you to review before sharing. The summary comes from local data, and any live checks are limited to an approved list.

  Try: “Make a support bundle for my network.”

  Read · unifi_get_support_bundle

• Shows what a switch supports

  Returns hardware limits for a switch, such as the most ACL rules, VLANs, aggregation groups and mirror sessions it allows.

  Try: “How many ACL rules can this switch hold?”

  Read · unifi_get_switch_capabilities

• Shows port assignments on a switch

  Returns each port with its assigned profile and name.

  Try: “Which profile is on each port of the office switch?”

  Read · unifi_get_switch_ports

• Shows controller version and load

  Returns controller version, uptime, hostname, device and client counts, update availability and CPU and memory use.

  Try: “What version is my controller running, and is there an update?”

  Read · unifi_get_system_info

• Shows IDS/IPS settings

  Returns the site-wide intrusion detection and prevention mode and categories, and the traffic identification settings.

  Try: “Is intrusion prevention on?”

  Read · unifi_get_threat_management_settings

• Shows the security posture summary

  Returns the CyberSecure threat posture for an hour, day, week or month, including allowlisted gateway signatures.

  Try: “How is my threat posture this week?”

  Read · unifi_get_threat_posture

• Ranks clients by traffic

  Ranks devices by how much they sent or received in a time window. It is the first call for finding what caused an upload spike.

  Try: “Who sent the most data in the last hour?”

  Read · unifi_get_top_clients

• Summarizes traffic flows

  Returns the Flow Summary from Insights, with risk and region breakdowns.

  Try: “Summarize my traffic flows by risk.”

  Read · unifi_get_traffic_flow_statistics

• Lists recent traffic flows

  Returns completed flow records from Insights with source, destination and size.

  Try: “Show the biggest flows from the last hour and who talked to whom.”

  Read · unifi_get_traffic_flows

• Shows one traffic route

  Returns the full settings of one traffic route by ID. A traffic route is a policy-based route that sends chosen traffic out a specific connection.

  Try: “Show the details of a traffic route.”

  Read · unifi_get_traffic_route_details

• Shows one user group

  Returns the full settings of one user group by ID. A user group is a bandwidth profile with optional speed limits.

  Try: “Show the details of a user group.”

  Read · unifi_get_usergroup_details

• Shows one hotspot voucher

  Returns the full settings of one hotspot voucher by ID. A hotspot voucher is a guest access code with time and data limits.

  Try: “Show the details of a hotspot voucher.”

  Read · unifi_get_voucher_details

• Shows one VPN client

  Returns the full settings of one VPN client by ID. A VPN client is a connection from your gateway out to another VPN (WireGuard, OpenVPN and others).

  Try: “Show the details of a VPN client.”

  Read · unifi_get_vpn_client_details

• Shows one VPN server

  Returns the full settings of one VPN server by ID. A VPN server is a VPN your gateway hosts for remote users (WireGuard, OpenVPN, L2TP).

  Try: “Show the details of a VPN server.”

  Read · unifi_get_vpn_server_details

• Shows one Wi-Fi network (SSID)

  Returns the full settings of one Wi-Fi network (SSID) by ID. A Wi-Fi network (SSID) is a wireless network name with its security and band settings.

  Try: “Show the details of a Wi-Fi network (SSID).”

  Read · unifi_get_wlan_details

• Lists your MAC access rules

  Returns the MAC access rules on your controller. Each one is a layer 2 rule that decides which devices on a VLAN may talk to each other.

  Try: “Show me the MAC access rules on the IoT VLAN.”

  Read · unifi_list_acl_rules

• Shows the live routing table

  Returns the routes the device is using now, both your own and system ones.

  Try: “Show my active routing table.”

  Read · unifi_list_active_routes

• Shows active alarms

  Returns the open alarms on the controller, such as security alerts, connectivity problems and firmware warnings, each with its type and message.

  Try: “Are there any active alarms on my network?”

  Read · unifi_list_alarms

• Lists your access point groups

  Returns the access point groups on your controller. Each one is a set of access points that broadcast chosen Wi-Fi names.

  Try: “Which access points are in the Upstairs group?”

  Read · unifi_list_ap_groups

• Lists allowed Wi-Fi channels

  Returns the channels your region allows for each band, with DFS status.

  Try: “Which 5 GHz channels can I use here?”

  Read · unifi_list_available_channels

• Lists your controller backups

  Returns the controller backups on your controller. Each one is a saved copy of the controller configuration.

  Try: “List the backups on the controller.”

  Read · unifi_list_backups

• Lists blocked devices

  Returns the clients currently blocked from the network, with name and last seen time.

  Try: “Which devices are blocked right now?”

  Read · unifi_list_blocked_clients

• Lists your client groups

  Returns the client groups on your controller. Each one is a named set of devices, listed by MAC address, that policies can target.

  Try: “List my client groups.”

  Read · unifi_list_client_groups

• Lists the devices connected to your network

  Returns each client with its name, IP, MAC address, wired or wireless connection and online state. It can include offline clients that the controller remembers.

  Try: “Which devices are connected to the Guest Wi-Fi?”

  Read · unifi_list_clients

• Lists your content filter profiles

  Returns the content filter profiles on your controller. Each one is a DNS-based block list by category, with optional safe search.

  Try: “Which content filter profiles do I have set up?”

  Read · unifi_list_content_filters

• Lists your UniFi gear with status and firmware

  Returns every adopted UniFi device with model, IP, firmware, uptime, online state and whether an upgrade is waiting. Each one is tagged as an access point, switch, gateway or power unit.

  Try: “Which of my UniFi devices are offline or need a firmware update?”

  Read · unifi_list_devices

• Lists your static DNS records

  Returns the static DNS records on your controller. Each one is a hostname that your network resolves to a fixed address.

  Try: “List my static DNS records.”

  Read · unifi_list_dns_records

• Lists apps the firewall can match

  Returns the application names that firewall rules and OON policies can match on.

  Try: “Which apps can I block with DPI?”

  Read · unifi_list_dpi_applications

• Lists app categories the firewall can match

  Returns the DPI categories, such as messengers, peer-to-peer and media streaming.

  Try: “What DPI categories are available?”

  Read · unifi_list_dpi_categories

• Lists your dynamic DNS entries

  Returns the dynamic DNS entries on your controller. Each one is a provider entry that keeps a hostname pointed at your changing WAN address.

  Try: “Which dynamic DNS entries are configured?”

  Read · unifi_list_dynamic_dns

• Shows the event log

  Returns time-stamped controller events like client joins and leaves, device state changes and firmware updates. You can filter by event type and time.

  Try: “What happened on my network in the last 24 hours?”

  Read · unifi_list_events

• Lists your firewall groups

  Returns the firewall groups on your controller. Each one is a reusable list of addresses or ports for firewall policies.

  Try: “Show my firewall address groups.”

  Read · unifi_list_firewall_groups

• Lists your firewall policies

  Returns the firewall policies on your controller. Each one is a zone-based rule that allows, blocks or rejects traffic.

  Try: “List the firewall policies between the IoT and LAN zones.”

  Read · unifi_list_firewall_policies

• Lists your firewall zones

  Returns the firewall zones on your controller. Each one is a group of networks that firewall policies target.

  Try: “What firewall zones exist?”

  Read · unifi_list_firewall_zones

• Lists old-style firewall rules

  Returns firewall rules from before zone-based firewalls, for sites that still use them.

  Try: “Do I still have legacy firewall rules?”

  Read · unifi_list_legacy_firewall_rules

• Lists your NAT rules

  Returns the NAT rules on your controller. Each one is a rule that rewrites source or destination addresses (DNAT, SNAT or masquerade).

  Try: “List my NAT rules.”

  Read · unifi_list_nat_rules

• Lists your networks

  Returns the networks on your controller. Each one is a LAN or VLAN with its subnet and DHCP settings.

  Try: “List my networks and VLAN IDs.”

  Read · unifi_list_networks

• Lists your OON policies

  Returns the OON policies on your controller. Each one is a policy that schedules internet access, blocks apps or limits bandwidth for chosen devices.

  Try: “Which OON policies are active?”

  Read · unifi_list_oon_policies

• Lists your port forwards

  Returns the port forwards on your controller. Each one is a rule that sends outside traffic on a port to a device inside your network.

  Try: “List my port forwards.”

  Read · unifi_list_port_forwards

• Lists your switch port profiles

  Returns the switch port profiles on your controller. Each one is a saved port setup with VLAN, isolation and PoE settings.

  Try: “List the switch port profiles.”

  Read · unifi_list_port_profiles

• Lists your QoS rules

  Returns the QoS rules on your controller. Each one is a rule that prioritizes or limits traffic for chosen devices.

  Try: “List my QoS rules.”

  Read · unifi_list_qos_rules

• Lists neighboring Wi-Fi networks

  Returns other access points your APs detect nearby. It returns a summary page of up to 100 records unless you ask for all.

  Try: “Which neighboring access points does my network see?”

  Read · unifi_list_rogue_aps

• Lists your static routes

  Returns the static routes on your controller. Each one is a manual route to another network through a next hop.

  Try: “Show my static routes.”

  Read · unifi_list_routes

• Lists your traffic routes

  Returns the traffic routes on your controller. Each one is a policy-based route that sends chosen traffic out a specific connection.

  Try: “List my traffic routes.”

  Read · unifi_list_traffic_routes

• Lists your user groups

  Returns the user groups on your controller. Each one is a bandwidth profile with optional speed limits.

  Try: “List my user groups and their speed limits.”

  Read · unifi_list_usergroups

• Lists your hotspot vouchers

  Returns the hotspot vouchers on your controller. Each one is a guest access code with time and data limits.

  Try: “List my hotspot vouchers.”

  Read · unifi_list_vouchers

• Lists your VPN clients

  Returns the VPN clients on your controller. Each one is a connection from your gateway out to another VPN (WireGuard, OpenVPN and others).

  Try: “List my VPN clients.”

  Read · unifi_list_vpn_clients

• Lists your VPN servers

  Returns the VPN servers on your controller. Each one is a VPN your gateway hosts for remote users (WireGuard, OpenVPN, L2TP).

  Try: “List my VPN servers.”

  Read · unifi_list_vpn_servers

• Lists Wi-Fi networks

  Returns each SSID with its settings. You can filter by name text.

  Try: “List my SSIDs.”

  Read · unifi_list_wlans

• Finds the device behind an IP

  Returns the name, MAC, online state and last seen time for the client using an IP address.

  Try: “Who is 192.168.1.45?”

  Read · unifi_lookup_by_ip

• Shows the latest live events

  Reads events from a short in-memory buffer filled by a live connection to the controller, so it answers fast without a new API call.

  Try: “Show me the last few events.”

  Read · unifi_recent_events

• Explains how to follow live events

  Returns a handle and resource address that tells a client how to subscribe to the live event stream.

  Try: “How do I subscribe to live network events?”

  Read · unifi_subscribe_events

• Adopts a pending device

  Adds a new UniFi device that is waiting for adoption to your site, found by MAC address. Without confirm it only shows a preview.

  Try: “Adopt the pending switch with MAC AA:BB:CC:DD:EE:FF.”

  Write · unifi_adopt_device

• Archives one alarm

  Marks a single alarm as resolved so it stops showing as active.

  Try: “Archive the alarm about the offline camera.”

  Write · unifi_archive_alarm

• Archives every active alarm

  Marks all active alarms as resolved in one go.

  Try: “Archive all active alarms.”

  Write · unifi_archive_all_alarms

• Lets a guest onto the guest network

  Authorizes a guest device by MAC address so it can use the guest network.

  Try: “Authorize the guest phone with MAC AA:BB:CC:DD:EE:FF.”

  Write · unifi_authorize_guest

• Blocks a device from the network

  Stops a device from using the network, found by MAC address.

  Try: “Block the device with MAC AA:BB:CC:DD:EE:FF.”

  Write · unifi_block_client

• Bonds switch ports together

  Sets up link aggregation (LACP) on a switch, joining consecutive ports for more bandwidth.

  Try: “Bond ports 7 and 8 on the rack switch.”

  Write · unifi_configure_port_aggregation

• Mirrors switch port traffic

  Copies traffic from one switch port to another so you can capture it.

  Try: “Mirror port 3 to port 10.”

  Write · unifi_configure_port_mirror

• Creates a MAC access rule

  Adds a new MAC access rule, which is a layer 2 rule that decides which devices on a VLAN may talk to each other. Without confirm it returns a preview only.

  Try: “Create a MAC access rule.”

  Write · unifi_create_acl_rule

• Creates an access point group

  Adds a group that controls which access points broadcast which Wi-Fi names.

  Try: “Create an AP group called Upstairs.”

  Write · unifi_create_ap_group

• Makes a controller backup

  Creates a new backup of the controller configuration on the controller and returns its details.

  Try: “Back up the controller now.”

  Write · unifi_create_backup

• Creates a client group

  Adds a new client group, which is a named set of devices, listed by MAC address, that policies can target. Without confirm it returns a preview only.

  Try: “Create a client group.”

  Write · unifi_create_client_group

• Creates a content filter profile

  Adds a new content filter profile, which is a DNS-based block list by category, with optional safe search. Without confirm it returns a preview only.

  Try: “Create a content filter profile.”

  Write · unifi_create_content_filter

• Creates a static DNS record

  Adds a new static DNS record, which is a hostname that your network resolves to a fixed address. Without confirm it returns a preview only.

  Try: “Create a static DNS record.”

  Write · unifi_create_dns_record

• Creates a dynamic DNS entry

  Adds a new dynamic DNS entry, which is a provider entry that keeps a hostname pointed at your changing WAN address. Without confirm it returns a preview only.

  Try: “Create a dynamic DNS entry.”

  Write · unifi_create_dynamic_dns

• Creates a firewall group

  Adds a new firewall group, which is a reusable list of addresses or ports for firewall policies. Without confirm it returns a preview only.

  Try: “Create a firewall group.”

  Write · unifi_create_firewall_group

• Creates a firewall policy

  Adds a new firewall policy, which is a zone-based rule that allows, blocks or rejects traffic. Without confirm it returns a preview only.

  Try: “Create a firewall policy.”

  Write · unifi_create_firewall_policy

• Creates a firewall zone

  Adds a new firewall zone, which is a group of networks that firewall policies target. Without confirm it returns a preview only.

  Try: “Create a firewall zone.”

  Write · unifi_create_firewall_zone

• Creates a NAT rule

  Adds a new NAT rule, which is a rule that rewrites source or destination addresses (DNAT, SNAT or masquerade). Without confirm it returns a preview only.

  Try: “Create a NAT rule.”

  Write · unifi_create_nat_rule

• Creates a network

  Adds a new network, which is a LAN or VLAN with its subnet and DHCP settings. Without confirm it returns a preview only.

  Try: “Create a network.”

  Write · unifi_create_network

• Creates a OON policy

  Adds a new OON policy, which is a policy that schedules internet access, blocks apps or limits bandwidth for chosen devices. Without confirm it returns a preview only.

  Try: “Create a OON policy.”

  Write · unifi_create_oon_policy

• Creates a port forward

  Adds a port forwarding rule using the full set of fields, checked against a schema.

  Try: “Forward TCP 443 to my web server.”

  Write · unifi_create_port_forward

• Creates a switch port profile

  Adds a new switch port profile, which is a saved port setup with VLAN, isolation and PoE settings. Without confirm it returns a preview only.

  Try: “Create a switch port profile.”

  Write · unifi_create_port_profile

• Creates a QoS rule

  Adds a new QoS rule, which is a rule that prioritizes or limits traffic for chosen devices. Without confirm it returns a preview only.

  Try: “Create a QoS rule.”

  Write · unifi_create_qos_rule

• Creates a static route

  Adds a new static route, which is a manual route to another network through a next hop. Without confirm it returns a preview only.

  Try: “Create a static route.”

  Write · unifi_create_route

• Creates a port forward from a short form

  Adds a port forward using a simplified set of fields.

  Try: “Forward port 8080 to 192.168.1.30.”

  Write · unifi_create_simple_port_forward

• Creates a QoS rule from a short form

  Adds a QoS rule using a simplified set of fields.

  Try: “Limit the guest network to 10 Mbps.”

  Write · unifi_create_simple_qos_rule

• Creates a traffic route

  Adds a new traffic route, which is a policy-based route that sends chosen traffic out a specific connection. Without confirm it returns a preview only.

  Try: “Create a traffic route.”

  Write · unifi_create_traffic_route

• Creates a user group

  Adds a new user group, which is a bandwidth profile with optional speed limits. Without confirm it returns a preview only.

  Try: “Create a user group.”

  Write · unifi_create_usergroup

• Creates guest vouchers

  Makes one or more hotspot vouchers with time, data and speed limits.

  Try: “Create 5 vouchers that last 24 hours.”

  Write · unifi_create_voucher

• Creates a Wi-Fi network (SSID)

  Adds a new Wi-Fi network (SSID), which is a wireless network name with its security and band settings. Without confirm it returns a preview only.

  Try: “Create a Wi-Fi network (SSID).”

  Write · unifi_create_wlan

• Re-pushes config to a device

  Sends the controller current configuration to a device again.

  Try: “Force provision the hallway access point.”

  Write · unifi_force_provision_device

• Kicks a client so it reconnects

  Disconnects a client so that it has to join the network again.

  Try: “Kick my TV so it reconnects.”

  Write · unifi_force_reconnect_client

• Blinks a device to find it

  Turns locate mode on or off so the device LED blinks and you can find it.

  Try: “Make the garage switch blink.”

  Write · unifi_locate_device

• Power cycles a PoE port

  Briefly cuts PoE power on a switch port, which restarts whatever is plugged in.

  Try: “Power cycle port 5 on the office switch.”

  Write · unifi_power_cycle_port

• Reboots a device

  Restarts a UniFi device by MAC address. Clients on it lose connection for a short time.

  Try: “Reboot the hallway access point.”

  Write · unifi_reboot_device

• Renames a client

  Changes the display name of a client in the controller.

  Try: “Rename this device to Living Room TV.”

  Write · unifi_rename_client

• Renames a UniFi device

  Changes the name of a UniFi device in the controller.

  Try: “Rename the switch to Rack Switch.”

  Write · unifi_rename_device

• Reorders firewall policies

  Sets a new order for the user-defined policies between two zones. You pass the full ordered list.

  Try: “Move the block rule above the allow rule.”

  Write · unifi_reorder_firewall_policies

• Pins a client to one access point

  Turns a wireless client fixed access point setting on or off. Turning it on needs the MAC of the access point.

  Try: “Keep the printer on the hallway access point.”

  Write · unifi_set_client_fixed_ap

• Sets a fixed IP or local DNS name

  Assigns a fixed IP address or a local DNS record to a client.

  Try: “Give the NAS the fixed IP 192.168.1.20.”

  Write · unifi_set_client_ip_settings

• Sets a device LED

  Forces a device LED on or off, or back to the site default.

  Try: “Turn off the LED on the bedroom access point.”

  Write · unifi_set_device_led

• Turns jumbo frames on or off

  Enables or disables jumbo frames on a switch.

  Try: “Enable jumbo frames on the storage switch.”

  Write · unifi_set_jumbo_frames

• Switches a power strip outlet

  Turns an outlet on or off on a UniFi smart power strip and can set its cycle option. Whatever is plugged in loses power.

  Try: “Turn off outlet 3 on the rack power strip.”

  Write · unifi_set_outlet_state

• Turns all device LEDs on or off

  Changes the site-wide LED setting for every device.

  Try: “Turn off all device LEDs at night.”

  Write · unifi_set_site_leds

• Assigns a profile to a switch port

  Sets the port profile for one switch port. It sends the full set of port overrides for the switch, so check the preview.

  Try: “Put port 4 on the IoT profile.”

  Write · unifi_set_switch_port_profile

• Disables or enables a device

  Turns a device off or on without removing it. A disabled device stays adopted but stops passing traffic.

  Try: “Disable the spare access point.”

  Write · unifi_toggle_device

• Turns a firewall policy on or off

  Enables or disables one firewall policy by ID.

  Try: “Disable the policy that blocks IoT from the LAN.”

  Write · unifi_toggle_firewall_policy

• Turns a NAT rule on or off

  Sets a manual NAT rule to enabled or disabled. Setting the current state does nothing.

  Try: “Enable NAT rule 5.”

  Write · unifi_toggle_nat_rule

• Turns an OON policy on or off

  Flips an OON policy between enabled and disabled.

  Try: “Switch off the bedtime policy tonight.”

  Write · unifi_toggle_oon_policy

• Turns a port forward on or off

  Switches an existing port forward on or off.

  Try: “Disable the SSH port forward.”

  Write · unifi_toggle_port_forward

• Turns a QoS rule on or off

  Enables or disables one QoS rule by ID.

  Try: “Disable the streaming QoS rule.”

  Write · unifi_toggle_qos_rule_enabled

• Turns a traffic route on or off

  Enables or disables a traffic route. Enabling an internet route needs one named client target.

  Try: “Disable the VPN traffic route.”

  Write · unifi_toggle_traffic_route

• Turns a Wi-Fi network on or off

  Switches an SSID on or off.

  Try: “Turn off the guest Wi-Fi.”

  Write · unifi_toggle_wlan

• Starts a Wi-Fi spectrum scan

  Starts an RF scan on an access point. The scan takes 5 to 10 minutes.

  Try: “Run an RF scan on the living room access point.”

  Write · unifi_trigger_rf_scan

• Starts a speed test

  Starts a speed test on the gateway and returns at once. Check progress with the status tool.

  Try: “Run a speed test.”

  Write · unifi_trigger_speedtest

• Revokes a guest authorization

  Removes a guest device access to the guest network by MAC address.

  Try: “Revoke guest access for this phone.”

  Write · unifi_unauthorize_guest

• Unblocks a device

  Lifts a block on a previously blocked device.

  Try: “Unblock the laptop I blocked earlier.”

  Write · unifi_unblock_client

• Changes a MAC access rule

  Changes an existing MAC ACL rule. Only the fields you give are changed.

  Try: “Disable the ACL rule on the IoT VLAN.”

  Write · unifi_update_acl_rule

• Changes an access point group

  Changes the members or Wi-Fi names of an AP group.

  Try: “Add the new access point to Upstairs.”

  Write · unifi_update_ap_group

• Changes auto-backup settings

  Changes the schedule, retention or cloud backup option for automatic backups. Only the fields you give are changed.

  Try: “Keep the last 10 automatic backups.”

  Write · unifi_update_autobackup_settings

• Changes a client group

  Changes the name or members of a client group.

  Try: “Add the new tablet to the Kids group.”

  Write · unifi_update_client_group

• Changes a content filter profile

  Changes blocked categories or client targets of a profile.

  Try: “Add gambling to the blocked categories.”

  Write · unifi_update_content_filter

• Changes radio settings on a device

  Changes channel, power or other radio settings for one band on an access point or Wi-Fi gateway.

  Try: “Set the 5 GHz radio on the hallway AP to channel 44.”

  Write · unifi_update_device_radio

• Changes a DNS record

  Changes an existing static DNS record.

  Try: “Point nas.home at 192.168.1.20.”

  Write · unifi_update_dns_record

• Changes a dynamic DNS entry

  Changes an existing dynamic DNS provider entry.

  Try: “Update the dynamic DNS hostname.”

  Write · unifi_update_dynamic_dns

• Changes a firewall group

  Changes the members or name of an address or port group.

  Try: “Add 10.0.5.20 to the camera address group.”

  Write · unifi_update_firewall_group

• Changes a firewall policy

  Changes fields of a zone-based policy, such as name, action, source, destination and ports. Only the fields you give are changed.

  Try: “Change the IoT policy action from allow to block.”

  Write · unifi_update_firewall_policy

• Renames a firewall zone

  Changes the name of a firewall zone. Network membership is not changed here.

  Try: “Rename the IoT zone to Smart Home.”

  Write · unifi_update_firewall_zone

• Changes gateway settings

  Updates gateway options such as security and NAT settings. Only the fields you give are changed.

  Try: “Turn on GeoIP filtering on the gateway.”

  Write · unifi_update_gateway_settings

• Changes mDNS settings

  Changes the site-wide mDNS mode and which services are allowed across networks.

  Try: “Allow mDNS between the LAN and IoT networks.”

  Write · unifi_update_mdns_settings

• Changes a NAT rule

  Changes a manual NAT rule and re-reads it to confirm. Only the fields you give are changed.

  Try: “Change the NAT rule translated port.”

  Write · unifi_update_nat_rule

• Changes a network or VLAN

  Changes fields of an existing LAN or VLAN. Only the fields you give are changed.

  Try: “Change the DHCP range on the IoT VLAN.”

  Write · unifi_update_network

• Changes an OON policy

  Changes the schedule, targets or limits of an OON policy.

  Try: “Move bedtime to 9 pm.”

  Write · unifi_update_oon_policy

• Changes a port forward

  Changes fields of an existing port forward. Only the fields you give are changed.

  Try: “Change the forward target to 192.168.1.31.”

  Write · unifi_update_port_forward

• Changes a switch port profile

  Changes an existing port profile. Only the fields you give are changed.

  Try: “Set the camera profile to PoE on.”

  Write · unifi_update_port_profile

• Changes a QoS rule

  Changes fields of an existing QoS rule.

  Try: “Raise the limit on the video call rule.”

  Write · unifi_update_qos_rule

• Changes a static route

  Changes the name, destination, next hop, distance or enabled state of a static route.

  Try: “Change the next hop of the lab route.”

  Write · unifi_update_route

• Changes SNMP settings

  Turns SNMP v1/v2c or v3 on or off and sets the community string, user name or password.

  Try: “Turn off SNMP v1.”

  Write · unifi_update_snmp_settings

• Changes spanning tree settings

  Sets the spanning tree (STP) configuration for a switch, including its priority.

  Try: “Set the core switch STP priority to 4096.”

  Write · unifi_update_switch_stp

• Changes IDS/IPS settings

  Changes the site-wide intrusion prevention mode and categories or the traffic identification settings, then checks the result stuck.

  Try: “Set intrusion prevention to detect only.”

  Write · unifi_update_threat_management_settings

• Changes a traffic route

  Changes the settings of a traffic route.

  Try: “Change which clients use the VPN route.”

  Write · unifi_update_traffic_route

• Changes a user group

  Renames a user group or changes its bandwidth limits. Use -1 for unlimited.

  Try: “Cap the guest user group at 20 Mbps down.”

  Write · unifi_update_usergroup

• Turns a VPN client on or off

  Enables or disables one VPN client by ID.

  Try: “Turn off the work VPN client.”

  Write · unifi_update_vpn_client_state

• Changes a WireGuard server public address

  Sets or clears the alternate hostname or IPv4 address a WireGuard server advertises.

  Try: “Set the WireGuard server address to vpn.example.com.”

  Write · unifi_update_vpn_server_alternate_address

• Turns a VPN server on or off

  Enables or disables one VPN server by ID.

  Try: “Turn off the WireGuard server.”

  Write · unifi_update_vpn_server_state

• Changes a Wi-Fi network

  Changes the settings of an SSID. Only the fields you give are changed.

  Try: “Change the guest Wi-Fi password.”

  Write · unifi_update_wlan

• Starts a firmware upgrade

  Begins a firmware upgrade on a device, using cached firmware by default.

  Try: “Upgrade the firmware on the garage switch.”

  Write · unifi_upgrade_device

• Deletes a MAC access rule

  Permanently deletes a MAC access rule by ID. Other settings that use it can be affected.

  Try: “Delete a MAC access rule.”

  Delete · unifi_delete_acl_rule

• Deletes a access point group

  Permanently deletes a access point group by ID. Other settings that use it can be affected.

  Try: “Delete a access point group.”

  Delete · unifi_delete_ap_group

• Deletes a controller backup

  Deletes a named backup file from the controller.

  Try: “Delete the oldest backup.”

  Delete · unifi_delete_backup

• Deletes a client group

  Permanently deletes a client group by ID. Other settings that use it can be affected.

  Try: “Delete a client group.”

  Delete · unifi_delete_client_group

• Deletes a content filter profile

  Permanently deletes a content filter profile by ID. Other settings that use it can be affected.

  Try: “Delete a content filter profile.”

  Delete · unifi_delete_content_filter

• Deletes a static DNS record

  Permanently deletes a static DNS record by ID. Other settings that use it can be affected.

  Try: “Delete a static DNS record.”

  Delete · unifi_delete_dns_record

• Deletes a dynamic DNS entry

  Permanently deletes a dynamic DNS entry by ID. Other settings that use it can be affected.

  Try: “Delete a dynamic DNS entry.”

  Delete · unifi_delete_dynamic_dns

• Deletes a firewall group

  Permanently deletes a firewall group by ID. Other settings that use it can be affected.

  Try: “Delete a firewall group.”

  Delete · unifi_delete_firewall_group

• Deletes a firewall policy

  Permanently deletes a firewall policy by ID. Other settings that use it can be affected.

  Try: “Delete a firewall policy.”

  Delete · unifi_delete_firewall_policy

• Deletes a firewall zone

  Permanently deletes a firewall zone by ID. Other settings that use it can be affected.

  Try: “Delete a firewall zone.”

  Delete · unifi_delete_firewall_zone

• Deletes a NAT rule

  Permanently deletes a NAT rule by ID. Other settings that use it can be affected.

  Try: “Delete a NAT rule.”

  Delete · unifi_delete_nat_rule

• Deletes a network

  Permanently deletes a network by ID. Other settings that use it can be affected.

  Try: “Delete a network.”

  Delete · unifi_delete_network

• Deletes a OON policy

  Permanently deletes a OON policy by ID. Other settings that use it can be affected.

  Try: “Delete a OON policy.”

  Delete · unifi_delete_oon_policy

• Deletes a port forward

  Permanently deletes a port forward by ID. Other settings that use it can be affected.

  Try: “Delete a port forward.”

  Delete · unifi_delete_port_forward

• Deletes a switch port profile

  Permanently deletes a switch port profile by ID. Other settings that use it can be affected.

  Try: “Delete a switch port profile.”

  Delete · unifi_delete_port_profile

• Deletes a VPN client

  Permanently deletes a VPN client by ID. Other settings that use it can be affected.

  Try: “Delete a VPN client.”

  Delete · unifi_delete_vpn_client

• Deletes a Wi-Fi network (SSID)

  Permanently deletes a Wi-Fi network (SSID) by ID. Other settings that use it can be affected.

  Try: “Delete a Wi-Fi network (SSID).”

  Delete · unifi_delete_wlan

• Erases a client from history

  Deletes the controller record of a known client, including its name, notes, fixed IP and history. The device shows up as new if it connects again.

  Try: “Forget the old tablet with MAC AA:BB:CC:DD:EE:FF.”

  Delete · unifi_forget_client

• Revokes a hotspot voucher

  Deletes a voucher so it can no longer be used.

  Try: “Revoke voucher 12345-67890.”

  Delete · unifi_revoke_voucher

• Runs several Network tools at once

  Starts a group of tool calls in parallel and returns job IDs. Each call carries the effects of its tool.

  Try: “Run system info, network health and the device list together.”

  Runs code · unifi_batch

• Runs any Network tool by name

  Runs the tool you name with the arguments you give. It has the effects of that tool, so changes still go through the policy gates and the confirm step.

  Try: “Use unifi_execute to list my firewall policies.”

  Runs code · unifi_execute

• Used by the assistant behind the scenes

  Checks a batch of tool calls

  Returns the status of a batch started earlier, with the result or the error once it finishes.

  Try: “Is my batch finished?”

  Read · unifi_batch_status

• Lists the Network tools by group

  Returns a compact index of the Network tools so the assistant can pick one without loading them all.

  Try: “What Network tools can you use for firewalls?”

  Read · unifi_tool_index

• Loads more tools into the session

  Loads a chosen group of Network tools so the client can call them directly. The tool list in the client then changes.

  Try: “Load the firewall tools.”

  Runs code · unifi_load_tools

Watch out for

• It can delete firewall rules, networks and Wi-Fi

  Nineteen tools delete or erase things, including firewall policies and zones, networks, SSIDs, VPN clients, backups and client history. Set UNIFI_POLICY_NETWORK_DELETE=false if you do not need deletes, or UNIFI_NETWORK_READ_ONLY=true to block all changes. github.com

• A wrong change can cut you off from your network

  The tools change firewall, VLAN, Wi-Fi, VPN and gateway settings, and can reboot, upgrade, disable or power-cycle devices. Deleting a Wi-Fi network disconnects every device on it. Our advice: take a backup first and read each preview before you confirm. github.com

• Your admin login sits in the client config

  The controller address and a local admin username and password are set as environment variables. Use a dedicated admin account for the assistant. github.com

• The run and batch tools can call any other tool

  The execute and batch tools run whatever tool they name. Approving one means approving the tool and arguments inside it, so check them. github.com

• Confirmation can be switched off

  Setting UNIFI_TOOL_PERMISSION_MODE=bypass or UNIFI_NETWORK_TOOL_PERMISSION_MODE=bypass applies every change that policy allows without a preview. The deprecated UNIFI_AUTO_CONFIRM=true does the same. Leave these unset unless you run unattended automation. github.com

• Your network details go to your AI app

  Client names, MAC and IP addresses, traffic flows and firewall rules are passed to the assistant you use. Pick an app you trust with that data. github.com

• Secrets are hidden unless you turn that off

  Wi-Fi passphrases, VPN keys, SNMP strings and device SSH credentials are redacted by default. Setting UNIFI_NETWORK_REDACT_SENSITIVE_FIELDS=false returns them raw. github.com

• The optional web mode has no sign-in by default

  The server uses stdio by default. If you turn on its HTTP mode it binds 127.0.0.1, and anything that can reach it can call the tools unless you set the bearer token. github.com

• Gate names by category

  Variables follow UNIFI_POLICY_NETWORK_<CATEGORY>_<ACTION>, for example UNIFI_POLICY_NETWORK_FIREWALL_POLICIES_DELETE, UNIFI_POLICY_NETWORK_WLANS_DELETE and UNIFI_POLICY_NETWORK_NETWORKS_UPDATE. The shorthand names in the tool manifest, such as client_group, are never read. github.com

Security advisories