pete-builds/mcp-unifi
Deployment & DevOpsこのページは AI により自動翻訳されています。技術的な詳細は原文をご確認ください。 原文を見る
Safety-first MCP server for self-hosted UniFi. 57 Network + 11 Protect + 18 Access tools, dry-run previews, JSONL audit log, composite rollback. Multi-site. Stdio + Streamable HTTP.
概要
An MCP server built around the assumption that LLM-driven infrastructure calls need guardrails. Every destructive tool accepts dry_run=True and returns the predicted change set without writing. Composite tools (create_iot_network, create_guest_network, provision_homelab_service, provision_camera) capture pre-state and roll back applied steps on partial failure. Every call — dry-run or real — lands in a JSONL audit log with secrets scrubbed; the included mcp-unifi-replay CLI can re-issue a log against a fresh controller. Beyond the safety substrate: tools for devices, AP radio tuning, VLANs, WLANs, firewall, switch ports, port forwards, DHCP reservations, AP groups, observability, Threat Management / IDS-IPS, Honeypot, and Teleport VPN, plus opt-in (cameras, motion events, smart detections, recording config) and (doors, credentials, visitors, badge events, hubs / readers). Every tool accepts a controller parameter so one server instance manages multiple UniFi sites.
README
以下は原文 README の抜粋です。原文を見る。
mcp-unifi
Safety-first MCP server for self-hosted UniFi. Dry-run previews, JSONL audit log, composite rollback. Network + Protect + Access.
An MCP server built around the assumption that LLM-driven infrastructure calls need guardrails. Every destructive tool accepts dry_run=True and returns the predicted change set without writing. Composite tools (create_iot_network, create_guest_network, provision_homelab_service, provision_camera) capture pre-state and roll back applied steps on partial failure. Every call — dry-run or real — lands in a JSONL audit log with secrets scrubbed; the included mcp-unifi-replay CLI can re-issue a log against a fresh controller.
Beyond the safety substrate: Network tools for devices, AP radio tuning, VLANs, WLANs, firewall, switch ports, port forwards, DHCP reservations, AP groups, observability, Threat Management / IDS-IPS, Honeypot, and Teleport VPN, plus opt-in Protect (cameras, motion events, smart detections, recording config) and Access (doors, credentials, visitors, badge events, hubs / readers). Every tool accepts a controller parameter so one server instance manages multiple UniFi sites. Speaks both stdio (Claude Desktop, uvx, .dxt) and Streamable HTTP (Docker, Helm). The full, always-current tool list is in the auto-generated Tool Manifest. Works on any UniFi OS gateway running UniFi Network 9.x or newer (UDM, UDM Pro, UDM SE, UCG-Fiber, UCG-Ultra, UDR, UDW, UniFi OS Server), authenticated with a local API key from Settings → Control Plane → Integrations. Verified against a UCG-Fiber on UniFi OS 5.1.33 running UniFi Network 10.6.101 (2026-09-13). Firewall reads cover both the legacy rulesets (list_firewall_rules) and the Zone-Based Firewall (list_firewall_policies, list_firewall_zones), and audit_open_ports checks both, so a site that has migrated to zones is not reported as having no firewall. Legacy firewall writes (create_firewall_rule and friends) target /rest/firewallrule; zone policy writes (create_firewall_policy, update_firewall_policy, delete_firewall_policy) go through the official Integration API only, and the provisioning composites create a zone policy instead of a legacy rule on a zone-based site ([ADR 0009](https://github.com/
インストール
docker run --rm -p 3714:3714 \