# Unifi MCP Server — 98 tools via DADL

The Unifi DADL turns Unifi's API into an MCP server that Claude, GPT or any MCP-compatible agent can consume directly. One YAML file declares all 98 tools — firewall, device, client, wlan, network, radius, and more — and ToolMesh serves them at runtime. No Python boilerplate, no per-endpoint code, no separate MCP server process.

Below: the endpoint coverage matrix, a two-block ToolMesh setup, the full tool reference grouped by Unifi feature area, required credential scopes.

**Source:** [Ubiquiti UniFi Network Controller API](https://ubntwiki.com/products/software/unifi-controller/api)

**Updated:** 2026-11-07

**Tags:** networking, crud, user-management, monitoring, logging, deployment, security, auth:session

## Which Unifi endpoints are covered?

**61%** (98 of ~160 endpoints).

**Focus:** Self-hosted UniFi Network Application API: devices (access points, switches, gateways, radio settings, adoption, restarts, firmware), WLANs (SSIDs, roaming, PMF, minimum data rates, AP groups), clients (active, known, blocking), firewall (rules, groups, NAT port forwarding, static routes), networks (LANs, VLANs, WAN), system log (client events, device alerts, admin activity), statistics (DPI, traffic reports, site health), hotspot (vouchers, authorizations), RADIUS, backups.

**Missing:** WebSocket events, v2 traffic rules and firewall policies, v2 client connection timeline, IPS/IDS management, hotspot portal config, VoIP extensions, spectrum scan results, switch port overrides, UniFi OS console login (/api/auth/login)

*Last reviewed: 2026-11-07*

## How do you configure the Unifi DADL?

1. Install or access your UniFi Network Controller (self-hosted or UDM/UDM Pro)
2. Create a local admin account or use an existing one (Settings -> Admins)
3. For dedicated API access, create a limited-admin account with read-only or site-admin role
4. Note: UniFi uses session-based auth (username + password), not API keys
5. Store the username and password in your ToolMesh credential store

**Environment variable:** `CREDENTIAL_UNIFI_USERNAME / CREDENTIAL_UNIFI_PASSWORD`

[Authentication docs](https://ubntwiki.com/products/software/unifi-controller/api)

*Written for the self-hosted UniFi Network Application: set url to https://<host>:8443. The file logs in at <url>/api/login. UniFi OS consoles (UDM, UCG, Cloud Key Gen2+) serve the Network API under https://<console>/proxy/network but log in at /api/auth/login on the console root, which this file does not configure; they are untested. Self-signed TLS certs are common -- configure TLS skip if needed. The health check calls GET /api/self and so tests the login with the stored credential.*

## How do you install the Unifi MCP server with ToolMesh?

Add to your `backends.yaml`:

```yaml
- name: unifi
  transport: rest
  dadl: unifi.dadl
  url: "https://unifi.example.com:8443"

```

Set the credential:

```
CREDENTIAL_UNIFI_USERNAME / CREDENTIAL_UNIFI_PASSWORD=your-token-here
```

## What 98 tools does the Unifi DADL expose?

- **GET** `get_server_status` — Get controller server status (unauthenticated). Returns server version, UUID, up status.
- **GET** `get_self` — Get currently logged-in admin user info
- **GET** `get_sysinfo` — Get controller system info: version, hostname, uptime, memory
- **GET** `get_health` — Get site health status for all subsystems (wan, wlan, lan, vpn)
- **GET** `get_dashboard` — Get dashboard metrics. Optional scale param for time granularity.
- **GET** `list_sites` — List all sites accessible to current admin (basic info)
- **GET** `list_sites_stats` — List all sites with health data, device counts, and alerts
- **POST** `site_command` — Site management commands: add-site, delete-site, update-site, get-admins, move-device, delete-device
- **GET** `list_admins` — List all administrators across all sites with permissions
- **POST** `admin_command` — Admin commands: invite-admin, assign-existing-admin, update-admin, revoke-admin, delete-admin
- **GET** `list_devices_basic` — List all adopted devices with limited fields (fast)
- **POST** `list_devices` — List adopted devices (APs, switches, gateways) as a compact projection: _id, mac, name, type (uap, usw, ugw, udm), model, state (1 = connected), version, ip, uptime, traffic rates, num_sta, satisfaction, plus per radio the settings (radio_table: radio, name, channel, ht, tx_power_mode, tx_power, min_rssi_enabled, min_rssi) and the live radio stats (radio_table_stats: radio, channel, tx_power, num_sta, satisfaction, cu_total, cu_self_rx, cu_self_tx, tx_retries_pct). Switches have empty radio arrays. Port tables, LLDP, uplink and the remaining radio fields are not included: use get_device (one MAC) or get_device_detail for the full raw document. Optional macs (array) filters by MAC.

- **POST** `get_device_detail` — Full raw device documents, no projection: port_table, lldp_table, uplink, vap_table, radio_table (all fields), radio_table_stats, config_network and more, about 30 kB per access point. Pass macs as an ARRAY, also for a single device: {macs: ["00:00:5e:00:53:01"]} returns exactly that device. There is no singular mac parameter; without macs the controller returns every device of the site. For one device get_device (GET by MAC) returns the same document. Returns an array of devices. The documents contain device keys (x_authkey, x_vwirekey): do not copy them into output.

- **GET** `get_device` — Get one device by MAC address: the full raw document (same content as get_device_detail with one MAC), including radio_table and radio_table_stats for access points and port_table for switches. Returns an array with one element. Works on self-hosted controllers (verified on Network 10.6). The document contains device keys (x_authkey, x_vwirekey): do not copy them into output.

- **PUT** `_update_device_raw` — Internal: raw device update. Sends only the fields given. radio_table REPLACES the whole radio array: a partial array loses the settings of the radios left out. Use the update_device composite instead, which reads the current radio_table and merges. Every call re-provisions the device (its clients drop briefly).

- **POST** `device_command` — Device management commands: adopt, restart, force-provision, power-cycle, upgrade, set-locate, unset-locate, speedtest, speedtest-status, migrate, cancel-migrate, spectrum-scan
- **GET** `list_active_clients` — List all currently connected clients
- **GET** `get_client` — Get details of a single connected client by MAC
- **GET** `get_user` — Get client/user details including offline clients
- **GET** `list_known_clients` — List all known/configured clients (including offline)
- **POST** `list_all_users` — List all users (active and historical). Filter by type and time range.
- **POST** `list_guests` — List guest clients within a time range
- **POST** `client_command` — Client management commands: block-sta, unblock-sta, kick-sta, forget-sta
- **PUT** `update_client` — Update client: name, note, fixed IP, network_id, usergroup_id
- **GET** `list_networks` — List all networks (LANs, VLANs, WAN)
- **POST** `create_network` — Create a new network
- **PUT** `update_network` — Update network configuration
- **DELETE** `delete_network` — Delete a network. WARNING: may disconnect clients on this network.
- **GET** `list_wlans` — List all WLAN configurations (SSIDs)
- **POST** `create_wlan` — Create a new WLAN (SSID)
- **PUT** `update_wlan` — Update a WLAN (SSID): pass only the fields to change; top-level fields not sent stay as they are. Array fields (wlan_bands, ap_group_ids) are replaced as a whole, so pass the complete list. Read the current values with list_wlans first. Every update re-provisions all APs that broadcast this SSID (clients drop briefly). Roaming: bss_transition (802.11v), fast_roaming_enabled (802.11r). Security: pmf_mode, wpa_mode, wpa3_support, wpa3_transition. Bands: wlan_bands. AP selection: ap_group_mode + ap_group_ids (list_ap_groups). The minrate_* values are used when minrate_setting_preference is manual. Returns the updated WLAN document, which includes x_passphrase: do not copy it into output.

- **DELETE** `delete_wlan` — Delete a WLAN. All clients on this SSID will be disconnected.
- **GET** `list_wlan_groups` — List WLAN groups (radio profiles)
- **GET** `list_ap_groups` — List AP groups (v2 API): each entry has _id, name and device_macs (the member APs). A WLAN with ap_group_mode groups is broadcast only by the APs in the groups listed in its ap_group_ids (see update_wlan). Returns a bare array.

- **GET** `list_firewall_rules` — List all user-defined firewall rules
- **POST** `create_firewall_rule` — Create a new firewall rule
- **PUT** `update_firewall_rule` — Update a firewall rule
- **DELETE** `delete_firewall_rule` — Delete a firewall rule
- **GET** `list_firewall_groups` — List firewall groups (address groups, port groups)
- **POST** `create_firewall_group` — Create a firewall group (address-group, port-group, ipv6-address-group)
- **PUT** `update_firewall_group` — Update firewall group members
- **DELETE** `delete_firewall_group` — Delete a firewall group
- **GET** `list_port_forwards` — List all port forwarding rules
- **POST** `create_port_forward` — Create a port forwarding rule
- **PUT** `update_port_forward` — Update a port forwarding rule (enable/disable, change ports)
- **DELETE** `delete_port_forward` — Delete a port forwarding rule
- **GET** `list_routes` — List user-defined static routes
- **GET** `get_active_routes` — Get active routing table from gateway device
- **POST** `create_route` — Create a static route
- **PUT** `update_route` — Update a static route
- **DELETE** `delete_route` — Delete a static route
- **GET** `get_dpi_stats` — Get site-wide Deep Packet Inspection stats
- **POST** `get_site_dpi` — Get filtered site DPI stats by application or category
- **POST** `get_client_dpi` — Get per-client DPI stats. Filter by MAC addresses.
- **POST** `stat_report_site` — Get site-level traffic report for a time interval
- **POST** `stat_report_device` — Get per-AP traffic report for a time interval
- **POST** `stat_report_user` — Get per-user traffic report for a time interval
- **POST** `stat_report_gateway` — Get gateway/WAN traffic report for a time interval
- **POST** `clear_dpi` — Clear/reset DPI counters
- **POST** `list_system_log` — Read the controller's system log (v2 API), where Network 10.x keeps the event history: client connects, disconnects and roams, device alerts and state changes, WAN and update events, admin activity, threat alerts. Replaces list_events and list_alarms, which Network 10.6 no longer serves. The POST is a query and changes nothing. timestampFrom and timestampTo are Unix epoch MILLISECONDS and are required, for the last 24 hours e.g. timestampFrom: Date.now() - 86400000, timestampTo: Date.now(). Results are paged and newest first: pageNumber starts at 0, pageSize sets the entries per page. Returns the raw page object {data: [...], page_number, total_element_count, total_page_count}. Entries carry key (e.g. a client-connected key), category, severity, timestamp (ms), a message template (message_raw, e.g. "{CLIENT} connected to {WLAN}") and parameters with the referenced CLIENT, DEVICE, WLAN etc. Class all returns every entry and can be narrowed with categories; the UniFi UI sends class-specific filter arrays for the other classes (see the params).

- **GET** `list_events` — Legacy: list events from stat/event (newest first, max 3000) on older controllers. Network 10.6 answers HTTP 404; use list_system_log there. Use _limit and _start for paging.
- **GET** `list_alarms` — Legacy: list alarms from stat/alarm (newest first, max 3000) on older controllers. Network 10.6 answers HTTP 404; use list_system_log (class device-alert or critical) there.
- **GET** `list_alarms_unarchived` — Legacy: list unarchived alarms from rest/alarm (oldest first) on older controllers. Network 10.6 answers HTTP 400 api.err.InvalidObject; use list_system_log there.
- **POST** `archive_all_alarms` — Archive all active alarms of the legacy alarm store (older controllers, where list_alarms works). Untested on Network 10.6, which no longer serves the alarm list.
- **POST** `create_backup` — Generate a controller backup
- **POST** `list_backups` — List available auto-backups
- **POST** `delete_backup` — Delete a backup file by filename
- **POST** `authorize_guest` — Authorize a guest client for network access
- **POST** `unauthorize_guest` — Revoke guest authorization
- **POST** `create_voucher` — Create hotspot voucher(s) for guest access
- **POST** `revoke_voucher` — Revoke a voucher by its _id
- **POST** `list_vouchers` — List all vouchers. Optionally filter by creation timestamp.
- **GET** `list_payments` — List hotspot payment history
- **POST** `list_sessions` — List client sessions with time range and optional MAC filter
- **GET** `list_user_groups` — List user groups (bandwidth profiles)
- **POST** `create_user_group` — Create a user group with bandwidth limits
- **PUT** `update_user_group` — Update user group bandwidth limits
- **DELETE** `delete_user_group` — Delete a user group
- **GET** `get_settings` — Get all site settings (country, locale, mgmt, guest_access, etc.)
- **PUT** `update_setting` — Update a specific site setting by key (country, locale, snmp, mgmt, guest_access, ntp, connectivity)
- **POST** `set_led` — Toggle site-wide device LED on/off
- **GET** `list_radius_profiles` — List RADIUS profiles
- **POST** `create_radius_profile` — Create a RADIUS profile
- **GET** `list_radius_accounts` — List RADIUS user accounts
- **POST** `create_radius_account` — Create a RADIUS user account
- **GET** `list_tags` — List all tags (MAC address groups)
- **POST** `create_tag` — Create a tag to group MAC addresses
- **PUT** `update_tag` — Update tag members
- **DELETE** `delete_tag` — Delete a tag
- **POST** `list_rogue_aps` — List neighboring/rogue APs detected within a time range
- **GET** `list_known_rogues` — List known/acknowledged rogue APs
- **GET** `get_ddns_status` — Get Dynamic DNS status (current IP, last change)
- **GET** `get_ddns_config` — Get Dynamic DNS configuration
- **PUT** `update_ddns_config` — Update Dynamic DNS configuration
- **GET** `list_port_profiles` — List switch port profiles (native VLAN, tagged VLANs, PoE mode)
- **GET** `get_country_codes` — List available country codes
- **GET** `get_wifi_channels` — List available WiFi channels for the site's country setting
- **GET** `get_sdn_status` — Get UniFi SDN/Cloud connection status

## What composite workflows does the Unifi DADL provide?

- **FN** `update_device` — Update a device (AP, switch, gateway): name, led_override, disabled, and per-radio settings of an access point. Pass only what should change. For radio_table pass one entry per radio you want to change, keyed by radio (ng = 2.4 GHz, na = 5 GHz, 6e = 6 GHz), with only the fields to change, e.g. [{radio: "ng", channel: 11, ht: 20}, {radio: "na", min_rssi_enabled: true, min_rssi: -80}]. The controller replaces the whole radio_table on every write, so the composite reads the device (get_device), merges the changes into the current entries and sends the complete array; other radios and fields keep their values. Settable radio fields: channel ("auto" or a channel number), ht (20, 40, 80, 160, 240, 320), tx_power_mode (auto, high, medium, low, custom, disabled; disabled switches the radio off), tx_power (dBm, with custom), min_rssi_enabled, min_rssi (-90 to -67 dBm), sens_level_enabled, sens_level (-90 to -50), antenna_gain, antenna_id, vwire_enabled, hard_noise_floor_enabled, loadbalance_enabled, maxsta, dfs. Unknown fields are rejected before anything is sent. If nothing differs from the current state, no write happens. dry_run true returns the PUT body without writing. Every write re-provisions the device: its clients drop for a few seconds. Returns {_id, written, changed, radio_table (settings after the merge), result} or, with dry_run, {_id, written: false, dry_run: true, changed, body}.


## Which DADLs are related to Unifi?

- [Mikrotik](https://www.dadl.ai/d/mikrotik/) — MikroTik RouterOS REST API -- manage interfaces, IP addresses, routing, firewall, DHCP, DNS, PPP, queues, wireless, system configuration, users, certificates, files, logs, and diagnostics on RouterOS v7.1+ devices
- [Opnsense](https://www.dadl.ai/d/opnsense/) — OPNsense firewall REST API — manage firewall rules, aliases, interfaces, VPN, DHCP, DNS, diagnostics, firmware, and services on OPNsense appliances
- [Alertmanager](https://www.dadl.ai/d/alertmanager/) — Prometheus Alertmanager API v2 -- alerts, silences, receivers, alert groups, status, and operational health
- [Checkmk](https://www.dadl.ai/d/checkmk/) — Checkmk REST API (version 1.0, Checkmk 2.4) -- live host and service status via Livestatus queries, downtimes, acknowledgements and comments, the Event Console (list, acknowledge, change state and archive events) and BI (packs, rules, aggregations and live aggregation state), plus the full Setup side: hosts, clusters, folders, service discovery, rules and rulesets, host/service/contact groups, users, roles, passwords, time periods, host tags, notification rules, site connections and change activation.

- [PeeringDB](https://www.dadl.ai/d/peeringdb/) — PeeringDB v2 API -- the public peering database of networks (ASNs), Internet Exchanges, and colocation facilities: full CRUD over net, ix, fac, org, carrier, campus, point-of-contact records, and the netixlan/netfac/ixfac/carrierfac/ixlan/ixpfx relationships that map who peers where
- [Graylog](https://www.dadl.ai/d/graylog/) — Graylog REST API -- log search (Views/Search + legacy universal), streams, pipelines, inputs, alerts, events, dashboards, users, roles, sidecars, index management, and cluster administration. Targets Graylog 6.x.

---

**Canonical URL:** https://www.dadl.ai/d/unifi/
**Raw DADL:** https://github.com/DunkelCloud/dadl-registry/blob/main/unifi.dadl