An MCP server that exposes UniFi network management operations as tools for use with AI assistants and MCP clients
The server provides 27 tools across UniFi network management with complete input schemas and consistent, clear descriptions. Tool naming follows verb-noun patterns (list_, get_, set_, create_, update_, delete_) which aids LLM comprehension. All tools have descriptions (average ~100-150 chars, well within the 10-1024 baseline). Parameters include types and descriptions. However, output schemas are not documented in the provided source, the code shows no schema definitions for tool responses. Error handling lacks structured guidance and recovery hints. Some parameter descriptions are minimal (e.g., 'Site UUID; omit to use the configured default site' repeated across 24 tools). No tool annotations (destructiveHint, readOnlyHint, idempotentHint) are visible. Security-critical tools like restart_device and delete_firewall_zone have no confirmation or dry-run mechanism documented.
Posts an AUTHORIZE_GUEST_ACCESS action for a connected client via POST /integration/v1/sites/{siteID}/clients/{clientID}/actions
Creates a new firewall zone via POST /integration/v1/sites/{siteID}/firewall/zones
Deletes a firewall policy via DELETE /integration/v1/sites/{siteID}/firewall/policies/{policyID}
Deletes a firewall zone via DELETE /integration/v1/sites/{siteID}/firewall/zones/{zoneID}
Returns a single ACL rule from GET /integration/v1/sites/{siteID}/acl-rules/{ruleID}
Returns a single connected client from GET /integration/v1/sites/{siteID}/clients/{clientID}
Returns a single device from GET /integration/v1/sites/{siteID}/devices/{deviceID}
No output schemas documented. Tool responses are described in implementation comments but not in MCP tool definitions, making it impossible for LLMs to know what fields to expect or plan downstream tool calls.
Destructive operations (restart_device, delete_firewall_policy, delete_firewall_zone) lack confirmation or dry-run mechanisms. No guidance in descriptions on irreversibility. Agents cannot safely plan these operations without additional safeguards.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-22 | D | 59 | 2026-07-28+ | v2 |
| 2026-03-09 | F | 0 | - | v1 |
Returns the latest statistics for a device from GET /integration/v1/sites/{siteID}/devices/{deviceID}/statistics/latest
Returns a single firewall policy from GET /integration/v1/sites/{siteID}/firewall/policies/{policyID}
Returns a single firewall zone from GET /integration/v1/sites/{siteID}/firewall/zones/{zoneID}
Returns application information from GET /integration/v1/info
Returns a single site by ID from GET /integration/v1/sites (paginates through all pages until the site is found)
Returns a single WiFi broadcast configuration from GET /integration/v1/sites/{siteID}/wifi/broadcasts/{broadcastID}
Returns one page of ACL rules from GET /integration/v1/sites/{siteID}/acl-rules
Returns one page of currently connected clients from GET /integration/v1/sites/{siteID}/clients
Returns one page of adopted devices from GET /integration/v1/sites/{siteID}/devices
Returns one page of firewall policies from GET /integration/v1/sites/{siteID}/firewall/policies
Returns one page of firewall zones from GET /integration/v1/sites/{siteID}/firewall/zones
Returns one page of configured networks from GET /integration/v1/sites/{siteID}/networks
Returns devices visible on the network but not yet adopted from GET /integration/v1/pending-devices. This endpoint is not site-scoped
Returns one page of sites from GET /integration/v1/sites
Returns one page of WiFi broadcast (SSID) configurations from GET /integration/v1/sites/{siteID}/wifi/broadcasts
Power-cycles a single PoE port on a switch via POST /integration/v1/sites/{siteID}/devices/{deviceID}/interfaces/ports/{portIdx}/actions
Sends a RESTART action via POST /integration/v1/sites/{siteID}/devices/{deviceID}/actions
Enables or disables a firewall policy via GET then PUT /integration/v1/sites/{siteID}/firewall/policies/{policyID}
Enables or disables a WiFi broadcast via GET then PUT /integration/v1/sites/{siteID}/wifi/broadcasts/{broadcastID}
Replaces a firewall zone via PUT /integration/v1/sites/{siteID}/firewall/zones/{zoneID}
No tool annotations visible (destructiveHint, readOnlyHint, idempotentHint). LLMs cannot infer which tools are safe to retry or modify state. All 27 tools lack MCP 2026-07-28 annotation support.
Parameter descriptions for 'site_id' are identical and minimal across 24 tools ('Site UUID; omit to use the configured default site'). This violates DRY but more critically lacks contextual guidance. No examples or constraints on what a valid site_id looks like.
No error handling guidance in tool descriptions. Tools provide HTTP status codes and API errors but no recovery hints. E.g., 'Device not found' should suggest 'try list_devices() to find valid device IDs'.
Pagination parameters (offset, limit) lack constraints in descriptions. No mention of maximum page size (1000 per code) or default behavior. LLMs may request 10,000 items without guidance.
No mention of default site behavior in tool descriptions. If site_id is omitted, tools fall back to UNIFI_SITE_ID env var. This is powerful but undocumented, LLMs won't know when/why to omit it or what happens when they do.