io.github.pete-builds

unifi

UniFi Gateway

Safe-by-default UniFi MCP: Network + Protect + Access, multi-site, dry-run, audit log.

Streamable HTTPcommunityservice

Package Details

ghcr.io/pete-builds/mcp-unifi:0.15.3

https://github.com/pete-builds/mcp-unifi/pkgs/container/mcp-unifi
TransportStreamable HTTP
Runtimedocker

Environment Variables

STUB_MODE(str)
Default:true

When true, the server returns realistic mock data and requires no UniFi hardware. Defaults to true so the image is functional out of the box.

UNIFI_HOST(str)

IP address or hostname of the UniFi OS gateway (UCG-Fiber, UDM Pro, etc). Required when STUB_MODE=false and MCP_UNIFI_CONTROLLERS_FILE is unset.

UNIFI_API_KEY(str)
Secret

Local API key generated under Settings -> Control Plane -> Integrations on the gateway. Required when STUB_MODE=false and MCP_UNIFI_CONTROLLERS_FILE is unset.

UNIFI_SITE(str)
Default:default

UniFi controller site name. Defaults to 'default'.

UNIFI_VERIFY_SSL(str)
Default:false

Whether to verify the gateway's TLS certificate. Defaults to false because most home gateways use a self-signed cert.

MCP_UNIFI_CONTROLLERS_FILE(str)

Path to a YAML file describing multiple named controllers for multi-site management. When set, the legacy UNIFI_HOST / UNIFI_API_KEY env vars are ignored. Each entry needs name, host, api_key, and optionally port, site, verify_ssl.

MCP_UNIFI_MODULES_ENABLED(str)
Default:network

Comma-separated list of modules to load. Known values: 'network', 'protect', 'access'. Defaults to 'network'. Set to 'network,protect,access' to enable Protect and Access tools alongside Network. Access is read-only in v0.10.

UNIFI_ACCESS_HOST(str)

UniFi Access hub IP or hostname. Required when the access module is enabled and STUB_MODE=false. Often the same host as UNIFI_HOST.

UNIFI_ACCESS_API_KEY(str)
Secret

UniFi Access API key. Separate from the Network API key; generated on the Access controller's developer settings. Required when the access module is enabled and STUB_MODE=false.

UNIFI_ACCESS_PORT(str)
Default:12445

HTTPS port for the Access hub. Defaults to 12445 (the direct Access app port).

MCP_UNIFI_AUDIT_SINK(str)
Default:file

Audit log sink. One of 'file' (default), 'stdout', or 'syslog'. Every tool call is recorded to a JSONL stream with secrets scrubbed.

MCP_UNIFI_AUDIT_PATH(str)
Default:audit.jsonl

Path for the audit log file when MCP_UNIFI_AUDIT_SINK=file. Defaults to audit.jsonl in the process CWD.