UniFi Network MCP

Create a V2 zone-based firewall policy with schema validation. Required: name, action (ALLOW/BLOCK/REJECT), source (zone_id + matching_target), destination (same structure). For specific IP targeting: matching_target='IP', matching_target_type='SPECIFIC', ips=[...]. For network targeting: matching_target='NETWORK', matching_target_type='OBJECT', network_ids=[...]. For any in zone: matching_target='ANY'. For client targeting: matching_target='CLIENT', client_macs=[...]. For port targeting (same source/destination dict): port_matching_type='SPECIFIC', port='53,853' (a single string, not a 'ports…

Create a new firewall zone. Zones group networks for zone-based firewall policy targeting. Network assignment happens separately via firewall_zone_id on unifi_update_network. Requires a UniFi API key (UNIFI_API_KEY) and session authentication. Returns a V2 controller ObjectID, not an Integration API UUID. Requires confirmation.

Create an IPv4 V2 NAT rule (DNAT, SNAT or MASQUERADE) with verified readback; disabled by default. Requires Network session credentials. The assigned rule_index is chosen again at confirmation. These IDs are scoped to the V2 NAT tool family — do not pass them to port-forward or Integration API tools.

Create a new network (LAN/VLAN) with schema validation. Guest creation requires an explicit, verified built-in Hotspot firewall_zone_id and network isolation disabled. Guest previews validate the live zone; confirmed creates verify both guest purpose and zone. Updating purpose to guest remains unsupported. VPN entries may only specify the system-defined Vpn firewall zone; custom zones are persisted without enforcement and therefore rejected. Confirmed creates are read back and report exact persisted, dropped, and coerced fields; a failed result may still identify a created resource for cleanup…

Create a new OON (Object-Oriented Network) policy for internet access scheduling, app blocking, bandwidth limiting, or VPN routing. IMPORTANT: qos and route must be full nested dicts (not the flattened qos_enabled/route_enabled booleans from list output). Use unifi_get_oon_policy_details on an existing policy as a template for the nested structure. Requires confirmation.

Create a new port forwarding rule on your Unifi Network controller using schema validation. Requires confirmation.

Create a new port profile. forward values: 'native' (access port), 'all' (trunk), or 'customize' (selective trunk). Port State (Active/Disabled) is a separate controller setting that these port-profile tools do not currently expose. tagged_vlan_mgmt is the access-vs-trunk control ('auto'/'block_all'/'custom'): the controller rewrites forward to agree with it, so an access port needs forward='native' with tagged_vlan_mgmt='block_all'. Port Mode in the UI maps to stp_edge_state + stp_bpdu_guard_enabled + stp_uplink (Edge = 'enabled'/true/false). Requires confirmation.

Create a new QoS rule on the Unifi Network controller. Requires confirmation.

Create a new static route for advanced routing configuration. Specify destination network in CIDR format (e.g., "10.0.0.0/24") and next-hop IP address (e.g., "192.168.1.1").

Create a port forward using a simplified schema. Returns a preview unless confirm=true.

Create a QoS rule using a simplified high-level schema. Returns a preview unless confirm=true.

Create a narrowly scoped Traffic Route (policy-based route). Requires confirmation. An explicit matching_target and target network/VPN are required. DOMAIN routes require at least one domain. INTERNET routes are allowed only for one explicit CLIENT with a valid unicast MAC address when the target is a verified WAN network.

Create a new user group (bandwidth profile) with optional speed limits. Bandwidth limits are specified in Kbps. Use -1 for unlimited. User groups can be assigned to clients to enforce bandwidth policies.

Create hotspot voucher(s) for guest network access. Vouchers can have: - Time limits: How long the voucher is valid after activation - Usage quota: Single-use (1), multi-use (0), or n-times usable - Bandwidth limits: Upload/download speed caps in Kbps - Data caps: Total data transfer limit in MB

Create a new Wireless LAN (WLAN/SSID) with schema validation. Confirmed creates are read back and report exact persisted, dropped, and controller-coerced fields; a failed result may still identify a created WLAN for cleanup. Requires confirmation.

Delete a MAC ACL rule. Requires confirmation. WARNING: Removing an ALLOW rule may block device communication. Removing a BLOCK rule may open access.

Delete an AP group by ID. Requires confirmation. WARNING: APs in this group may lose their SSID assignments.

Delete a backup file from the controller. Use unifi_list_backups to find filenames. Requires confirmation.

Delete a client group. Requires confirmation. WARNING: Deleting a group may affect OON policies and firewall rules that reference it.

Delete a content filtering profile. Requires confirmation. WARNING: Deleting a profile removes DNS-based blocking for all targeted clients/networks.

Delete a static DNS record. Use unifi_list_dns_records to find record IDs. Requires confirmation.

Delete a Dynamic DNS entry. Use unifi_list_dynamic_dns to find entry IDs. Requires confirmation.

Delete a firewall group. Requires confirmation. WARNING: Firewall policies referencing this group via ip_group_id or port_group_id may break.

Delete a firewall policy by ID. Requires confirmation. WARNING: Removing an ALLOW rule may block traffic. Removing a BLOCK rule may open access.

Delete a firewall zone by ID. System-defined zones cannot be deleted. Requires a UniFi API key (UNIFI_API_KEY) and session authentication. The ID must come from unifi_list_firewall_zones; it is a V2 controller ObjectID, not an Integration API UUID. Requires confirmation.

Delete a manual V2 NAT rule and verify its absence. Requires Network session credentials. These IDs are scoped to the V2 NAT tool family — do not pass them to port-forward or Integration API tools.

Delete a LAN/VLAN network by ID. Requires confirmation. Only LAN-class networks (purpose corporate/guest/vlan-only) are deletable; WAN uplinks and VPN networkconf entries are refused. WARNING: dependent WLANs, clients, routes, and firewall policies may lose connectivity or become invalid.

Delete an OON policy. Requires confirmation. WARNING: This will remove the policy and all associated firewall rules that were auto-generated from it.

Delete a port forwarding rule by ID. Requires confirmation. WARNING: This permanently removes the rule; external access to the forwarded service will stop. It cannot be undone - you must recreate the rule to restore it.

Delete a port profile. System profiles with attr_no_delete=true cannot be deleted. WARNING: Switch ports using this profile will revert to defaults. Requires confirmation.

Delete a VPN client configuration by ID. Requires confirmation.

Delete a WLAN/SSID by ID. Requires confirmation. WARNING: All devices using this SSID will be disconnected.

Force re-provision a device, pushing the current configuration from the controller to the device. Works on any UniFi device (switches, APs, gateways). Useful after manual changes or to resolve config drift. Requires confirmation.

Force a client to reconnect to the network (kick) by MAC address

Remove/forget a client from the controller's known client history by MAC address. This permanently deletes the client record including its name, notes, fixed IP settings, and historical stats. The client will reappear as a new unknown device if it reconnects.

Get detailed configuration for a specific MAC ACL rule by ID. Returns the same field names as unifi_list_acl_rules.

Get recent alerts from the Unifi Network controller

Get network anomaly detection events.

Get details of a specific AP group by ID, including member APs and WLANs.

Get auto-backup settings (enabled state, schedule, retention count, cloud backup).

Returns client data for one client by MAC address. By default (summary=false) returns the full raw client object — all controller-reported fields, with the typed/normalized shape (ISO timestamps, derived status, null-safe name/hostname) layered on top of the merged live /stat/sta + /rest/user data. Set summary=true to trim to selected sections via include (basic, network, wireless, traffic, fingerprint, all). For a summary of all clients, use unifi_list_clients.

Get per-client DPI traffic data by application or category. On Network 9.x+ this reads the v2 traffic aggregate for the window (default: last 24h); older controllers fall back to the legacy per-site/per-client DPI endpoint, which has no window. upload_bytes is what the client sent. application/category are numeric DPI IDs — resolve names with unifi_list_dpi_applications / unifi_list_dpi_categories; 65535/255 means unidentified (typically encrypted QUIC/TLS). The controller aggregates DPI in coarse buckets, so totals for windows that cut through a bucket are approximate: use DPI for what kind o…

Get detailed configuration for a specific client group by ID.

Get client session history. Note: this endpoint tracks hotspot/captive portal authorization sessions, not general WiFi connect/disconnect events. Returns empty without a guest portal configured. For WiFi roaming events, use the event log instead.

Get a client's traffic time-series from the controller's per-client report. summary.upload_bytes is what the client sent and summary.download_bytes what it received (the report's rx_bytes/tx_bytes, counted from the network side). Pass start/end to inspect a past incident window. Wired clients are not metered per client in this report on current gateways, so an empty series for a wired client means 'not reported', not 'no traffic'.

Get detailed WiFi statistics for a single wireless client including signal, noise, satisfaction, tx/rx rates, retries, roam count, channel, radio, ESSID, and more.

Get detailed configuration for a specific content filtering profile by ID. Returns the full profile including categories, client MACs, network IDs, safe search settings, and allow/block lists.

Get the pre-aggregated site dashboard. Defaults to a compact summary that omits high-volume activity/history series; pass summary=false to preserve raw dashboard entries.

Returns device data for one device by MAC address. By default (summary=false) returns the full raw device object — all controller-reported fields including radio tables, port tables, system stats, WAN info, firmware details. Set summary=true to trim to selected sections via include (basic, ports, radios, stats, uplink, lldp, all). Port fields (summary mode): - last_seen_mac: last MAC that sent traffic on port (may be wireless client traffic, not reliable) - lldp_neighbor: actual connected infrastructure device (from LLDP, reliable for switches/APs) Examples: <no args> (full raw); summary=tru…

Get radio configuration and live statistics for a device with radios (AP, or UDM/gateway with built-in WiFi). Returns per-band config (channel, tx_power, channel width, min_rssi) and live stats (actual tx_power, channel utilization, client count, retries).

Returns historical traffic time-series (rx/tx bytes, client counts) for one device by MAC or _id. Duration: hourly/daily/weekly/monthly. For APs, includes avg/max client counts and WiFi quality metrics. For current device status instead of stats, use unifi_get_device_details.

Get details for a specific DNS record by ID.

Get Deep Packet Inspection (DPI) statistics (applications and categories)

Get details for a specific Dynamic DNS entry by ID. The provider password/token is redacted.

Get recently observed exact event keys for filtering events. Use a returned key with the unifi_list_events event_type parameter. Keys are sampled from the 1,000 most recent events within the last 7 days, so event types absent from that sample are not included.

Get detailed configuration for a specific firewall group by ID.

Get detailed configuration for a specific firewall policy by ID.

Get user-defined firewall policy ordering for a source/destination firewall zone pair. Returns policy IDs from the UniFi public integration API (UUIDs); these IDs are scoped to the ordering tool family — pass them ONLY to unifi_reorder_firewall_policies. They do NOT correspond to the policy IDs returned by unifi_list_firewall_policies or any other controller-API firewall tool. Requires a UniFi API key (UNIFI_API_KEY) and session credentials. The current ordering path requires a legacy connection even when Integration zone UUIDs are supplied.

Get the gateway (USG) settings: security (GeoIP filtering, SYN cookies, ICMP redirects, DNS verification), NAT/UPnP (UPnP, NAT-PMP, MSS clamp), connection-tracking ALG modules (FTP/GRE/H.323/PPTP/SIP/TFTP), hardware offloading, and conntrack timeouts. Read-only; use unifi_update_gateway_settings to change values.

Get gateway WAN/LAN performance history including bandwidth, CPU, and memory utilization.

Collects bounded, read-only Network event evidence for one incident window. Returns a unifi-incident-evidence-view by default: every source's coverage, failures and budget usage plus a bounded list of record citations, with omitted records counted; detail='full' returns the whole unifi-incident-evidence document. Stops at the first spent budget and says so; check coverage_complete before treating an empty result as an all-clear.

Get IPS/IDS security events (intrusion detection/prevention alerts). Reads the legacy IPS endpoint and, when it is empty or gone (Network 10.x), the SECURITY category of the v2 system log, where threat blocks are recorded. For other security event types use unifi_list_events with categories=['SECURITY'].

Get LLDP neighbor discovery table for a switch. Shows what devices are connected to each port by their LLDP-advertised chassis ID and descriptions. Use unifi_list_devices to find switch MAC addresses.

Get site-wide mDNS service settings and read-only network scope.

Get the site's device management (mgmt) settings, read-only: device SSH state and user name, password-auth flag, authorised-key count, whether an SSH password, password hash, management key and API token are stored (presence only; values never returned), debug tools, auto-upgrade and its hour.

Get a NAT rule from the V2 controller API. Requires Network session credentials. These IDs are scoped to the V2 NAT tool family — do not pass them to port-forward or Integration API tools.

Description is built at runtime.

Returns per-subsystem health status for WAN, LAN, WLAN, and VPN — each with status, number of gateways/switches/APs, and active user counts. Use to check WAN connectivity, see how many devices are online per subsystem, or detect degraded network segments. For controller-level info (version, uptime), use unifi_get_system_info.

Get network statistics from the Unifi Network controller

Get detailed configuration for a specific OON policy by ID. Returns the full policy object including secure, qos, route sections and targets.

Return per-outlet state for a UniFi Smart Power PDU (UP6 / USP-Strip). Combines the device's sensed outlet_table (live relay_state, cycle_enabled, has_relay, has_metering) with the controller's desired outlet_overrides so callers see both reported and intended state per outlet. Returns an error if the device is not a PDU.

Get a specific port forwarding rule by ID from your Unifi Network controller.

Get detailed configuration for a specific port profile by ID. Returns full profile including VLAN, isolation, PoE, STP, 802.1X, storm control, and QoS settings.

Get live port statistics for a switch. Returns per-port data including link speed, duplex, PoE draw (voltage/current/power), error counters, MAC table count, bytes per second, and enabled state. Use unifi_list_devices to find switch MAC addresses.

Get details for a specific QoS rule by ID.

Get RF spectrum scan results for an access point. Returns per-channel interference levels (dBm), utilization (%), and BSS counts for each radio band. Trigger a scan first with unifi_trigger_rf_scan if no results are available. Scans take 5-10 minutes — if spectrum_scanning is true, the scan is still in progress.

Get detailed information about a specific static route by its ID

Get actual DPI traffic data by application or category for the entire site. Shows real bandwidth usage per app/category, NOT restriction configuration. Use unifi_get_dpi_stats for restriction config instead. On Network 9.x+ this reads the v2 traffic aggregate for the window (default: last 24h); older controllers fall back to the legacy per-site/per-client DPI endpoint, which has no window. upload_bytes is what the client sent. application/category are numeric DPI IDs — resolve names with unifi_list_dpi_applications / unifi_list_dpi_categories; 65535/255 means unidentified (typically encrypted …

Get current site settings: site identity, regulatory country code, timezone, connectivity monitor (enabled, uplink type) and NTP servers.

Get current SNMP settings for the site: v1/v2c enabled state and community string, SNMPv3 enabled state and user name. The two services are independent flags on one record. The community string and the v3 password are returned by the controller and always shown redacted by this tool.

Get historical speedtest results including download, upload (Mbps), and latency (ms).

Check the status of a running speedtest on the gateway.

Get switch hardware capabilities including max ACL rules, max VLANs, max aggregation sessions, max mirror sessions, STP config, and jumbo frame status. Use unifi_list_devices to find switch MAC addresses.

Get port assignments for a specific switch. Shows which port profile is assigned to each port, port names, and PoE mode. Use unifi_list_devices to find switch MAC addresses.

Returns controller version, uptime, hostname, memory/CPU usage, and update availability. Use for basic 'is the controller healthy?' checks. For network subsystem status (WAN/LAN/WLAN), use unifi_get_network_health instead. For network subsystem details, use unifi_get_network_health.

Get site-wide threat management (IDS/IPS) and traffic identification settings. Requires Network session credentials.

Get CyberSecure threat posture for HOUR, DAY, WEEK, or MONTH, including allowlisted gateway signature status. Requires Network session credentials. Counts and timestamps may be unknown (null); timestamps are milliseconds. Gateway device IDs are scoped to the legacy Network device family, not public Integration API device UUIDs.

Rank clients by traffic inside a time window — the first call when working an upload or egress spike ('who sent data between 02:00 and 05:00?'). Sums the controller's per-client report over the window; upload_bytes is what each client sent, download_bytes what it received. Use sort_by='upload' for exfiltration questions. Covers clients the controller meters individually (wireless on current gateways); wired clients, cluster nodes included, are absent. Entries with source='live_counters' are a fallback for controllers without the report and are cumulative since association, not scoped to the wi…

Aggregated UniFi Traffic Flows summary (Insights > Flows 'Flow Summary'). Returns risk and region count breakdowns plus Top-Talker rankings for a preset period: top clients, top destinations, top applications (by bytes), top blocked clients, and top blocking policies. Risk bands are low/medium/high (the UI labels these Low/Suspicious/Concerning). Application entries include best-effort DPI application/category names resolved from the controller catalogue; names remain null when the catalogue is unavailable or has no matching entry. The returned application_id is the low V2 traffic-flow applica…

Query historical UniFi Traffic Flows (Insights > Flows). Returns completed flow records — source/destination (incl. resolved destination domains), service, risk, action, bytes, and timestamps — for a time window, with server-side filtering and pagination. Supply both time_from and time_to (epoch ms) for an explicit window, or use within_hours. Read-only; one page per call (use page/total_page_count to paginate).

Get detailed information for a specific traffic route by ID.

Get detailed information about a specific user group by its ID

Get detailed information about a specific voucher by its ID

Get details for a specific VPN client by ID.

Get details for a specific VPN server by ID.

Get details for a specific WLAN by ID.

List MAC ACL rules (Policy Engine) for Layer 2 access control. These rules control which devices can communicate at Layer 2 within a VLAN.

List all active routes from the device routing table. Includes both user-defined and system routes currently in effect. This shows the actual routing table state on the gateway device. Note: This endpoint may not be available on all controller versions. Returns empty list if unavailable.

Returns active alarms (security alerts, connectivity issues, firmware warnings). Each alarm includes type, message, timestamp, and related device/client MAC. By default shows only unresolved alarms; set include_archived=true for history. For general event logs (non-critical), use unifi_list_events.

List all AP groups configured on the controller. AP groups control which access points broadcast which SSIDs. Returns group names, IDs, and associated AP/WLAN memberships.

List allowed RF channels for the site's regulatory domain. Returns per-band channel lists with DFS status and max power. Useful for planning channel assignments.

List available backups on the controller. Returns filename, datetime, size, and version for each backup.

Lists clients/devices currently blocked from the network. Each entry includes mac, hostname, name, last_seen, blocked. Pass an entry's mac to unifi_unblock_client as mac_address.

List client groups (network member groups). Groups organize devices by MAC address for use in OON policies and firewall rules.

Returns connected clients with mac, name, hostname, ip, status (online/offline), connection type (wired/wireless), and for wireless clients: ssid, signal_dbm, channel, radio. Filter by filter_type (all/wired/wireless), set include_offline=true for historical clients. Use search to filter by name/hostname/IP/MAC (case-insensitive). For a single client's full raw object, use unifi_get_client_details. For IP-to-client lookup, use unifi_lookup_by_ip. Pass an entry's mac to the client tools as mac_address (unifi_get_client_details, unifi_block_client, unifi_rename_client, unifi_get_client_sessions,…

List content filtering profiles. Profiles control DNS-based category blocking, safe search enforcement (GOOGLE, YOUTUBE, BING), and domain allow/block lists. Profiles can target specific clients by MAC or entire networks by ID. Common categories: FAMILY, ADVERTISEMENT, MALWARE, PHISHING, BOTNETS, SPAM, SPYWARE, HACKING, ANONYMIZERS, DNS_TUNNELING, ADULT, ALCOHOL, DRUGS, GAMBLING, VIOLENCE, PORNOGRAPHY, NUDITY, WEAPONS, DATING, HATE_SPEECH_AND_EXTREMISM, CHILD_ABUSE, CIPA, EMPTY_DOMAINS, NEWLY_DISCOVERED_DOMAINS, PARKED_DOMAINS, UNREACHABLE_DOMAINS.

Returns adopted device inventory with MAC, name, model, IP, firmware version, uptime, status (online/offline/upgrading/etc), device_category (ap/switch/gateway/pdu), upgradable flag, connection_network, uplink topology, load_avg, mem_pct, and model_eol. Filter by device_type (ap/switch/gateway/pdu) and status (online/offline/pending/upgrading). Note: device_type=ap correctly excludes USP Smart Power strips. Use search to filter by name, IP, or MAC (case-insensitive). Set include_details=true for additional per-device fields: by default (summary=true) compressed radio/port summaries; set summar…

List all static DNS records configured on the controller. Returns hostname, value, record type, enabled state, and TTL for each record.

List DPI applications available for use in firewall rules and OON policies. Returns application names and their compound IDs. Supports name-based search. NOTE: The official API currently only returns categories 0-1 (IM, P2P). Streaming, social media, and other categories are not yet populated by Ubiquiti. For apps not found here, add via the UniFi UI and read back the IDs from the policy. Requires UNIFI_API_KEY or UNIFI_NETWORK_API_KEY.

List DPI application categories (e.g., 'Instant messengers', 'Peer-to-peer networks', 'Media streaming services'). Categories group applications for DPI classification. Requires UNIFI_API_KEY or UNIFI_NETWORK_API_KEY.

List all Dynamic DNS provider entries configured on the controller. Returns hostname, service/provider, WAN interface, login, and options for each entry. The provider password/token is redacted.

Returns timestamped event log entries (client connects/disconnects, device state changes, firmware updates, config changes) sorted newest-first. Filter by within_hours (default 24), an exact event_type key (use unifi_get_event_types for recently observed keys), categories (for example ['SECURITY']) and severities (for example ['HIGH', 'VERY_HIGH']) on v2 controllers, and paginate with start/limit. For critical alerts specifically, use unifi_list_alarms instead.

List firewall groups (address and port groups) used as reusable objects in firewall policies. Address groups contain IP addresses/CIDRs, port groups contain port numbers/ranges. These are referenced by firewall policies via ip_group_id and port_group_id fields.

List firewall policies configured on the Unifi Network controller. Returns V2 zone-based targeting (zone_id, matching_target, matching_target_type, IPs, network IDs, client MACs, IP/port groups, port matching). Filters: search (name substring), action (ALLOW/BLOCK/REJECT), enabled_only, limit (default 50), include_predefined. By default (summary=true) returns a curated entry per policy (id, name, enabled, action, rule_index, description, protocol + source/destination targeting incl. port_matching_type/port/port_group_id when set). Set summary=false for the full fw_from_controller().model_dump…

List controller firewall zones (V2 API). Returned IDs are V2 controller ObjectIDs, not Integration API UUIDs; use them with the firewall-zone CRUD tools and network firewall_zone_id.

List legacy pre-zone-based firewall rules from the UniFi controller. Use this on sites that still use the legacy firewall engine and return no V2 zone-based firewall policies. Returns ruleset, rule_index, action (lowercase accept/drop/reject), source and destination addresses, ports, networks and firewall groups, protocol, connection-state matching, logging, and enabled state.

List NAT rules from the V2 controller API. Requires Network session credentials. These IDs are scoped to the V2 NAT tool family — do not pass them to port-forward or Integration API tools.

Returns configured networks (LAN, WAN, VLAN-only) with name, purpose, IP subnet, VLAN ID, DHCP settings, and enabled state. Use to understand network topology and VLAN layout. Filters: search (name/VLAN substring), purpose (corporate/guest/wan/vlan-only), limit (default 25), fields (comma-separated subset). For a single network's full config, use unifi_get_network_details. For wireless SSIDs, use unifi_list_wlans. API-key inventory uses legacy reads when supported, otherwise limited public inventory. Public results include source_api=integration and integration_id; missing legacy fields are un…

List OON (Object-Oriented Network) policies. These policies control internet access schedules (bedtime blackouts), application blocking (social media, streaming), QoS, and policy-based routing.

List all port forwarding rules on your Unifi Network controller.

List all port profiles (port configurations) on the controller. Port profiles define VLAN assignment, port isolation, PoE mode, STP, 802.1X, and storm control settings. Profiles are assigned to switch ports via port overrides.

List all QoS rules on the Unifi Network controller for the current site.

List neighboring/rogue APs detected by your access points. Defaults to a compact 100-record page; pass summary=false for raw records in the selected page. Filters apply before pagination, limit is at most 500, and pagination metadata includes total_count, returned_count/count, limit, offset, next_offset, and has_more.

List all user-defined static routes for the current site. Returns route names, destination networks, next-hop addresses, and status. These are manually configured routes, not dynamic or system routes.

List all traffic routes (policy-based routing rules) for the current site. Traffic routes define how specific traffic is routed based on domains, IP addresses, regions, or target devices. Often used for VPN routing.

List all user groups (bandwidth profiles) for the current site. User groups define bandwidth limits that can be applied to clients. Each group specifies upload/download speed caps in Kbps.

List hotspot vouchers for the current site. Returns voucher codes, expiration times, usage quotas, and bandwidth limits. Vouchers are used for guest network access in captive portal setups. Supports optional limit, offset, case-insensitive search by code or note (including UI hyphenated codes), and strict fields projection. Deterministic pagination sorts by created_at descending with id descending tie-break for shaped calls; unshaped calls preserve controller return order for backward compatibility.

List all configured VPN clients (Wireguard, OpenVPN, etc).

List all configured VPN servers (Wireguard, OpenVPN, L2TP, etc).

List configured Wireless LANs (WLANs) on the Unifi Network controller. Filters: search (SSID name substring), enabled_only, limit (default 25). API-key inventory uses legacy reads when supported, otherwise limited public inventory. Public results include source_api=integration and integration_id; missing legacy fields are unknown. These IDs are scoped to the Integration inventory tool family — do not pass them to other resource tools. Full details and mutations can require session credentials.

Toggle device locate mode (LED blinking) to physically identify a device. Works on any UniFi device (switches, APs, gateways). Requires confirmation.

Quick IP-to-client lookup. Returns essential fields (hostname, name, mac, is_online, last_seen) to minimize token usage.

Power cycle PoE on a specific switch port. This briefly cuts power to the connected PoE device, causing it to reboot. Requires confirmation.

Reboot a specific device by MAC address

Get recent events from the in-memory websocket buffer. This is fast (no API call) and returns events received via the real-time websocket stream. Supports filtering by exact event_type key, client/device mac, and limit. Use this for real-time monitoring; use unifi_list_events for historical queries. The response reports whether the listener is running (listening) and attached to the controller (attached, with last_error when not), the buffer occupancy (buffer_size) and its capacity (buffer_capacity); an empty buffer with attached=false is not 'no events'.

Rename a client/device in the Unifi Network controller by MAC address

Rename a device in the Unifi Network controller by MAC address

Reorder user-defined firewall policies for a source/destination firewall zone pair. Pass the complete orderedFirewallPolicyIds object obtained from unifi_get_firewall_policy_ordering (beforeSystemDefined + afterSystemDefined arrays). These IDs are integration-API UUIDs scoped to the ordering tool family — they are NOT the policy IDs returned by unifi_list_firewall_policies. Requires confirmation and a UniFi API key (UNIFI_API_KEY) and session credentials. The current ordering path requires a legacy connection even when Integration zone UUIDs are supplied.

Revoke/delete a hotspot voucher by its ID, preventing further use

Enable or disable a wireless client's fixed access-point association. Enabling requires the MAC address of an adopted access point. Disabling preserves the controller's inactive AP MAC. This legacy write requires Network session authentication.

Set fixed IP address and/or local DNS record for a client device. Allows configuring: - Fixed IP: Assign a static IP address to a client (DHCP reservation) - Local DNS: Create a local DNS hostname for the client (UniFi Network 7.2+) Either setting can be enabled/disabled independently.

Set the LED override state on a specific device. Use 'on' to force LEDs on, 'off' to force them off, or 'default' to use site-wide setting. Requires confirmation.

Enable or disable jumbo frames on a switch. Note: the UniFi controller requires jumbo frames to be enabled via the UI at least once before the API can toggle it. If you get JumboFrameChangeNotAllowed, enable it in the UI first. Requires confirmation.

Set per-outlet relay state (on/off) and optionally cycle_enabled on a UniFi Smart Power PDU (UP6 / USP-Strip). The controller stores per-outlet desired state in the outlet_overrides array on the device document; this tool reads the existing array, replaces only the entry whose index matches outlet_index, and PUTs the full array back -- preserving all sibling outlets' overrides (name, relay_state, cycle_enabled) verbatim. If no override exists for the target outlet yet, one is created from the outlet's current sensed state. Use unifi_get_pdu_outlets first to inspect current state.

Toggle all device LEDs site-wide on or off. This sets the global LED policy for the site — individual device overrides take precedence. Requires confirmation.

Assign a port profile to a specific switch port. IMPORTANT: This sends ALL port overrides as a full replacement. Fetch current overrides with unifi_get_switch_ports first, modify the target port, and send the complete array. Missing ports revert to defaults. Requires confirmation.

Returns a handle describing how to subscribe to live network events. Provides the MCP resource URI for the event stream and pointers to the buffered-event tool, plus whether the websocket listener is running (listening) and attached (attached, last_error) and the buffer occupancy and capacity. Use this to set up continuous event monitoring.

Enable or disable a device without unadopting it. A disabled device remains adopted but stops passing traffic. Requires confirmation.

Enable or disable a specific firewall policy by ID.

Set a manual V2 NAT rule's enabled state explicitly; setting its current state is a no-op. Pass only the fields you want to change — current values are automatically preserved. A full fetch-merge-put can overwrite a concurrent edit between fetch and PUT. Requires Network session credentials. These IDs are scoped to the V2 NAT tool family — do not pass them to port-forward or Integration API tools.

Toggle an OON policy on or off. Fetches the current state, flips the enabled flag, and sends the update. Requires confirmation.

Toggle a port forwarding rule on or off on your Unifi Network controller.

Enable or disable a specific QoS rule by ID. Requires confirmation.

Toggle a traffic route on/off by ID. Enabling an INTERNET route requires one explicit CLIENT target with a valid unicast MAC address and a verified WAN network.

Toggle a WLAN/SSID on or off. Requires confirmation.

Trigger an RF spectrum scan on an access point. Requires confirmation. The scan takes 5-10 minutes to complete. Some APs have a dedicated scanning radio and scan without going offline; others briefly go off-channel which may cause momentary client disconnections. Poll unifi_get_rf_scan_results periodically — results appear only after the scan finishes. Returns per-channel interference levels and utilization across all bands.

Trigger a speedtest on the gateway device. Returns immediately; use unifi_get_speedtest_status to poll for results.

Revoke authorization for a guest client by MAC address

Unblock a previously blocked client/device by MAC address

Update an existing MAC ACL rule. Pass only the fields you want to change — current values are automatically preserved. Uses the same field names as unifi_list_acl_rules output: name, acl_index, action, enabled, network_id, source_macs, destination_macs, source_netmask, destination_netmask. To remove a netmask (widen a prefix rule back to an exact match), set clear_source_netmask / clear_destination_netmask = true (passing source_netmask=null is a no-op, not a clear). Requires confirmation.

Update an existing AP group's configuration. Pass only the fields you want to change — current values are automatically preserved. Requires confirmation.

Update auto-backup settings. Pass only the fields you want to change — current values are automatically preserved. Fields: autobackup_enabled (bool), autobackup_cron_expr (str, cron format), autobackup_days (int, retention days), autobackup_max_files (int, max backup files to keep), autobackup_timezone (str), autobackup_cloud_enabled (bool). Requires confirmation.

Update an existing client group. Pass only the fields you want to change — current values are automatically preserved. Requires confirmation.

Update an existing content filtering profile. Pass only the fields you want to change — current values are automatically preserved. client_macs and network_ids are additive — both can be set and the filter applies to all. Safe search valid values: GOOGLE, YOUTUBE, BING (only these three are supported). Requires confirmation.

Update radio settings for a specific band on a device with radios (AP, or UDM/gateway with built-in WiFi). Supports tx_power_mode, tx_power (custom dBm), channel, ht (channel width), min_rssi_enabled, min_rssi, assisted_roaming_enabled (802.11k/v), antenna_gain (dBi), vwire_enabled, sens_level_enabled, sens_level. Use unifi_get_device_radio first to see current settings.

Update an existing DNS record. Pass only the fields you want to change — current values are automatically preserved. Fields: key (str), value (str), record_type ('A'/'AAAA'/'CNAME'/'MX'/'TXT'/'SRV'), enabled (bool), ttl (int), port (int), priority (int), weight (int). Requires confirmation.

Update an existing Dynamic DNS entry. Pass only the fields you want to change — current values are automatically preserved. Fields: host_name (str), service (str), server (str), login (str), x_password (str), interface ('wan'/'wan2'), custom_service (str), options (list of strings). Requires confirmation.

Update an existing firewall group. Pass only the fields you want to change — current values are automatically preserved. Accepted fields are name and members; group_type cannot be changed. Requires confirmation.

Update specific fields of an existing V2 zone-based firewall policy by ID. Accepts: name, action (ALLOW/BLOCK/REJECT), enabled, source, destination, protocol, ip_version, logging, connection_state_type, connection_states, schedule. source/destination are deep-merged with the current policy and accept the same targeting and port fields as create (matching_target, port_matching_type, port, port_group_id, client_macs); the merged result is checked for port shape and selector activation, while the zone/IP/NETWORK completeness rules are checked on create only. To change policy order use unifi_reord…

Rename an existing firewall zone by ID. Only the name is mutable; network membership is managed via firewall_zone_id on the network. Requires a UniFi API key (UNIFI_API_KEY) and session authentication. The ID must come from unifi_list_firewall_zones; it is a V2 controller ObjectID, not an Integration API UUID. Requires confirmation.

Update gateway (USG) settings. Pass only the fields you want to change; current values (including nested sub-objects) are automatically preserved via deep-merge. Security: geo_ip_filtering_enabled (bool), geo_ip_filtering_block ('block'/'allow'), geo_ip_filtering_countries (CSV ISO codes), geo_ip_filtering_traffic_direction ('both'/'ingress'/'egress'), syn_cookies (bool), broadcast_ping (bool), receive_redirects (bool), send_redirects (bool), dns_verification (object). NAT/UPnP: upnp_enabled (bool), upnp_nat_pmp_enabled (bool), upnp_secure_mode (bool), upnp_wan_interface (str), mss_clamp ('aut…

Update site-wide mDNS service mode, predefined services, or custom services. Pass only the fields you want to change — current values are automatically preserved. Each provided service list replaces the entire list. Mode 'all' requires both service lists empty; mode 'custom' requires at least one service. Network scope (enabled_for and enabled_for_network_ids) is read-only and preserved. Changes may affect service discovery. Requires confirmation.

Update a manual V2 NAT rule with verified fresh readback. Pass only the fields you want to change — current values are automatically preserved. A full fetch-merge-put can overwrite a concurrent edit between fetch and PUT. Requires Network session credentials. These IDs are scoped to the V2 NAT tool family — do not pass them to port-forward or Integration API tools.

Update specific fields of an existing network (LAN/VLAN). Pass only the fields you want to change — current values are automatically preserved. Every network field below is a key inside the update_data dict, not a top-level argument, e.g. update_data={'dhcpd_enabled': false}. Unknown keys are rejected. Basic: name, purpose ('corporate'/'vlan-only'), vlan_enabled (bool), vlan (str), ip_subnet (CIDR), enabled (bool), network_isolation_enabled (bool, corporate only), internet_access_enabled (bool), upnp_lan_enabled (bool), firewall_zone_id (str, V2 firewall-zone ID — assigns the network to a zone…

Update an existing OON policy. Pass only the fields you want to change — current values are automatically preserved. Requires confirmation.

Update specific fields of an existing port forwarding rule using schema validation. Pass only the fields you want to change — current values are automatically preserved. Requires confirmation.

Update an existing port profile. Pass only the fields you want to change — current values are automatically preserved. Note: system profiles with attr_no_edit=true cannot be modified. Requires confirmation.

Update specific fields of an existing QoS rule. Requires confirmation.

Update an existing static route's properties. Can modify name, destination network, next-hop, distance, or enabled status.

Update SNMP settings for the site: v1/v2c (enabled, community) and SNMPv3 (enabled_v3, username, x_password). The two services are independent; disabling one leaves the other listening. Pass only the fields you want to change — current values are automatically preserved. Requires confirm=true to apply changes.

Update STP (Spanning Tree Protocol) configuration for a switch. stp_priority valid values: 4096, 8192, 12288, ..., 61440 (default: 32768). stp_version: 'stp' or 'rstp' (default). Requires confirmation.

Update site-wide IPS mode/category selection or traffic identification settings and verify persistence. Pass only the fields you want to change — current values are automatically preserved. Use separate calls for IPS and traffic identification fields. Category lists replace the full list and select manual filtering; codes are validated against the gateway catalog. Disabling IPS also disables filtering and clears categories; enabling requires protected networks and nonempty manual categories. Network scope is read-only. ipsInline can only be preserved if already in use. Changes may reduce inspe…

Update a traffic route's settings. Pass only the fields you want to change — current values are automatically preserved. Toggle fields: - enabled: Enable or disable the traffic route - kill_switch_enabled: Enable/disable the kill switch (blocks traffic if VPN is down) Routing-match fields (each REPLACES the whole existing list/value — read the route first with unifi_get_traffic_route_details, then send the full desired value): - target_devices: Which clients/networks the route applies to. For INTERNET routes, this must remain one explicit CLIENT target. [{"type": "CLIENT", "client_mac": "…

Update an existing user group's name or bandwidth limits. Use -1 for unlimited bandwidth. Changes affect all clients assigned to this group.

Enable or disable a specific VPN client by ID. Requires confirmation.

Update the advertised alternate hostname or IPv4 address for a WireGuard VPN server. Pass only the fields you want to change — current values are automatically preserved. Requires Network session authentication and confirmation; verifies persistence after applying. MCP previews read live state; API action previews show submitted arguments only.

Enable or disable a specific VPN server by ID. Requires confirmation.

Update specific fields of an existing WLAN (SSID). Pass only the fields you want to change — current values are automatically preserved. Every WLAN field below is a key inside the update_data dict, not a top-level argument, e.g. update_data={'enabled': false, 'hide_ssid': true}. Unknown keys are rejected. Basic: name (str), security ('open'/'wpapsk'/'wpa2-psk'), x_passphrase (str), enabled (bool), hide_ssid (bool), guest_policy (controller-dependent bool; may be reported as dropped), usergroup_id (str), networkconf_id (str). Security: wpa3_support (bool), wpa3_transition (bool), pmf_mode ('dis…

Initiate a firmware upgrade for a device by MAC address (uses cached firmware by default)