# UniFi Gateway

Gives an agent tools for a self-hosted UniFi controller, with a preview of every change before it lands. Handy when touching VLANs or firewall rules by hand feels risky.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed · ★ 26
- Author: pete-builds
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/pete-builds/mcp-unifi
- Updated: 2026-10-22
- HTML: https://affpapa.org/en/nevibecode/mcp/unifi-gateway

## What it does

The server covers UniFi Network: devices, AP radio settings, VLANs, WLANs, firewall, switch ports, port forwards, DHCP reservations, Threat Management, Honeypot and Teleport VPN. Protect (cameras, motion events, recording) and Access (doors, credentials, visitors, badge events) are opt-in. A `controller` argument lets one process work across several sites at once.

Guardrails come first. Any destructive tool takes `dry_run=True`, which returns the predicted change set and writes nothing. Composite operations such as `create_iot_network`, `create_guest_network`, `provision_homelab_service` and `provision_camera` save the previous state and undo the steps already applied when one fails partway. Each call, real or simulated, goes into a JSONL audit log with secrets removed; the shipped `mcp-unifi-replay` CLI can replay that log against a clean controller. Setting `MCP_UNIFI_READONLY=true` hides mutating tools from the list and rejects them by name.

You need a local API key from Settings → Control Plane → Integrations, and the gateway must run UniFi Network 9.x or newer. No cloud account involved. Four routes exist: a Docker container speaking Streamable HTTP on port `3714`, a `.dxt` bundle for Claude Desktop, a Helm chart, or `uvx`. Over HTTP the service refuses to start without a bearer token, so set one in advance — on an open interface every client gets admin-level reach into the controller.

## Requirements
- Needs: Docker
- Environment variables: `STUB_MODE`, `UNIFI_HOST`, `UNIFI_API_KEY`, `UNIFI_SITE`, `UNIFI_VERIFY_SSL`, `MCP_UNIFI_CONTROLLERS_FILE`, `MCP_UNIFI_MODULES_ENABLED`, `UNIFI_ACCESS_HOST`, `UNIFI_ACCESS_API_KEY`, `UNIFI_ACCESS_PORT` — keys and tokens: ask the human for the values, never commit them or put them in shared files.

## Install

### Claude Code (native platform)

**Install**
- The MCP registry has no launch command for it: see the repository README

## When to use it
- preview which firewall rule change will actually apply
- roll back a half-finished guest network provisioning
- check open ports across legacy rules and zone policies
- pull camera and motion event data from a site
- re-run a recorded call sequence on a fresh controller

## Example prompts
- List the VLANs on the `home` controller without changing anything
- Create a guest network via `create_guest_network`, `dry_run=True` first
- Audit open ports on the `office` site and summarize the findings

## Similar
- [GitHub](https://affpapa.org/en/nevibecode/mcp/github.md) — MCP server · ★ 33918
- [Netdata](https://affpapa.org/en/nevibecode/mcp/netdata.md) — MCP server · ★ 81115
- [Oh My Posh Validator](https://affpapa.org/en/nevibecode/mcp/oh-my-posh-validator.md) — MCP server · ★ 23643
- [Keploy](https://affpapa.org/en/nevibecode/mcp/keploy.md) — MCP server · ★ 18727
- [Coder](https://affpapa.org/en/nevibecode/mcp/coder.md) — MCP server · ★ 17160
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12109

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md