UniFi Gateway — Claude Code MCP server: Network, Protect, Access
Gives an agent tools for a self-hosted UniFi controller, with a preview of every change before it lands. Handy when touching VLANs or firewall rules by hand feels risky.
Open on GitHubWhat UniFi Gateway does
The server covers UniFi Network: devices, AP radio settings, VLANs, WLANs, firewall, switch ports, port forwards, DHCP reservations, Threat Management, Honeypot and Teleport VPN. Protect (cameras, motion events, recording) and Access (doors, credentials, visitors, badge events) are opt-in. A controller argument lets one process work across several sites at once.
Guardrails come first. Any destructive tool takes dry_run=True, which returns the predicted change set and writes nothing. Composite operations such as create_iot_network, create_guest_network, provision_homelab_service and provision_camera save the previous state and undo the steps already applied when one fails partway. Each call, real or simulated, goes into a JSONL audit log with secrets removed; the shipped mcp-unifi-replay CLI can replay that log against a clean controller. Setting MCP_UNIFI_READONLY=true hides mutating tools from the list and rejects them by name.
You need a local API key from Settings → Control Plane → Integrations, and the gateway must run UniFi Network 9.x or newer. No cloud account involved. Four routes exist: a Docker container speaking Streamable HTTP on port 3714, a .dxt bundle for Claude Desktop, a Helm chart, or uvx. Over HTTP the service refuses to start without a bearer token, so set one in advance — on an open interface every client gets admin-level reach into the controller.
What it helps with
- preview which firewall rule change will actually apply
- roll back a half-finished guest network provisioning
- check open ports across legacy rules and zone policies
- pull camera and motion event data from a site
- re-run a recorded call sequence on a fresh controller
Example prompts for the agent
- List the VLANs on the
homecontroller without changing anything - Create a guest network via
create_guest_network,dry_run=Truefirst - Audit open ports on the
officesite and summarize the findings
How to install UniFi Gateway
Install
The MCP registry has no launch command for it: see the repository README
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about UniFi Gateway
How do I install UniFi Gateway in Claude Code?
There is no ready-made Claude command. Run uvx --from git+https://github.com/pete-builds/mcp-unifi mcp-unifi for stdio, or start the container with Streamable HTTP on port 3714 and register that endpoint in your MCP config.
What does UniFi Gateway do?
It exposes UniFi Network, Protect and Access operations to an agent. Destructive calls accept dry_run=True, composite tools undo partial work, and every request is logged.
What do I need before it will run?
A local API key from Settings → Control Plane → Integrations and a gateway on UniFi Network 9.x or newer. The HTTP transport also requires a bearer token; without it the server will not start.
