Home › Other › UniFi Gateway

UniFi Gateway

Safe-by-default UniFi MCP: Network + Protect + Access, multi-site, dry-run, audit log.

Python

★ 24 stars Last pushed 2026-09-24 License: MIT

View repository → Website →

Connect

Review any command before running it. Package names and URLs come from the server's own registry entry.

Package (oci)

Package: oci ghcr.io/pete-builds/mcp-unifi:0.23.0

STUB_MODE — When true, the server returns realistic mock data and requires no UniFi hardware. Defaults to true so the image is functional out of the box.
UNIFI_HOST — IP address or hostname of the UniFi OS gateway (UCG-Fiber, UDM Pro, etc). Required when STUB_MODE=false and MCP_UNIFI_CONTROLLERS_FILE is unset.
UNIFI_API_KEY secret — Local API key generated under Settings -> Control Plane -> Integrations on the gateway. Required when STUB_MODE=false and MCP_UNIFI_CONTROLLERS_FILE is unset.
UNIFI_SITE — UniFi controller site name. Defaults to 'default'.
UNIFI_VERIFY_SSL — Whether to verify the gateway's TLS certificate. Defaults to false because most home gateways use a self-signed cert.
MCP_UNIFI_CONTROLLERS_FILE — Path to a YAML file describing multiple named controllers for multi-site management. When set, the legacy UNIFI_HOST / UNIFI_API_KEY env vars are ignored. Each entry needs name, host, api_key, and optionally port, site, verify_ssl.
MCP_UNIFI_MODULES_ENABLED — Comma-separated list of modules to load. Known values: 'network', 'protect', 'access'. Defaults to 'network'. Set to 'network,protect,access' to enable Protect and Access tools alongside Network. Access currently ships read-only; door unlocks and credential issuance require session-token auth and are deferred.
UNIFI_ACCESS_HOST — UniFi Access hub IP or hostname. Required when the access module is enabled and STUB_MODE=false. Often the same host as UNIFI_HOST.
UNIFI_ACCESS_API_KEY secret — UniFi Access API key. Separate from the Network API key; generated on the Access controller's developer settings. Required when the access module is enabled and STUB_MODE=false.
UNIFI_ACCESS_PORT — HTTPS port for the Access hub. Defaults to 12445 (the direct Access app port).
MCP_UNIFI_AUDIT_SINK — Audit log sink. One of 'file' (default), 'stdout', or 'syslog'. Every tool call is recorded to a JSONL stream with secrets scrubbed.
MCP_UNIFI_AUDIT_PATH — Path for the audit log file when MCP_UNIFI_AUDIT_SINK=file. Defaults to audit.jsonl in the process CWD.