Loading ToolBench
MCP server for managing UniFi network infrastructure, including firewall rules, networks, clients, traffic management, port forwarding, and security monitoring
Server has 32 well-named tools with consistent verb_noun patterns (list_, get_, create_, update_, delete_). Descriptions are present and actionable (avg ~120 chars), exceeding the 10-char minimum. Input schemas are visible and typed with Zod validation. However, parameter descriptions are sparse or generic in many tools (e.g., 'Firewall rule configuration' for complex objects), output schemas are not documented, and error handling lacks recovery guidance. No tool annotations (readOnlyHint, destructiveHint) despite clear risk classifications. Composition is sound, tools are single-responsibility and chainable via ID returns.
Block a client from the network by MAC address.
Create a firewall group. Required: name, group_type (address-group|port-group|ipv6-address-group), group_members (array of IPs/CIDRs or ports).
Create a new firewall rule. Required fields: name, ruleset, action (accept|drop|reject). Optional: src_address, dst_address, protocol, src_port, dst_port, enabled.
Create a network. Required: name, ip_subnet (CIDR). Optional: vlan_id, dhcpd_enabled, purpose.
Create a port forward rule. Required: name, dst_port (external port), fwd (destination IP), fwd_port (internal port), proto (tcp/udp/tcp_udp).
Create a traffic rule. Required: description, action, matching_target. See UniFi docs for full schema.
Complex object parameters lack detailed field documentation. create_firewall_rule, create_firewall_group, create_network, create_port_forward, create_traffic_rule all accept generic 'rule'/'group'/'network' objects with only 'See UniFi docs' guidance. LLMs cannot infer required vs optional fields or valid value ranges.
No output schemas documented. Tools return results but LLMs cannot plan downstream calls without knowing response structure. E.g., list_clients returns clients but field names (mac, ip, hostname, etc.) are not specified.
No tool annotations (readOnlyHint, destructiveHint, idempotentHint) despite clear risk classifications. Destructive tools (delete_firewall_rule, delete_network, delete_port_forward) should be marked to guide agent caution.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 65 | <=2025-11-25 | v2 |
Delete a firewall group by ID.
Delete a firewall rule by ID.
Delete a network by ID. DESTRUCTIVE: disconnects all devices on the network. Must pass confirm_name matching the network name exactly.
Delete a port forward rule by ID.
Delete a traffic rule by ID.
Get details for a connected client by MAC address.
Get health status of all UniFi devices (UDM Pro, APs, switches): uptime, state, firmware version.
Get a single firewall rule by its ID.
Get a network by ID.
Get network alarms/alerts (e.g. IPS/IDS blocks, rogue AP detected, admin actions). Optional: key_filter (e.g. "EVT_WC_Connected"), limit, archived (true/false to filter by archived status).
Get neighboring/rogue access points detected near your network. Optional: within (hours to look back, e.g. 24).
Get site-wide health stats: WAN/LAN status, connected device counts, bandwidth usage.
List network clients. include_offline=true includes recently seen offline clients.
List firewall groups (IP sets and port sets used in firewall rules).
List firewall rules. Optionally filter by ruleset (WAN_IN, WAN_OUT, LAN_IN, LAN_OUT, GUEST_IN, GUEST_OUT).
List all networks and VLANs.
List all port forwarding rules.
List traffic management rules (newer policy-based rules, separate from classic firewall rules).
Remove the fixed IP assignment from a client.
Assign a fixed/static IP address to a client by MAC.
Unblock a previously blocked client by MAC address.
Update a firewall group by ID. Only provide fields to change.
Update an existing firewall rule by ID. Only provide fields to change — existing fields are preserved via read-before-write.
Update a network by ID. Only provide fields to change.
Update a port forward rule by ID. Only provide fields to change.
Update a traffic rule by ID. Only provide fields to change.
Error handling lacks recovery guidance. No indication of retryable vs fatal errors, or what the LLM should do next (e.g., 'User not found. Try search_users() first').
Confirmation pattern incomplete. delete_network requires confirm_name, but other destructive operations (delete_firewall_rule, delete_port_forward) lack confirmation steps, risking accidental deletion.