UniFi Gateway

Create a static next-hop route. Side effects: - Adds a destination-based route: traffic to ``destination`` is sent to ``next_hop`` instead of following the default route. Takes effect immediately on the gateway's routing table. - Mutates controller state. Use dry_run=True to preview the change without applying. BLAST RADIUS: a static route changes where traffic for the destination prefix is sent. A wrong next-hop can black-hole that prefix. It does not affect traffic outside ``destination``. Example: create_route(name="Lab via firewall", destination="10.99.0.0/24", next_hop="192.168.1…

Reserve a fixed IP for a client by MAC. Side effects: - Adds a fixed-IP entry on the user object so ``mac`` always receives ``ip`` from the controller's DHCP server. The next DHCP renewal for that client picks up the reservation. - The IP must fall inside the network's subnet or the controller will reject the request. - Mutates controller state. Use dry_run=True to preview the change without applying. Example: create_static_dhcp_lease(mac="aa:bb:cc:00:00:01", ip="10.50.0.10", network_id="65f...", name="cameras-nvr") Args: mac: Client MAC address (e.g. ``"aa:bb:cc:00:00:01"``). …

Create a v2 traffic rule from a full rule object. Side effects: - Adds a new app/domain/IP allow-or-block policy that takes effect immediately on matching traffic. - Mutates controller state. Use dry_run=True to preview the change without applying. The v2 traffic-rule schema is rich and version-dependent, so this tool takes the full rule object as a dict rather than fixed parameters. Build it from a ``get_traffic_rule_details`` example on a similar rule, or from the UniFi UI's network inspector. Example: create_traffic_rule(rule={"action": "BLOCK", "matching_target": "INTERNET", "target…

Create a VLAN-tagged network on the controller. Side effects: - Adds a new network record with the given VLAN ID, IP subnet, and DHCP scope. The first usable address (.1) becomes the gateway. - Mutates controller state. Use dry_run=True to preview the change without applying. Example: create_vlan(name="iot", vlan_id=50, subnet="10.50.0.0/24") Args: name: Network display name (e.g. ``"iot"``, ``"cameras"``). vlan_id: 802.1Q VLAN ID, 2-4094. subnet: Subnet in either gateway-IP form (``"10.50.0.1/24"``, what the UniFi controller stores) or network form (``"10.50…

Create a WiFi SSID bound to an existing network/VLAN. Side effects: - Adds a new WLAN record. Access points start broadcasting the SSID within seconds of the apply. - Mutates controller state. Use dry_run=True to preview the change without applying. AP-group binding: - UniFi controllers reject ``POST /rest/wlanconf`` with ``api.err.ApGroupMissing`` when ``ap_group_ids`` is absent. When ``ap_group_ids`` is unset, this tool calls ``list_ap_groups`` and uses the controller's "default" group automatically. Pass an explicit list to broadcast only on specific groups. Example: create_w…

Preview deletion of a content-filtering profile. This tool does not delete on its own. It returns a preview envelope with a ``token``; call ``confirm_destructive_action(token)`` to commit the delete. Tokens expire after 5 minutes. Side effects: - None until ``confirm_destructive_action`` runs against the token. - On confirm: removes the profile. The clients and networks in its scope stop being filtered by it and fall back to whatever other profile (or none) applies. - ``dry_run=True`` returns the legacy ``would_delete`` envelope with no token: purely informational, no commit step possi…

Preview deletion of a Dynamic DNS config. This tool does not delete on its own. It returns a preview envelope with a ``token``; call ``confirm_destructive_action(token)`` to commit the delete. Tokens expire after 5 minutes. Side effects: - None until ``confirm_destructive_action`` runs against the token. - On confirm: removes the DDNS config. The provider stops receiving updates from the gateway; the external hostname goes stale once its TTL lapses. - ``dry_run=True`` returns the legacy ``would_delete`` envelope with no token: purely informational, no commit step possible. Example: de…

Preview deletion of a firewall group. This tool no longer deletes on its own. It returns a preview envelope with a ``token``; call ``confirm_destructive_action(token)`` to commit the delete. Tokens expire after 5 minutes. Side effects: - None until ``confirm_destructive_action`` runs against the token. - On confirm: removes the group. **The controller rejects deletion of a group still referenced by any firewall rule** — detach it from every rule first. - ``dry_run=True`` returns the legacy ``would_delete`` envelope with no token — purely informational, no commit step possible. Example…

Preview deletion of a Zone-Based Firewall policy you created. This tool does not delete on its own. It returns a preview envelope with a ``token``; call ``confirm_destructive_action(token)`` to commit the delete. Tokens expire after 5 minutes. Side effects: - None until ``confirm_destructive_action`` runs against the token. - On confirm: removes the policy through the Integration API. Traffic it matched falls through to the next policy or the zone pair's default. - Controller-managed policies are refused. - ``dry_run=True`` returns the ``would_delete`` envelope with no token, purely in…

Preview deletion of a firewall rule. v0.7.0: this tool no longer deletes on its own. It returns a preview envelope with a ``token``; call ``confirm_destructive_action(token)`` to commit the delete. Tokens expire after 5 minutes. Side effects: - None until ``confirm_destructive_action`` runs against the token. - On confirm: removes the rule. Traffic that previously matched it falls through to the next rule (or the implicit default). - ``dry_run=True`` returns the legacy ``would_delete`` envelope with no token — purely informational, no commit step possible. Example: delete_firewall_rule(…

Preview deletion of a honeypot entry. v0.7.0 destructive pattern: this tool does not delete on its own. It returns a preview envelope with a ``token``; call ``confirm_destructive_action(token)`` to commit. Tokens expire after 5 minutes. Side effects: - None until ``confirm_destructive_action`` runs against the token. - On confirm: rewrites the ``ips`` setting's ``honeypot`` list with the entry removed and sets ``honeypot_enabled`` based on whether the resulting list is empty. - ``dry_run=True`` returns the legacy ``would_delete`` envelope with no token (informational only). Example: d…

Preview deletion of a port-forward (DNAT) rule. v0.7.0: this tool no longer deletes on its own. It returns a preview envelope with a ``token``; call ``confirm_destructive_action(token)`` to commit the delete. Tokens expire after 5 minutes. Side effects: - None until ``confirm_destructive_action`` runs against the token. - On confirm: removes the NAT rule. The internal service stops being reachable from the WAN immediately. - ``dry_run=True`` returns the legacy ``would_delete`` envelope with no token — purely informational, no commit step possible. Example: delete_port_forward(forward_id…

Preview deletion of a switch port profile. v0.7.0: this tool no longer deletes on its own. It returns a preview envelope with a ``token``; call ``confirm_destructive_action(token)`` to commit the delete. Tokens expire after 5 minutes. Side effects: - None until ``confirm_destructive_action`` runs against the token. - On confirm: removes the profile. The controller rejects the request if any switch port still references it. - ``dry_run=True`` returns the legacy ``would_delete`` envelope with no token — purely informational, no commit step possible. Example: delete_port_profile(profile_id…

Preview deletion of a static route. This tool no longer deletes on its own. It returns a preview envelope with a ``token``; call ``confirm_destructive_action(token)`` to commit the delete. Tokens expire after 5 minutes. Side effects: - None until ``confirm_destructive_action`` runs against the token. - On confirm: removes the route. Traffic to the destination prefix falls back to the default route (or another matching route). - ``dry_run=True`` returns the legacy ``would_delete`` envelope with no token — purely informational, no commit step possible. Example: delete_route(route_id="65f.…

Preview deletion of a static DHCP reservation. v0.7.0: this tool no longer deletes on its own. It returns a preview envelope with a ``token``; call ``confirm_destructive_action(token)`` to commit the delete. Tokens expire after 5 minutes. Side effects: - None until ``confirm_destructive_action`` runs against the token. - On confirm: removes the fixed-IP entry. The client returns to dynamic DHCP on its next renewal and may receive a different address. - ``dry_run=True`` returns the legacy ``would_delete`` envelope with no token — purely informational, no commit step possible. Example: …

Preview deletion of a VLAN/network. v0.7.0: this tool no longer deletes on its own. It returns a preview envelope with a ``token``; call ``confirm_destructive_action(token)`` to commit the delete. Tokens expire after 5 minutes. Side effects: - None until ``confirm_destructive_action`` runs against the token. - On confirm: removes the network record. Any WLANs, firewall rules, or DHCP reservations still referencing it must be detached first or the controller will reject the request. Clients on this VLAN lose connectivity. - ``dry_run=True`` returns the legacy ``would_delete`` envelope w…

Preview deletion of a WiFi SSID. v0.7.0: this tool no longer deletes on its own. It returns a preview envelope with a ``token``; call ``confirm_destructive_action(token)`` to commit the delete. Tokens expire after 5 minutes. Side effects: - None until ``confirm_destructive_action`` runs against the token. - On confirm: removes the WLAN record. APs stop broadcasting the SSID within seconds. Connected wireless clients on this SSID are immediately disconnected. - ``dry_run=True`` returns the legacy ``would_delete`` envelope with no token — purely informational, no commit step possible. E…

Fetch one Access device's full record by ID. Side effects: None (read-only). Same shape as one entry from ``list_access_devices``. Useful for checking firmware version, online status, or hub assignment on a specific reader. Example: get_access_device(device_id="dev...", controller="default") Args: device_id: Device ``id`` from ``list_access_devices``. controller: Name of the UniFi controller to target.

Fetch one access policy's full record by ID. Side effects: None (read-only). Same shape as one entry from ``list_access_policies``. Useful when auditing why a specific user can or cannot badge into a specific door at a specific time. Example: get_access_policy(policy_id="pol...", controller="default") Args: policy_id: Access policy ``id`` from ``list_access_policies``. controller: Name of the UniFi controller to target.

Return controller version, license tier, and capacity. Side effects: None (read-only). Returns ``version``, ``release_channel``, ``license`` (with ``doors_used``, ``doors_max``, ``users_used``, ``users_max``), ``controller_id``, ``uptime_seconds``. Useful for surfacing licence ceilings before suggesting enrolling more doors / users. Example: get_access_system_info(controller="default") Args: controller: Name of the UniFi controller to target.

List client-impacting anomalies the controller has detected. Side effects: None (read-only). Returns one record per anomaly with ``anomaly`` (an enum string such as ``USER_HIGH_TCP_LATENCY`` or ``USER_DNS_LATENCY``), ``mac`` (the affected client), and ``timestamps`` (a list of epoch-ms occurrence times). Returns an empty list on a clean network. Example: get_anomalies(controller="default") Args: controller: Name of the UniFi controller to target. Defaults to ``"default"``.

Fetch a single camera's full record by ID. Side effects: None (read-only). Returns the full camera record (same shape as one entry from ``list_cameras``) including current recording mode, motion sensitivity, privacy-mask state, and the most recent ``lastMotion`` timestamp. Example: get_camera(camera_id="65f...", controller="default") Args: camera_id: The Protect ``id`` (or ``_id``) from ``list_cameras``. controller: Name of the UniFi controller to target. Defaults to ``"default"``.

List recent client connection sessions over a time window. Side effects: None (read-only). Returns one record per association, newest first, with ``mac``, ``hostname``, ``name``, ``ip``, ``assoc_time`` (epoch seconds), ``duration`` (seconds), ``rx_bytes``/``tx_bytes``, ``is_wired``, ``is_guest``, ``ap_mac``, and ``satisfaction``. Pass ``mac`` to scope to one client; omit it for every client's sessions in the window. Example: get_client_sessions(mac="aa:bb:cc:00:00:01", hours=48, limit=20) Args: mac: MAC address to filter to one client. Empty (default) returns sessions for all c…

Report per-client traffic, signal, and uptime for one client by MAC. Side effects: None (read-only). Returns a record with ``hostname``, ``name``, ``ip``, ``is_wired``, ``network``, ``essid``, ``uptime``, ``first_seen``/``last_seen``, ``signal``/``rssi``/``satisfaction`` (wireless), ``tx_rate``/``rx_rate``, ``tx_bytes``/``rx_bytes``, ``tx_retries``, ``anomalies``, and the wired ``wired_rate_mbps``/``wired_tx_bytes``/``wired_rx_bytes`` fields when present. Returns a NOT_FOUND error envelope if the client is not currently connected. Example: get_client_stats(mac="aa:bb:cc:00:00:01") Args: …

Show UniFi OS firmware and available-update state. Requires a **console session**, not the Network API key: UniFi OS's own endpoints do not accept ``X-API-Key``. Set ``UNIFI_OS_USERNAME`` and ``UNIFI_OS_PASSWORD`` to enable this tool. Without them it returns a clear configuration error rather than a bare 401. UNVERIFIED RESPONSE SHAPE: the endpoint is confirmed to exist on UCG-Fiber / UniFi OS 5.1.19 (it answers 401 rather than 404 without a session), but its response body has not been observed — no console credentials were available when this tool was written. The raw body is passed through…

Diagnose the gateway's two layers separately: UniFi OS and Network. Start here when anything UniFi-related is failing. Every other tool in this server talks to the UniFi Network *application*; this one also checks the UniFi OS *console* underneath it, so it can tell you whether the box is down, the application is down, or your credentials are wrong — three very different problems that otherwise look identical. Side effects: None (read-only, two GET probes). Returns a record with: - ``state``: one of ``healthy``, ``network_app_starting``, ``network_app_down``, ``credentials_invalid``, ``…

Show UniFi OS console identity and connectivity, independent of Network. Answers from the UniFi OS layer, so it keeps working while the UniFi Network application is down. Useful for confirming the box itself is alive, which model it is, and whether it still has internet and cloud connectivity. Side effects: None (read-only). Returns ``model`` (hardware short name), ``name``, ``mac``, ``device_state``, ``device_error_code``, ``has_internet``, ``cloud_connected``, ``remote_access_enabled``, ``sso_enabled``, and ``installed_apps`` (application inventory reported by the console). This firmware…

Show one content-filtering profile's full record by ``_id``. Side effects: None (read-only). Call this before ``update_content_filter`` to see the profile's current categories, allow/block lists, and scope (the values you are about to read-modify-write). Returns the profile record, or an error envelope if no profile matches. Example: get_content_filter_details(filter_id="65f...") Args: filter_id: The ``_id`` from ``list_content_filters``. controller: Name of the UniFi controller to target. Defaults to ``"default"``.

Fetch one credential's full record by ID. Side effects: None (read-only). Same shape as one entry from ``list_credentials`` plus any type-specific fields (``card_id`` for NFC, ``pin_length`` for PIN, ``device_label`` for mobile). Example: get_credential(credential_id="cred...", controller="default") Args: credential_id: Credential ``id`` from ``list_credentials``. controller: Name of the UniFi controller to target.

Show per-radio RF settings for an access point. Side effects: None (read-only). Use this before any ``set_radio_*`` call to see the current values you are about to change. Returns the device identity plus one record per radio with ``radio`` (UniFi id: ``ng``=2.4GHz, ``na``=5GHz, ``6e``=6GHz), the friendly ``band``, ``channel``, ``ht`` (channel width MHz), ``tx_power_mode`` (``auto`` when unset), ``tx_power``, ``min_rssi_enabled``, ``min_rssi``, and the hardware ``min_txpower``/``max_txpower`` bounds. Example: get_device_radios(device_mac="aa:bb:cc:00:00:02") Args: device_mac: AP MAC ad…

Report per-device stats for one UniFi device by MAC. Side effects: None (read-only). Returns a record with ``name``, ``model``, ``type``, ``state``, ``uptime`` (seconds), ``cpu_pct``, ``mem_pct``, ``satisfaction``, ``num_sta``, ``tx_bytes``/``rx_bytes``, and (for access points) ``tx_retries``/``tx_packets``/``rx_packets``. Returns a NOT_FOUND error envelope if no adopted device matches ``mac``. Example: get_device_stats(mac="f4:e2:c6:00:00:02") Args: mac: MAC address of the device (gateway, AP, or switch). controller: Name of the UniFi controller to target. Defaults to ``"d…

Fetch one door's full record by ID. Side effects: None (read-only). Returns the same fields as one entry in ``list_doors`` plus the live lock and position status. Useful for confirming a door is online before reading recent events against it. Example: get_door(door_id="abc...", controller="default") Args: door_id: Access door ``id`` from ``list_doors``. controller: Name of the UniFi controller to target.

Show one Dynamic DNS config's full record by ``_id``. Side effects: None (read-only). Call this before ``update_dynamic_dns`` to see the current provider, hostname, and tracked interface. Returns the DDNS record (with ``x_password`` redacted), or an error envelope if no config matches. Example: get_dynamic_dns_details(ddns_id="65f...") Args: ddns_id: The ``_id`` from ``list_dynamic_dns``. controller: Name of the UniFi controller to target. Defaults to ``"default"``.

Fetch the JPEG thumbnail for a Protect event, base64-encoded. Side effects: None (read-only). Same response shape as ``get_snapshot``, but keyed on the event instead of the camera. Useful for previewing a motion or smart-detection trigger without pulling the full clip. Example: get_event_thumbnail(event_id="evt123", controller="default") Args: event_id: Protect event ``id`` from ``list_motion_events`` or ``list_smart_detections``. controller: Name of the UniFi controller to target. Defaults to ``"default"``.

Show one firewall group's full record by ``_id``. Side effects: None (read-only). Call this before ``update_firewall_group`` to see the current members you are about to read-modify-write. Returns the group record with ``_id``, ``name``, ``group_type``, and ``group_members``, or an error envelope if no group matches. Example: get_firewall_group_details(group_id="65f...") Args: group_id: The ``_id`` from ``list_firewall_groups``. controller: Name of the UniFi controller to target. Defaults to ``"default"``.

Report gateway resource stats: CPU, memory, temperature, throughput. Side effects: None (read-only). Returns a single record for the gateway (UCG/UDM) with ``cpu_pct``, ``mem_pct``, ``temperatures`` (a list of ``{name, type, value}`` in degrees C), ``uptime`` (seconds), ``tx_bytes``/``rx_bytes``, ``num_sta``, ``last_wan_ip``, and ``speedtest_status``. Returns ``{}`` if no gateway device is adopted on this controller. Example: get_gateway_stats(controller="default") Args: controller: Name of the UniFi controller to target. Defaults to ``"default"``.

Show the guest captive-portal configuration for the site. The portal is a **site setting** (``guest_access``), not a property of any WLAN. Turning a WLAN off "Hotspot" mode does not disable the portal — check and change it here. Side effects: None (read-only). Returns ``portal_enabled`` (the click-through page toggle), ``auth`` (``"none"`` means a bare Connect button with no credential), ``expire``/``expire_number``/``expire_unit`` (how long an authorised guest session lasts before the page reappears), ``redirect_enabled`` and ``redirect_url``, the ``restricted_subnet_*`` entries, and the p…

Show one network's full record, grouped into readable sections. Side effects: None (read-only). This is the deep view that complements ``list_networks`` (the summary). Use it to inspect a network's DHCP scope, IPv6 configuration, and VPN fields before editing with ``update_vlan`` / ``set_lan_ipv6``. Resolve the network by ``network_id`` (preferred, from ``list_networks``) or by ``name`` (case-insensitive; errors if the name is ambiguous). Returns: - ``network``: identity fields (``_id``, ``name``, ``purpose``, ``vlan``, ``vlan_enabled``, ``ip_subnet``, ``enabled``, ``networkgroup``). - …

Return the most recent N events across every door. Side effects: None (read-only). Convenience wrapper around ``list_access_events`` with a 24-hour window and no filters. Useful for "what just happened" triage. Example: get_recent_access_events(limit=10) Args: limit: Maximum events returned. Defaults to 20. controller: Name of the UniFi controller to target.

Show one static route's full record by ``_id``. Side effects: None (read-only). Call this before ``update_route`` to see the current destination, next hop, and distance. Returns the route record, or an error envelope if no route matches. Example: get_route_details(route_id="65f...") Args: route_id: The ``_id`` from ``list_routes``. controller: Name of the UniFi controller to target. Defaults to ``"default"``.

Report per-subsystem health (wan, lan, wlan, www, vpn). Side effects: None (read-only). Returns one record per subsystem with ``subsystem``, ``status``, and subsystem-specific metrics (e.g. WAN throughput, LAN client counts). Example: get_site_health(controller="default") Args: controller: Name of the UniFi controller to target. Defaults to ``"default"``.

Fetch a current JPEG snapshot from a camera, base64-encoded. Side effects: None (read-only). Returns ``{"camera_id": ..., "format": "jpeg", "data": "<base64>", "size_bytes": ...}``. The JPEG payload is base64-encoded so it can ride inside the JSON envelope all MCP tools return; decode with ``base64.b64decode`` to get the raw image bytes. Example: get_snapshot(camera_id="65f...", controller="default") Args: camera_id: Protect camera ``id``. controller: Name of the UniFi controller to target. Defaults to ``"default"``.

List recent speed-test results, newest first. Side effects: None (read-only). Returns one record per test with ``time``, ``xput_up``, ``xput_download``, ``latency``, and ``server``. Example: get_speedtest_results(limit=10) Args: limit: Max number of results to return (default 10, max 1000). controller: Name of the UniFi controller to target. Defaults to ``"default"``.

Report controller/system info: version, uptime, device type. Side effects: None (read-only). Returns a single record with ``version``, ``build``, ``previous_version``, ``hostname``, ``name``, ``uptime`` (seconds), ``timezone``, ``ubnt_device_type``, ``udm_version``, ``console_display_version``, and ``update_available``. Use it to check the firmware level and whether an update is pending. Example: get_system_info(controller="default") Args: controller: Name of the UniFi controller to target. Defaults to ``"default"``.

Return Teleport VPN state and any wireguard-server networks. Side effects: None (read-only). Returns ``{"enabled": bool, "vpn_networks": [...], "clients_via_local_api": false, "notes": [...]}``. The ``enabled`` flag is the global Teleport listener toggle; ``vpn_networks`` lists the underlying wireguard-server network records (Teleport rides on these for tunnel termination); ``clients_via_local_api`` is a hard ``false`` on UniFi Network 9.x — the client roster and invitation lifecycle are only reachable via the Ubiquiti mobile app pairing flow, not the local API. Example: get_teleport_config…

Return current Threat Management (IDS/IPS) configuration. Side effects: None (read-only). Reads the controller's ``ips`` setting record and projects it to the operator view: ``enabled`` (true when mode is ``ids`` or ``ips``), ``mode`` (one of ``off`` / ``ids`` / ``ips``), ``enabled_signature_categories`` (the IDS/IPS Emerging Threats rule groups that are turned on), ``enabled_networks`` (network IDs the engine inspects), plus the adjacent booleans for endpoint scanning, ad blocking, DNS filtering, and honeypot. Example: get_threat_management(controller="default") Args: controller: Name…

Show one traffic route's full record by ``_id``. Side effects: None (read-only). Call this before ``update_traffic_route`` or ``toggle_traffic_route`` to see the route's current matching target, next hop, and kill-switch state. Returns the route record, or an error envelope if no route matches. Example: get_traffic_route_details(route_id="65f...") Args: route_id: The ``_id`` from ``list_traffic_routes``. controller: Name of the UniFi controller to target. Defaults to ``"default"``.

Show one traffic rule's full record by ``_id``. Side effects: None (read-only). Call this before ``update_traffic_rule`` or ``toggle_traffic_rule`` to see the rule's current matching target and action. Returns the rule record, or an error envelope if no rule matches. Example: get_traffic_rule_details(rule_id="65f...") Args: rule_id: The ``_id`` from ``list_traffic_rules``. controller: Name of the UniFi controller to target. Defaults to ``"default"``.

Fetch one visitor pass's full record by ID. Side effects: None (read-only). Same shape as one entry from ``list_visitors`` plus any per-pass purpose / notes, with ``pass_code`` redacted for the same reason. Example: get_visitor(visitor_id="vis...", controller="default") Args: visitor_id: Visitor ``id`` from ``list_visitors``. controller: Name of the UniFi controller to target.

Show the current IPv6 configuration of the WAN uplink(s). Side effects: None (read-only). Call this before ``set_wan_ipv6`` to see exactly what you are about to change. Returns one record per WAN interface with ``name``, ``_id``, and the IPv6 keys: ``wan_type_v6`` (connection type: ``disabled``/``dhcpv6``/ ``pppoe``/``static``), ``ipv6_wan_delegation_type`` (``none`` or ``pd``), ``wan_dhcpv6_pd_size_auto``, ``wan_dhcpv6_pd_size`` (present only when PD is configured), ``wan_ipv6_dns_preference``, and ``ipv6_setting_preference``. Example: get_wan_ipv6(controller="default") Args: wan_name…

Report current WAN status: link, ISP, public IP, throughput, latency. Side effects: None (read-only). Convenience wrapper around ``get_site_health`` that returns just the WAN subsystem record. Returns ``{"subsystem": "wan", "status": "unknown"}`` if the controller does not report WAN. Example: get_wan_status(controller="default") Args: controller: Name of the UniFi controller to target. Defaults to ``"default"``.

List hubs, readers, relays, and intercoms bonded to the controller. Side effects: None (read-only). Returns one record per device with ``id``, ``type`` (``hub`` or ``reader``), ``model``, ``name``, ``mac``, ``ip``, ``online``, ``firmware_version``, and (for readers) the ``door_id`` and ``hub_id`` they belong to. Example: list_access_devices(controller="default") Args: controller: Name of the UniFi controller to target.

List badge-scan / door events with filters. Side effects: None (read-only). Returns events whose timestamp falls inside the last ``hours_back`` hours. ``result`` filters to ``"granted"`` or ``"denied"``; empty returns both. ``door_id`` narrows to one door. Example: list_access_events(hours_back=6, result="denied", limit=20) Args: hours_back: Look-back window in hours. Defaults to 24. result: Optional ``"granted"`` or ``"denied"`` filter. Empty (default) returns both. door_id: Optional door ``id`` filter. Empty returns events across every door. limit: Maximum…

List every access policy on the controller. Side effects: None (read-only). Each policy ties a schedule (e.g. business hours), one or more door groups, and a set of users / credential types. Returns ``id``, ``name``, ``type``, ``schedule``, ``door_group_ids``, ``user_ids``, ``credential_types``, ``active``. Example: list_access_policies(controller="default") Args: controller: Name of the UniFi controller to target.

List every user enrolled in the Access system. Side effects: None (read-only). Returns one record per user with ``id``, ``first_name``, ``last_name``, ``full_name``, ``email``, ``status``, ``employee_number``, and ``credential_ids`` (cross-reference with ``list_credentials``). Example: list_access_users(controller="default") Args: controller: Name of the UniFi controller to target.

List controller alarms, active or archived. Side effects: None (read-only). Returns the most recent ``limit`` alarm records. Not available on every firmware: UniFi Network 10.5 and 10.6 answer 400 ``api.err.InvalidObject`` on every alarm route, so on those controllers this tool returns an error saying the feature is unsupported rather than an empty list. It works on 10.4 and older. Example: list_alarms(limit=20, archived=False) Args: limit: Max number of alarms to return (default 50, max 1000). archived: ``True`` lists dismissed/archived alarms; ``False`` (default) lists a…

List access-point groups configured on the controller. Side effects: None (read-only). Returns one record per AP group with ``_id``, ``name``, ``attr_hidden_id`` (the built-in "default" group carries ``"default"`` here), ``device_macs``, and ``site_id``. Used by ``create_wlan`` to auto-resolve the default AP group when no explicit ``ap_group_ids`` is supplied. Call this directly to inspect which groups exist before creating per-AP-group WLANs. Example: list_ap_groups(controller="default") Args: controller: Name of the UniFi controller to target. Defaults to ``"default"``.

List every camera bonded to the Protect controller. Side effects: None (read-only). Returns one record per camera with ``id``, ``name``, ``model``, ``mac``, ``host``, ``state``, ``isConnected``, ``isDoorbell``, plus the nested ``recordingSettings``, ``motionSettings``, ``privacyMask``, and ``stats`` blocks the UniFi Protect API surfaces. Example: list_cameras(controller="default") Args: controller: Name of the UniFi controller to target. Defaults to ``"default"``.

List currently active wireless and wired clients. Side effects: None (read-only). Mirrors the controller's Insights → Clients view: MAC, hostname, IP, network, signal/satisfaction (wireless only), AP or switch port (wired), uptime, and last_seen. Example: list_clients(controller="default") Args: controller: Name of the UniFi controller to target. Defaults to ``"default"``.

List DNS content-filtering profiles (category blocking, safe-search). Side effects: None (read-only). Returns one record per profile with ``_id``, ``name``, ``enabled``, ``categories`` (blocked DNS-category enum list), ``allow_list`` / ``block_list`` (per-domain overrides), ``client_macs`` and ``network_ids`` (the scope the profile applies to), ``safe_search``, and ``schedule``. Empty on a gateway with no filtering profiles. Example: list_content_filters(controller="default") Args: controller: Name of the UniFi controller to target. Defaults to ``"default"``.

List every credential enrolled in the Access controller. Side effects: None (read-only). Returns one record per credential with ``id``, ``type`` (``nfc``, ``pin``, or ``mobile``), ``label``, ``user_id``, ``status``, ``issued_at`` (ms), and ``expires_at`` (ms or null for non-expiring mobile credentials). Example: list_credentials(controller="default") Args: controller: Name of the UniFi controller to target.

List every UniFi device adopted by this controller. Side effects: None (read-only). Returns one record per device (gateway, AP, switch). By default that is the full controller record (``_id``, ``mac``, ``type``, ``model``, ``name``, ``ip``, ``version``, ``state``, ``uptime``, ``num_sta``, ``satisfaction`` and every other field the controller carries, which runs to roughly 35 KB per device). With ``compact=True`` each record is reduced to ``_id``, ``name``, ``mac``, ``model``, ``type``, ``ip`` and ``state``, which is what an inventory or "which AP is that" question needs and fits a context wi…

List static DHCP reservations on the controller. Side effects: None (read-only). UniFi stores fixed leases on the user object with ``use_fixedip=true``. This returns just those entries with ``_id``, ``mac``, ``name``, ``hostname``, ``fixed_ip``, and ``network_id``. Example: list_dhcp_leases(controller="default") Args: controller: Name of the UniFi controller to target. Defaults to ``"default"``.

List every door group defined on the controller. Side effects: None (read-only). Door groups bundle doors for access-policy assignment. Returns ``id``, ``name``, ``door_ids``, and ``description``. Example: list_door_groups(controller="default") Args: controller: Name of the UniFi controller to target.

List doorbell cameras (those with ``isDoorbell=True``). Side effects: None (read-only). Returns the subset of cameras that are doorbells. Useful as a pre-step before configuring chime / message tools (future Phase 3.x work). Each entry includes the camera's ``id``, ``name``, and ``isConnected``. Example: list_doorbell_messages(controller="default") Args: controller: Name of the UniFi controller to target. Defaults to ``"default"``.

List every door bonded to the Access controller. Side effects: None (read-only). Returns one record per door with ``id``, ``name``, ``location``, ``hub_id``, ``locked``, ``online``, ``door_position_status``, ``lock_status``, and ``last_activity`` (epoch ms). Example: list_doors(controller="default") Args: controller: Name of the UniFi controller to target. Defaults to ``"default"``.

List Dynamic DNS update configurations on the controller. Side effects: None (read-only). Returns one record per DDNS config with ``_id``, ``service`` (provider), ``host_name`` (the FQDN kept updated), ``login``, ``server`` (custom update-URL host, if any), ``interface`` (tracked WAN), and ``enabled``. The provider password (``x_password``) is write-only and comes back redacted. Empty on a gateway with no DDNS configured. Example: list_dynamic_dns(controller="default") Args: controller: Name of the UniFi controller to target. Defaults to ``"default"``.

List recent controller events (connections, disconnections, etc.). Side effects: None (read-only). Returns the most recent ``limit`` event records, newest first. Not available on every firmware: UniFi Network 10.5 and 10.6 expose no event log on the local API-key surface (``/stat/event`` answers 404), so on those controllers this tool returns an error saying the feature is unsupported rather than an empty list. It works on 10.4 and older. Example: list_events(limit=100) Args: limit: Max number of events to return (default 50, max 1000). controller: Name of the UniFi controller to …

Return only ``result == "denied"`` events within the window. Side effects: None (read-only). Convenience wrapper around ``list_access_events`` for security audits. Each entry includes ``reason`` (e.g. ``"expired"``, ``"off-hours"``, ``"unknown_pin"``) so the LLM can summarise the cause distribution. Example: list_failed_access_attempts(hours_back=12, door_id="abc...") Args: hours_back: Look-back window in hours. Defaults to 24. door_id: Optional door ``id`` filter. Empty returns denials across every door. limit: Maximum events returned. Defaults to 100. controller: …

List reusable firewall groups (address, IPv6-address, and port groups). Side effects: None (read-only). Firewall groups are named, reusable sets of addresses or ports that firewall rules and other policies reference by ``_id`` instead of repeating literals. Returns one record per group with ``_id``, ``name``, ``group_type`` (``address-group``/``ipv6-address-group``/ ``port-group``), and ``group_members`` (the list of CIDRs, IPs, or ports). Example: list_firewall_groups(controller="default") Args: controller: Name of the UniFi controller to target. Defaults to ``"default"``.

List every Zone-Based Firewall policy on the controller (v2 API). Side effects: None (read-only). Sites on UniFi Network 9.x and newer that use the Zone-Based Firewall keep their policy here, not in the legacy rulesets that ``list_firewall_rules`` reads. A site still on legacy rulesets returns ``[]`` from this tool and its rules from ``list_firewall_rules``; ``audit_open_ports`` reads both so you do not have to guess which model a site uses. Returns one record per policy with ``_id``, ``name``, ``action`` (``ALLOW``/``BLOCK``/``REJECT``), ``enabled``, ``predefined`` (controller-managed, not…

List every legacy-ruleset firewall rule on the controller. Side effects: None (read-only). Reads the legacy ``/rest/firewallrule`` collection (rulesets such as ``WAN_IN`` and ``LAN_IN``). A site that has migrated to the Zone-Based Firewall (Network 9.x and newer) keeps its policy elsewhere and this returns ``[]`` even though the firewall is configured: use ``list_firewall_policies`` for those sites, or ``audit_open_ports``, which reads both. Returns one record per rule with ``_id``, ``name``, ``ruleset``, ``rule_index``, ``action``, ``enabled``, ``protocol``, and ``src_*``/``dst_*`` fields.…

List the Zone-Based Firewall zones on the controller (v2 API). Side effects: None (read-only). Zones are what ``list_firewall_policies`` records point at through ``source.zone_id`` and ``destination.zone_id``, so this is the lookup that turns a policy into "WAN to LAN". A site still on legacy rulesets returns ``[]``. Returns one record per zone with ``_id``, ``name``, ``zone_key`` (``"wan"``, ``"lan"``, ...), ``default_zone``, ``attr_no_edit`` and the ``network_ids`` the zone spans. Example: list_firewall_zones(controller="default") Args: controller: Name of the UniFi controller to ta…

List configured honeypots and the global honeypot toggle. Side effects: None (read-only). Returns ``{"enabled": bool, "honeypots": [...]}`` where each entry carries ``id`` (synthesised ``network_id:ip``), ``network_id``, ``network_name`` (looked up from ``list_networks``), ``ip``, and ``version`` (always ``v4`` on UniFi 9.x). Example: list_honeypots(controller="default") Args: controller: Name of the UniFi controller to target. Defaults to ``"default"``.

List motion events in the last ``hours_back`` hours. Side effects: None (read-only). Filters Protect's event stream to entries with ``type == "motion"`` within the requested window. ``camera_id`` narrows the result set to one camera; an empty string returns motion across every bonded camera. Example: list_motion_events(camera_id="65f...", limit=20, hours_back=6) Args: camera_id: Protect camera ``id``. Empty (default) returns motion across all cameras. limit: Maximum number of events returned. Defaults to 50. hours_back: Look-back window in hours from now. Defaults to 24…

List every network/VLAN configured on the controller. Side effects: None (read-only). Returns one record per network with ``_id``, ``name``, ``purpose``, ``vlan``, ``vlan_enabled``, ``ip_subnet``, ``dhcpd_enabled``, ``dhcpd_start``, ``dhcpd_stop``, and ``enabled``. Records also carry their IPv6 state inline: ``ipv6_interface_type`` (``none``/``pd``/ ``static``), ``ipv6_ra_enabled`` (router advertisements), and ``ipv6_client_address_assignment`` (``slaac``/``dhcpv6``). Use ``set_lan_ipv6`` to change those, or ``get_wan_ipv6`` / ``set_wan_ipv6`` for the WAN uplink's IPv6 config. Example: list…

List every port-forward (DNAT) rule on the controller. Side effects: None (read-only). Returns one record per forward with ``_id``, ``name``, ``enabled``, ``proto``, ``src``, ``fwd``, ``fwd_port``, and ``dst_port``. Example: list_port_forwards(controller="default") Args: controller: Name of the UniFi controller to target. Defaults to ``"default"``.

List switch port profiles configured on the controller. Side effects: None (read-only). Port profiles control PoE, native VLAN, tagged VLANs, and STP per switch port. Returns one record per profile with ``_id``, ``name``, ``native_networkconf_id``, ``forward``, and ``poe_mode``. Use these IDs when assigning ports on a switch. Example: list_port_profiles(controller="default") Args: controller: Name of the UniFi controller to target. Defaults to ``"default"``.

List Protect recordings for one camera over the last ``hours_back`` hours. Side effects: None (read-only). Returns one record per stored clip segment with ``id``, ``start``, ``end``, ``type``, and ``size`` (bytes). Useful for finding the recording window around a specific motion event. Example: list_recordings(camera_id="65f...", hours_back=6) Args: camera_id: Protect camera ``id``. hours_back: Look-back window in hours. Defaults to 24. controller: Name of the UniFi controller to target. Defaults to ``"default"``.

List user-defined static (next-hop) routes on the controller. Side effects: None (read-only). Returns one record per route with ``_id``, ``name``, ``type``, ``static-route_network`` (destination CIDR), ``static-route_nexthop`` (next-hop IP), ``static-route_distance``, and ``enabled``. Empty on a gateway with no custom routes (the default route is managed by the WAN config, not listed here). Example: list_routes(controller="default") Args: controller: Name of the UniFi controller to target. Defaults to ``"default"``.

List smart-detection events (person, vehicle, animal, package). Side effects: None (read-only). Filters Protect's event stream to ``type == "smartDetectZone"`` and narrows to entries whose ``smartDetectTypes`` contain ``detection_type``. Empty ``camera_id`` returns detections across all cameras. Example: list_smart_detections(detection_type="person", hours_back=12) Args: detection_type: One of ``"person"``, ``"vehicle"``, ``"animal"``, ``"package"``. Defaults to ``"person"``. camera_id: Protect camera ``id``. Empty (default) returns matches across all cameras. l…

List top clients by total bytes (DPI by-station report). Side effects: None (read-only). Returns one record per client ranked by ``total_bytes`` descending, with ``mac``, ``hostname``, ``ip``, ``tx_bytes``, ``rx_bytes``, and ``total_bytes``. Example: list_top_talkers(limit=10) Args: limit: Max number of clients to return (default 10, max 1000). controller: Name of the UniFi controller to target. Defaults to ``"default"``.

List v2 traffic routes (policy-based routing, e.g. VPN-client routes). Side effects: None (read-only). Returns one record per route with ``_id``, ``matching_target``, ``next_hop`` / ``network_id`` (the interface or VPN the matched traffic is sent out), ``kill_switch_enabled``, and ``enabled``. Empty on a gateway with no policy routes configured. Example: list_traffic_routes(controller="default") Args: controller: Name of the UniFi controller to target. Defaults to ``"default"``.

List v2 traffic rules (app/domain/IP-based allow & block policies). Side effects: None (read-only). Returns one record per rule with ``_id``, ``action`` (``BLOCK``/``ALLOW``), ``matching_target``, ``target_devices``, and ``enabled``. Empty on a gateway with no traffic rules configured. Example: list_traffic_rules(controller="default") Args: controller: Name of the UniFi controller to target. Defaults to ``"default"``.

List every visitor pass on the controller (active and expired). Side effects: None (read-only). Returns one record per visitor with ``id``, ``first_name``, ``last_name``, ``full_name``, ``email``, ``host_user_id``, ``valid_from`` (ms), ``valid_until`` (ms), and ``status``. ``pass_code`` is **redacted** to ``"[REDACTED]"``. It is the code that opens the door, not the record's identifier — ``id`` is, and ``id`` still comes back, so ``get_visitor`` and every other lookup still work. Read the code from the Access UI if you need to reissue it. Example: list_visitors(controller="default") Args:…

List every WiFi SSID configured on the controller. Side effects: None (read-only). Returns one record per WLAN with ``_id``, ``name``, ``enabled``, ``security``, ``wpa_mode``, ``networkconf_id``, ``is_guest``, ``hide_ssid``, and ``wlan_band``. The WPA pre-shared key (``x_passphrase``) is **redacted** to ``"[REDACTED]"``. This tool cannot reveal it, by design — there is no opt-in flag. Tool output routinely lands in transcripts and logs that outlive the request, so a PSK returned here is a PSK disclosed. Read it from the controller UI if you genuinely need it. Example: list_wlans(controller…

Toggle the LED locate beacon on a device. Side effects: - The physical device flashes its status LED until ``on=False`` is sent (or it reboots). Helpful for finding which physical AP or switch maps to a controller record. - No traffic impact. - Mutates controller state. Use dry_run=True to preview the change without applying. Example: locate_device(mac="aa:bb:cc:00:00:01", on=True) Args: mac: Device MAC address (from ``list_devices``). on: ``True`` (default) starts the flash; ``False`` stops it. controller: Name of the UniFi controller to target. Defaults to ``"def…

Configure a camera end-to-end: recording mode + sensitivity + privacy. Side effects: - Step 1: PATCHes ``recordingSettings.mode`` and ``recordingSettings.retentionDurationMs`` (computed from ``retention_days`` * 86400000). - Step 2: PATCHes ``motionSettings.sensitivity``. - Step 3: PATCHes ``privacyMask.enabled``. - Mutates controller state. Use dry_run=True to preview the change without applying. - Rollback: if step 2 or step 3 fails, the camera's original recording, sensitivity, and privacy settings are restored from the pre-call snapshot. The response includes ``rolled_back`` and…

Stand up a homelab service: DHCP lease + firewall allow + (optional) port forwards. Side effects: - Step 1: creates a static DHCP reservation pinning ``mac`` to ``ip`` on the named network. - Step 2 (when ``ports`` is non-empty): creates a LAN_LOCAL accept firewall rule for ``ip`` on the requested TCP ports. On a site running the Zone-Based Firewall it creates an ALLOW zone policy from the ``Internal`` zone to ``ip`` on those ports instead, through the Integration API (``firewall_policy`` in the response). - Step 3 (when ``wan_expose=True`` and ``ports`` is non-empty): creates one…

Block a client and log the quarantine action with a reason. Side effects: - Step 1: adds the MAC to the controller's user-block list (same as ``block_client``). The client is immediately disconnected and prevented from re-associating until ``unblock_client`` is called. - Step 2: appends a WARNING-level structured log entry capturing ``mac`` and ``reason`` for later forensics. - Mutates controller state. Use dry_run=True to preview the change without applying. - Rollback: if any sub-step fails, all prior sub-steps are reverted (the log entry is best-effort and not unwound; only step …

Force a client to reconnect (kick-sta). Side effects: - Issues a deauthentication frame for ``mac`` on its current AP. The client immediately disconnects and most clients re-associate automatically within seconds. - The block-list is not modified; this is a transient nudge. - Mutates controller state. Use dry_run=True to preview the change without applying. Example: reconnect_client(mac="aa:bb:cc:00:00:01") Args: mac: Client MAC address (e.g. ``"aa:bb:cc:00:00:01"``). controller: Name of the UniFi controller to target. Defaults to ``"default"``. dry_run: Preview th…

Rename an adopted UniFi device (AP, switch, or gateway). Side effects: - Cosmetic only: changes the display name in the controller and in tool output. No RF or traffic impact, no client disconnects. - Mutates controller state. Use dry_run=True to preview the change without applying. Example: rename_device(device_mac="aa:bb:cc:00:00:02", name="Bedroom AP") Args: device_mac: Device MAC address (from ``list_devices``). name: New display name. Must be non-empty. controller: Name of the UniFi controller to target. Defaults to ``"default"``. dry_run: Preview the change…

Restart an adopted UniFi device (gateway, AP, or switch). Side effects: - Issues a soft reboot. The device is unreachable for ~60 seconds. - Wireless clients on a restarted AP will be disconnected and must re-associate. - Restarting a gateway interrupts WAN/LAN traffic for the duration of the reboot. - Mutates controller state. Use dry_run=True to preview the change without applying. Example: restart_device(mac="aa:bb:cc:00:00:01") Args: mac: Device MAC address (from ``list_devices``). controller: Name of the UniFi controller to target. Defaults to ``"default"``. d…

Restore controller state from a ``backup_config`` envelope. Side effects: - Diffs the envelope against current controller state and applies an ordered create/delete plan. Deletes run first (firewall_rules, port_forwards, wlans, dhcp_leases, port_profiles, networks); creates run second in the reverse order. No update path in this version: drifted fields show up as a delete + create pair (or stay put when names match). - Cross-controller restore: if the envelope's ``controller`` differs from the target, the restore proceeds and the response includes a warning. - Stripped secrets: …

Toggle a camera's privacy mask (lens cover) on or off. Side effects: - PATCHes ``privacyMask.enabled`` on the camera. When ``True``, the camera stops capturing video; clips are not recorded. - Mutates controller state. Use dry_run=True to preview the change without applying. Example: set_camera_privacy_mode(camera_id="65f...", enabled=True) Args: camera_id: Protect camera ``id``. enabled: ``True`` to engage the privacy mask, ``False`` to release it. controller: Name of the UniFi controller to target. Defaults to ``"default"``. dry_run: Preview the change …

Set a camera's recording mode (``always``, ``motion``, or ``never``). Side effects: - PATCHes ``recordingSettings.mode`` on the camera. Takes effect immediately; ``never`` halts new clip writes. - Mutates controller state. Use dry_run=True to preview the change without applying. Example: set_camera_recording_mode(camera_id="65f...", mode="motion") Args: camera_id: Protect camera ``id``. mode: One of ``"always"``, ``"motion"``, ``"never"``. controller: Name of the UniFi controller to target. Defaults to ``"default"``. dry_run: Preview the change without applying i…

Change the guest captive-portal configuration. Set ``portal_enabled=False`` to remove the click-through "Connect" page that guests see on every reconnection. Side effects: - Read-modify-writes the site's ``guest_access`` setting. Only the fields you pass are altered; the rest of the record is written back unchanged (full-object write, never a partial body). - **Does not weaken network isolation** when isolation is enforced by firewall rules or a guest VLAN. The portal is an interstitial authorisation page, not a security boundary. Disabling it changes who sees a login screen, not w…

Set the IPv6 configuration of one LAN/VLAN network. Side effects: - Changes how this network gets and advertises IPv6. Turning on ``interface_type="pd"`` plus ``ra_enabled=True`` is what makes the LAN's clients receive global IPv6 addresses from the prefix delegated by the WAN. Toggling router advertisements (``ra_enabled``) or the address-assignment mode causes clients on this network to re-acquire IPv6; IPv4 is unaffected. - Only the IPv6 keys you supply change; every other field on the network record is read first and written back unchanged (strict read-modify-write). - Mutat…

Set a camera's motion sensitivity (0-100). Side effects: - PATCHes ``motionSettings.sensitivity``. Higher values trigger more motion events; 0 effectively disables motion-based recording even when ``recordingSettings.mode`` is ``"motion"``. - Mutates controller state. Use dry_run=True to preview the change without applying. Example: set_motion_sensitivity(camera_id="65f...", sensitivity=60) Args: camera_id: Protect camera ``id``. sensitivity: Integer 0-100. Out-of-range values are rejected. controller: Name of the UniFi controller to target. Defaults to ``"default"…

Override settings on a single switch port. Side effects: - Modifies one port's ``enable``, ``poe_mode``, and/or ``portconf_id`` on the named switch without touching the others. - Disabling a port immediately drops the link; powered devices on that port (PoE cameras, APs) will go offline. - Mutates controller state. Use dry_run=True to preview the change without applying. Example: set_port_state(device_mac="aa:bb:cc:00:00:01", port_idx=5, enable=True, poe_mode="auto") Args: device_mac: Switch MAC address (from ``list_devices``). port_idx: 1-based port index. enable: ``True`…

Set the channel and/or channel width of one radio on an AP. Side effects: - The radio retunes immediately; wireless clients on that band briefly disconnect and re-associate. - On 5GHz, DFS channels (52-144) may add a radar-scan delay before the radio starts serving clients. - Only the targeted radio changes; everything else on the device is read first and written back unchanged. - Mutates controller state. Use dry_run=True to preview the change (including the current value) without applying. Read first: call ``get_device_radios`` to see the current channel and width. Example: set_ra…

Enable, tune, or disable minimum RSSI on one radio of an AP. Side effects: - With min-RSSI enabled, the AP kicks clients whose signal drops below the threshold, forcing them to roam to a closer AP. A threshold set too aggressive (e.g. -60) causes disconnect loops for legitimately distant clients. - Only the targeted radio changes; everything else on the device is read first and written back unchanged. - Mutates controller state. Use dry_run=True to preview the change (including the current value) without applying. Read first: call ``get_device_radios`` to see the current state. Typ…

Set the transmit power mode of one radio on an access point. Side effects: - Changes the AP's RF footprint. Lowering TX power shrinks coverage; clients at the cell edge may roam to another AP or drop to a lower PHY rate. The radio applies the change within seconds (brief client re-association possible). - Only the targeted radio changes; the device's other radios and settings are read first and written back unchanged. - Mutates controller state. Use dry_run=True to preview the change (including the current value) without applying. Read first: call ``get_device_radios`` to see the c…

Toggle the Teleport VPN listener. Side effects: - Patches the ``teleport`` setting record's ``enabled`` field. When ``False``, the controller tears down the listener and disconnects any active sessions. Registered clients (via the mobile app) remain registered and reconnect once the listener is re-enabled. - Mutates controller state. Use dry_run=True to preview. Example: set_teleport_enabled(enabled=True) Args: enabled: ``True`` activates the listener; ``False`` disables it. controller: Name of the UniFi controller to target. Defaults to ``"default"``. dry_run: P…

Update Threat Management (IDS/IPS) configuration. Side effects: - Patches the controller's ``ips`` setting record. When ``enabled=False`` the mode is forced to ``off``; the controller then disables packet inspection on every network. When ``enabled=True``, ``mode`` selects detection-only (``ids``) or inline blocking (``ips``). - Untouched fields (signature categories, network bindings, ad blocking, DNS filtering) are preserved by the controller's merge semantics. Supplying ``signature_categories`` replaces the active list wholesale; ``None`` leaves it unchanged. - Mutates contro…

Set the WAN uplink's IPv6 connection type and prefix delegation. Side effects: - Changes how the gateway obtains IPv6 on the WAN. **Changing ``connection_type`` tears down and re-establishes the WAN IPv6 session**: existing IPv6 connections drop and the gateway re-negotiates with the ISP (DHCPv6/SLAAC). IPv4 connectivity is not affected, but IPv6 hosts lose reachability for a few seconds to a minute. Enabling delegation (``prefix-delegation``) is what hands IPv6 prefixes down to your LANs. - Only the IPv6 keys you supply change; every other field on the WAN record is read first …

Aggregate badge events by door, user, and outcome. Side effects: None (read-only). Pulls events over the last ``hours_back`` hours (cap 500 to keep the summary tractable) and rolls them up into counts so the LLM can answer "who used which door how often" without re-aggregating client-side. Returns ``total``, ``granted``, ``denied``, plus ``by_door`` and ``by_user`` maps. Example: summarize_access_activity(hours_back=24) Args: hours_back: Look-back window in hours. Defaults to 24. controller: Name of the UniFi controller to target.

Enable or disable a traffic route without editing its other fields. Side effects: - Flips the route's ``enabled`` flag. Reads the current route first and PUTs the full object back with only ``enabled`` changed (read-modify-write), so the rest of the route is preserved. - Takes effect immediately: a disabled route stops steering its matched traffic, which then follows the default route. - Mutates controller state. Use dry_run=True to preview the change without applying. Example: toggle_traffic_route(route_id="65f...", enabled=False) Args: route_id: The ``_id`` from ``list_traffic…

Enable or disable a traffic rule without editing its other fields. Side effects: - Flips the rule's ``enabled`` flag. Reads the current rule first and PUTs the full object back with only ``enabled`` changed (read-modify-write), so the rest of the rule is preserved. - Takes effect immediately: a disabled BLOCK rule stops blocking; a disabled ALLOW rule stops allowing. - Mutates controller state. Use dry_run=True to preview the change without applying. Example: toggle_traffic_rule(rule_id="65f...", enabled=False) Args: rule_id: The ``_id`` from ``list_traffic_rules``. enabled:…

Kick off a UniFi speed test on the WAN link. Side effects: None on the controller's persistent state. Issues a one-shot WAN measurement that consumes WAN bandwidth for ~30-60 seconds while the test runs server-side. Use ``get_speedtest_results`` to read the result once it finishes. Example: trigger_speedtest(controller="default") Args: controller: Name of the UniFi controller to target. Defaults to ``"default"``.

Unblock a previously-blocked client by MAC. Side effects: - Removes the MAC from the controller's user-block list. The client can re-associate immediately. - Mutates controller state. Use dry_run=True to preview the change without applying. Example: unblock_client(mac="aa:bb:cc:00:00:01") Args: mac: Client MAC address (e.g. ``"aa:bb:cc:00:00:01"``). controller: Name of the UniFi controller to target. Defaults to ``"default"``. dry_run: Preview the change without applying it. Returns the predicted change set.

Patch fields on an existing content-filtering profile (read-modify-write). Side effects: - Modifies the named profile in place. The v2 PUT replaces the whole object, so this reads the current profile first and merges ``updates`` onto it before writing: only the keys you supply change, everything else (scope, schedule, the other lists) is preserved. - Takes effect immediately on DNS resolution for the in-scope clients and networks: enabling a category starts blocking it; adding a ``block_list`` domain starts NXDOMAIN-ing it. - List fields (``categories``, ``allow_list``, ``block_list…

Patch fields on an existing Dynamic DNS config. Side effects: - Modifies the named DDNS config in place. Only fields supplied in ``updates`` change; everything else is preserved. - Takes effect immediately: changing ``host_name`` or ``service`` repoints the next update; toggling ``enabled`` starts or stops updates. - Mutates controller state. Use dry_run=True to preview the change without applying. Example: update_dynamic_dns(ddns_id="65f...", updates={"enabled": False}) Args: ddns_id: The ``_id`` from ``list_dynamic_dns``. updates: Partial DDNS record. Common keys: ``servic…

Rename a firewall group or replace its members (read-modify-write). Side effects: - Replaces the group's name and/or members in place. The members list is **replaced wholesale**, not merged, so pass the full desired set. The group's ``group_type`` is preserved (it is read first and written back unchanged); group type cannot be changed after creation, only members. - Every rule referencing this group immediately sees the new members. - Mutates controller state. Use dry_run=True to preview the before/ after diff without applying. Read first: call ``get_firewall_group_details`` to see…

Change a Zone-Based Firewall policy you created (Integration API). Side effects: - Reads the policy, applies the changes, and PUTs the whole policy back, since the v1 PUT replaces it. Takes effect on the next packet. - Refuses controller-managed policies (predefined or derived return traffic): only ``metadata.origin == "USER_DEFINED"`` is editable. - Mutates controller state. Use dry_run=True to preview the before and after bodies without applying. Verified write: after the PUT the policy is re-read and the response carries it plus a ``verification`` block (``verified``, ``persisted_fi…

Patch fields on an existing firewall rule. Side effects: - Modifies the named rule in place. Only fields supplied in ``updates`` change; everything else is preserved. - Takes effect immediately on the next packet hitting the affected datapath. - Mutates controller state. Use dry_run=True to preview the change without applying. Verified write: after applying, the rule is re-read from the controller and the response carries the rule's fields plus a ``verification`` block (``verified``, ``mutation_applied``, ``persisted_fields``, ``unchanged_fields``, ``dropped_fields``, ``coerced_fields`…

Patch fields on an existing port-forward rule. Side effects: - Modifies the named forward in place. Only fields supplied in ``updates`` change. - Takes effect immediately on the next inbound packet. - Mutates controller state. Use dry_run=True to preview the change without applying. Verified write: after applying, the rule is re-read from the controller and the response carries a ``verification`` block listing ``persisted_fields``, ``unchanged_fields`` (already correct before the write), ``dropped_fields`` (silently discarded by the controller), ``coerced_fields`` (stored with a differen…

Patch fields on an existing port profile. Side effects: - Modifies the named profile in place. Every switch port currently using the profile picks up the new behaviour on the next provision (typically within seconds). - Changing ``native_networkconf_id`` may move powered devices to a different VLAN. - Mutates controller state. Use dry_run=True to preview the change without applying. Example: update_port_profile(profile_id="65f...", updates={"poe_mode": "off"}) Args: profile_id: The ``_id`` from ``list_port_profiles``. updates: Partial profile record. Common keys: ``name``, …

Patch fields on an existing static route. Side effects: - Modifies the named route in place. Only fields supplied in ``updates`` change; everything else is preserved. - Takes effect immediately on the gateway's routing table. - Mutates controller state. Use dry_run=True to preview the change without applying. Example: update_route(route_id="65f...", updates={"enabled": False}) Args: route_id: The ``_id`` from ``list_routes``. updates: Partial route record. Common keys: ``name``, ``enabled``, ``static-route_network`` (destination CIDR), ``static-route_nexthop`` (n…

Convert or update an existing client to a fixed-IP reservation. Use this instead of ``create_static_dhcp_lease`` when the MAC already has a user record on the controller (any client that has ever connected). The controller rejects POST ``/rest/user`` for known MACs with ``api.err.MacUsed``; this tool resolves the existing ``_id`` and PUTs an update to ``/rest/user/{_id}`` instead. Side effects: - Sets ``use_fixedip=true`` and pins ``fixed_ip`` on the user record. - If ``local_dns_record`` is supplied, also sets ``local_dns_record_enabled=true`` so the name resolves on the LAN (controller…

Patch fields on an existing traffic route (read-modify-write). Side effects: - Modifies the named policy route in place. The v2 PUT replaces the whole object, so this reads the current route first and merges your changes onto it before writing — only the keys you supply change. - Changes where matched traffic is routed (and, via ``kill_switch_enabled``, whether it is dropped when the route's interface is down). Takes effect immediately. - Mutates controller state. Use dry_run=True to preview the change without applying. Example: update_traffic_route(route_id="65f...", kill_switch_e…

Patch fields on an existing traffic rule (read-modify-write). Side effects: - Modifies the named rule in place. The v2 PUT replaces the whole object, so this reads the current rule first and merges ``updates`` onto it before writing — only the keys you supply change. - Takes effect immediately on matching traffic. - Mutates controller state. Use dry_run=True to preview the change without applying. Example: update_traffic_rule(rule_id="65f...", updates={"action": "ALLOW"}) Args: rule_id: The ``_id`` from ``list_traffic_rules``. updates: Partial traffic-rule record to merge. Com…

Patch fields on an existing VLAN/network record. Side effects: - Modifies the named network in place. Only fields supplied in ``updates`` change; everything else is preserved. - Changes to ``vlan`` or ``ip_subnet`` may disconnect clients on the affected network. A change to ``ip_subnet`` that would leave the existing ``dhcpd_start`` / ``dhcpd_stop`` outside the new subnet is refused unless both are passed in the same update, because the controller keeps the old pool and the network then hands out no addresses. - Mutates controller state. Use dry_run=True to preview the change wi…

Patch fields on an existing WiFi SSID. Side effects: - Modifies the named WLAN in place. Only fields supplied in ``updates`` change; everything else is preserved. - Changes to ``security``, ``wpa_mode``, or ``x_passphrase`` may disconnect connected clients until they re-authenticate. - Passphrases passed via ``x_passphrase`` are redacted in the response. - Mutates controller state. Use dry_run=True to preview the change without applying. Verified write: after applying, the WLAN is re-read from the controller and the response carries a ``verification`` block listing ``persisted_fields…