Network & Infrastructure

Live

UniFi Network MCP server

Read-only visibility into a UniFi deployment, plus one carefully fenced RF write.

Connect UniFi Network All connectors

Tools: 25
Read-only: 23
Write: 2; Off by default
Destructive: 2; Flagged distinctly

What it does

UniFi Network through an assistant

Sites, devices, clients, Wi-Fi and WAN health, switch ports, events and firmware status -- enough to answer "what is actually wrong right now" without opening the controller. Every tool but one is read-only, and you choose which sites a connection may reach before any of them run. The exception is AP radio config: channel, width and transmit power only, snapshotted before the change and auto-reverting unless you confirm it.

Site inventory and site health, including WAN status and alert counts
Device inventory, offline-device detection and firmware update status
Client lookup by name, MAC or IP, with per-client signal and RF stats
Top bandwidth users over a bounded window, and recent events by severity
Switch port link speed, PoE state and error counters
Change an AP's channel, width or transmit power, with automatic revert (opt-in)

Ask your assistant

What people actually ask

Real questions, answered from live UniFi Network data.

“Which UniFi sites do I have connected, and are any of them unhealthy?”

unifi_list_sitesunifi_get_site_health

“Which access point has the most clients, and are any clients on a weak signal?”

unifi_get_wireless_client_stats

“Who are the top 5 bandwidth users on the guest network in the last hour?”

unifi_get_top_bandwidth_clients

Tool catalogue

25 UniFi Network tools

Grouped by what they touch. Every tool is individually toggleable — you expose only what you want.

RF & radio

7 tools5 read-only · 2 write

Showing 7 of 7 tools

unifi_confirm_radio_config
Read-only
[API: Local] Cancels the pending auto-revert for a radio config change made with unifi_set_radio_config and marks it permanent. Errors if the revision has no pending auto-revert (already confirmed, already reverted, or auto_revert was false when it was made) or if the auto-revert already fired. Requires the read-advanced permission profile AND local API access to be explicitly configured for this connection.
unifi_get_radio_config
Read-only
[API: Local] Read-only. Current channel, channel width, and tx power mode/value for every radio on a UniFi AP (or every AP on a site if device_mac is omitted), with device names resolved. Use this to plan a change before calling unifi_set_radio_config, and to verify one afterward without a mutating call. Requires the read-advanced permission profile AND local API access to be explicitly configured for this connection.
unifi_get_wireless_client_stats
Read-only
[API: Local] Per-client wireless RF telemetry via local controller API access — which AP each client is actually on, band and channel, signal strength, and connection rate. The Integration API's client list has no equivalent data (ap_mac and ssid are always null there, and it has no signal field at all) — this is the only way to answer 'is this device on a weak signal / is this a coverage gap / which AP is over-loaded'. IMPORTANT — signal vs rssi are NOT the same scale and are commonly confused: `signal` is the actual measured strength in dBm (e.g. -62, more negative is weaker) — use this for any single dBm figure. `rssi` is a UniFi-computed value in dB ABOVE A NOMINAL NOISE FLOOR (e.g. 44, higher is stronger) and is not comparable to `signal` or to the separately-reported `noise` field. Requires the read-advanced permission profile AND local API access to be explicitly configured for this connection. Snapshot semantics: the underlying stat/sta endpoint reports only currently-associated clients, polled at call time — it is not a stable census, and a site with clients that connect/disconnect frequently (motion-triggered cameras, phones leaving a building) will show a different total on every call; do not treat one sample as authoritative, and it will often diverge from unifi_list_clients's Integration-API inventory count, which is expected rather than a bug. With include_summary=true, adds a derived rollup: client count per AP (resolved to AP name when available), client count per band, an RSSI histogram in 10dBm buckets from -90 to -30 using `signal`, and a count of clients at or below -75dBm (roaming/coverage-gap candidates). Returns a clear error if local API access hasn't been set up.
unifi_list_pending_reverts
Read-only
[API: Local] Lists every armed auto-revert, still-retrying revert failure, and drift-skipped revert across the connection (or one site, if site_id is given) — device, radio, what changed, when it reverts, and the retry state of any failure. Requires the read-advanced permission profile AND local API access to be explicitly configured for this connection.
unifi_list_radio_revisions
Read-only
[API: Local] Newest-first history of radio config changes for a site (or one device, if device_mac is given) — what changed, when, whether the post-write readback confirmed it took effect, and its current state (armed / confirmed / auto_reverted / manually_reverted / revert_failed / revert_skipped_drift). A revert is its own revision here too, cross-linked to the one it restored, so the full chain of a device's radio history is visible in one list. Requires the read-advanced permission profile AND local API access to be explicitly configured for this connection.
unifi_revert_radio_config
Write
Destructive
[API: Local] MUTATING. Restores a radio to the state recorded in a prior revision — the same deauth side effect as unifi_set_radio_config, since it is itself a radio config write. Reverting creates a NEW revision capturing what the radio looked like immediately before the revert, so a revert can itself be undone; the original revision is marked reverted and cross-linked to the new one. Refuses if the radio's live config has drifted from what that revision recorded as its result — e.g. someone changed it in the UniFi UI since — and names the drifted fields; pass force: true to override and revert anyway, which will discard that drift. Requires confirm: true, the read-advanced permission profile, and local API access to be explicitly configured for this connection.
unifi_set_radio_config
Write
Destructive
[API: Local] MUTATING. Changes an AP radio's channel, channel width, and/or tx power — restricted to exactly those fields; enabling/disabling a radio, SSID/WLAN config, and anything on a gateway or switch are out of scope and refused. The radio restarts to apply the change: every client on it deauthenticates and re-associates, which can take several minutes for battery-powered or sleeping devices (cameras, sensors) to complete — an immediate client count afterward is not a reliable health signal. Every prior state is snapshotted to a revision BEFORE any write is attempted, and by default (auto_revert: true, auto_revert_minutes: 10) the change automatically reverts unless confirmed within that window with unifi_confirm_radio_config — pass auto_revert: false only when you mean the change to be permanent immediately with no safety net. Refuses if this device+radio already has an unresolved pending change (names the blocking revision). Requires confirm: true (a bare call with confirm omitted or false is refused, precisely because of the deauth side effect) and the read-advanced permission profile AND local API access to be explicitly configured for this connection.

Site health

4 tools4 read-only · 0 write

Showing 4 of 4 tools

unifi_get_offline_devices
Read-only
[API: Integration] List devices on a UniFi site that are currently offline.
unifi_get_site_health
Read-only
[API: Integration (derived)] Get a ServeMCP-computed health rollup for a UniFi site (online/offline device counts, connected client count) derived from device and client inventory — the UniFi Integration API has no native site-health endpoint, so this is not a raw controller-reported score.
unifi_get_wan_health
Read-only
[API: Local] Get a real WAN health summary (ISP name, WAN IP, latency, availability, uptime, current throughput, and per-monitor ping/DNS results) for a UniFi site via local controller API access. The Integration API has no equivalent endpoint at all, so this returns UNIFI_UNSUPPORTED_OPERATION if local API access isn't configured for this connection — requires the read-advanced permission profile. Dropped-packet count is not available from this endpoint and is always null.
unifi_get_wifi_health
Read-only
[API: Local] Get a real Wi-Fi health summary (access point counts, connected/guest client counts, status) for a UniFi site via local controller API access. The Integration API has no equivalent endpoint at all, so this returns UNIFI_UNSUPPORTED_OPERATION if local API access isn't configured for this connection — requires the read-advanced permission profile.

Clients

3 tools3 read-only · 0 write

Showing 3 of 3 tools

unifi_find_client
Read-only
[API: Integration] Find a client by name, MAC address, or IP address on a UniFi site.
unifi_get_client
Read-only
[API: Integration] Get details for a single client device on a UniFi site.
unifi_list_clients
Read-only
[API: Integration] List client devices connected to a UniFi site, optionally filtered by connection type or online status. Inventory only — this always returns ap_mac: null, ssid: null, and no signal/RSSI field at all (confirmed against the live API), so it cannot answer which AP a client is on or how strong its signal is. For per-client RF telemetry (AP association, band, channel, signal strength), use unifi_get_wireless_client_stats instead, which requires local API access.

Devices

2 tools2 read-only · 0 write

Showing 2 of 2 tools

unifi_get_device
Read-only
[API: Integration] Get details for a single UniFi device.
unifi_list_devices
Read-only
[API: Integration] List network devices (APs, switches, gateways) at a UniFi site.

Traffic & WAN

2 tools2 read-only · 0 write

Showing 2 of 2 tools

unifi_get_throughput_history
Read-only
[API: Local] Get historical throughput (bytes transferred over time, at 5-minute or daily granularity) for a UniFi site or a single device, via local controller API access. Requires the read-advanced permission profile AND local API access to be explicitly configured for this connection. Device-level queries can return two rows per timestamp — one labeled 'device' (general/aggregate counters) and one labeled 'wan' (specifically the WAN interface) — this is intentional interface-level detail, not duplicated data. Field names for the underlying report are the least-documented part of the UniFi local API — returns whatever throughput-shaped metrics the controller actually provides rather than a fixed set. Returns a clear error if local API access hasn't been set up.
unifi_get_top_bandwidth_clients
Read-only
[API: Integration (derived)] Get the highest-bandwidth-consuming clients on a UniFi site based on current-session traffic counters (the UniFi Integration API has no historical time-range query, so this reflects current usage, not a bounded past window). Requires the read-advanced permission profile. Returns UNIFI_UNSUPPORTED_OPERATION if the controller doesn't expose per-client traffic counters — if that happens, try unifi_get_throughput_history instead, which uses local API access and does have historical data.

Events & alerts

1 tool1 read-only · 0 write

Showing 1 of 1 tools

unifi_get_recent_events
Read-only
[API: Local] Get recent events (WAN transitions, link flaps, reconnects, and more) for a UniFi site over a time range, via local controller API access. The Integration API has no events endpoint at all, so this returns UNIFI_UNSUPPORTED_OPERATION if local API access isn't configured for this connection — requires the read-advanced permission profile. Also returns UNIFI_UNSUPPORTED_OPERATION on some newer Network application versions where this endpoint has been relocated or removed.

More tools

6 tools6 read-only · 0 write

Showing 6 of 6 tools

unifi_get_alarms
Read-only
[API: Local] Get system-generated alarms for a UniFi site over a time range (distinct from the general event log — alarms are explicit alerts like WAN disconnects) via local controller API access. Requires the read-advanced permission profile AND local API access to be explicitly configured for this connection. Returns a clear error if local API access hasn't been set up, and also returns UNIFI_UNSUPPORTED_OPERATION on some newer Network application versions where this endpoint has been relocated or removed.
unifi_get_firmware_status
Read-only
[API: Integration] Get firmware version and update-available status for devices on a UniFi site. Requires the read-advanced permission profile.
unifi_get_port_stats
Read-only
[API: Local] Get port-level statistics for a UniFi device — link speed, duplex, up/down state, rx/tx error counters, and device uptime (so error counts can be read as a rate, not just a raw total) — including which port is WAN-facing on a gateway, if determinable. Requires the read-advanced permission profile AND local API access to be explicitly configured for this connection (a separate, higher-privilege credential from the main connection — see the connection's settings). Returns a clear error if local API access hasn't been set up.
unifi_list_sites
Read-only
[API: Integration] List UniFi sites authorized for this connection.
unifi_list_switch_ports
Read-only
[API: Unsupported] Attempts to list switch ports for a UniFi switch device. Not currently supported regardless of credentials — the per-device endpoint it depends on requires an identifier the device list never exposes, on either API. This tool always returns UNIFI_UNSUPPORTED_OPERATION and is kept for forward compatibility if Ubiquiti exposes device IDs in a future API version. Use unifi_get_port_stats instead, which gets the same data via a different local-API endpoint that does work.
unifi_search
Read-only
[API: Integration] Search devices and/or clients on a UniFi site by name, MAC, or IP address. Requires the read-advanced permission profile.

Every tool name and description, machine-readable: /llms-full.txt

Access & safety

You decide what it can touch

The same model applies to every connector, and it defaults closed.

Your own credential

You supply your own UniFi Network key, scoped however you like on their side. It is encrypted with AES-256-GCM and never returned by any API response or tool call.

Writes off by default

A new connection switches on a read-oriented default set only. Every write tool must be enabled deliberately before any client can call it.

Roles enforced server-side

READ, WRITE and ADMIN gate tool invocation on the server, not just in the UI. A READ member's token is refused any write tool.

Setup

Connect UniFi Network in minutes

No infrastructure to run. Copy one URL and one token into your client.

1Create a free workspace and connect UniFi Network.
2Choose which tools to expose — writes stay off until you enable them.
3Copy your MCP endpoint URL and bearer token.
4Paste them into Claude, Cursor, or any MCP client.

claude_desktop_config.json

{
  "mcpServers": {
    "serve-mcp": {
      "url": "https://servemcp.com/api/mcp/your-workspace",
      "transport": "http",
      "headers": {
        "Authorization": "Bearer smcp_..."
      }
    }
  }
}