// SCAN REPORT

UniFi Network MCP Server

74 tools. 32 can modify or destroy data without limits.

11 destructive tools with no built-in limits. Policy required.

Last updated:

32 can modify or destroy data
42 read-only
74 tools total

Community server · catalogue entry verified 02/07/2026

How to control UniFi Network MCP Server ↓

TOOL MAP

What UniFi Network MCP Server exposes to your agents

Read (42) Write / Execute (21) Destructive / Financial (11)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS
Critical Risk

The most dangerous UniFi Network MCP Server tools

Destructive · High unifi_bulk_delete_vouchers This tool irreversibly deletes data (hotspot vouchers) at scale with no undo capability. Destructive · High unifi_delete_acl_rule This tool irreversibly removes access control list rules from a network device. Destructive · High unifi_delete_dns_policy This tool permanently deletes DNS policies, which cannot be undone. Destructive · High unifi_delete_firewall_policy The tool irreversibly deletes a firewall policy, which cannot be undone.

32 of UniFi Network MCP Server's 74 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control UniFi Network MCP Server

PolicyLayer is an MCP gateway — it sits between your AI agents and UniFi Network MCP Server, and nothing reaches the server without passing your rules. These are the rules we recommend:

Deny destructive operations
{
  "unifi_bulk_delete_vouchers": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Blocked by default. Requires approval."
      }
    ]
  }
}

Destructive tools should never be available to autonomous agents without human approval.

Rate limit write operations
{
  "unifi_authorize_guest": {
    "limits": [
      {
        "counter": "unifi_authorize_guest_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations
{
  "unifi_adopt_device": {
    "limits": [
      {
        "counter": "unifi_adopt_device_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

  1. Create a free account and register UniFi Network MCP Server — nothing to install.
  2. Add these rules — paste them, or build them visually. Tune the limits to your setup.
  3. Point your MCP client (Claude, Cursor, anything) at your gateway URL.
ENFORCE POLICY ON UNIFI NETWORK →

Instant setup, no code required.

FULL CATALOGUE

All 74 UniFi Network MCP Server tools

DESTRUCTIVE 11 tools
Destructive unifi_bulk_delete_vouchers DESTRUCTIVE: Bulk delete hotspot vouchers based on filter criteria Destructive unifi_delete_acl_rule DESTRUCTIVE: Delete an ACL rule Destructive unifi_delete_dns_policy DESTRUCTIVE: Delete a DNS policy Destructive unifi_delete_firewall_policy DESTRUCTIVE: Delete a firewall policy Destructive unifi_delete_firewall_zone DESTRUCTIVE: Delete a custom firewall zone Destructive unifi_delete_network DESTRUCTIVE: Delete a network — all clients on this network will be disconnected Destructive unifi_delete_traffic_matching_list DESTRUCTIVE: Delete a traffic matching list Destructive unifi_delete_voucher DESTRUCTIVE: Delete a hotspot voucher Destructive unifi_delete_wifi DESTRUCTIVE: Delete a WiFi network — all clients on this SSID will be disconnected Destructive unifi_remove_device DESTRUCTIVE: Remove (unadopt) a device from a site. If the device is online, it will be reset to factory defau Destructive unifi_unauthorize_guest Revoke guest authorization; the client returns to the captive portal on next request. Idempotent.
EXECUTE 2 tools
Execute unifi_power_cycle_port Power-cycle PoE on a specific switch port (briefly drops then restores power). portIdx is the port number (1-b Execute unifi_restart_device Restart (reboot) a device. The device will be unreachable for ~1–3 minutes. Idempotent: repeated calls trigger
WRITE 19 tools
Write unifi_authorize_guest Authorize a guest client through a captive-portal hotspot. Optional limits override hotspot defaults. Idempote Write unifi_create_acl_rule Create a new ACL rule Write unifi_create_dns_policy Create a new DNS policy Write unifi_create_firewall_policy Create a new firewall policy Write unifi_create_firewall_zone Create a new custom firewall zone Write unifi_create_network Create a new VLAN/network. management=GATEWAY means routed via UDM/UXG; SWITCH means VLAN-only; UNMANAGED mean Write unifi_create_traffic_matching_list Create a new traffic matching list Write unifi_create_voucher Create one or more hotspot vouchers (use count for batch creation, up to 1000 at once). Returns: array of crea Write unifi_create_wifi Create a new WiFi network (SSID) Write unifi_patch_firewall_policy Partially update a firewall policy without resending all fields. Common use: toggle loggingEnabled or enabled. Write unifi_reorder_acl_rules Reorder user-defined ACL rules Write unifi_reorder_firewall_policies Reorder user-defined firewall policies for a zone pair Write unifi_update_acl_rule Update an ACL rule Write unifi_update_dns_policy Update a DNS policy Write unifi_update_firewall_policy Update a firewall policy Write unifi_update_firewall_zone Update a firewall zone Write unifi_update_network Update an existing network Write unifi_update_traffic_matching_list Update a traffic matching list Write unifi_update_wifi Update an existing WiFi network
READ 42 tools
Read unifi_adopt_device Adopt a pending device into a site by MAC address. The device must already appear in unifi_list_pending_device Read unifi_get_acl_rule Get a specific ACL rule by ID (full match criteria and action). Read unifi_get_acl_rule_ordering Get the evaluation order of user-defined ACL rules. Returns: orderedAclRuleIds[]. Rules higher in the list win Read unifi_get_client Get a specific connected client by ID. Returns same shape as unifi_list_clients entries. Read unifi_get_device Get full configuration for a device. Returns (in addition to list fields): supported, firmwareUpdatable, provi Read unifi_get_device_statistics Get latest live statistics for a device. Returns: uptimeSec, lastHeartbeatAt, nextHeartbeatAt, loadAverage1/5/ Read unifi_get_dns_policy Get a specific DNS policy by ID (same fields as the list entry). Read unifi_get_firewall_policy Get a firewall policy by ID with full match criteria and action. Read unifi_get_firewall_policy_ordering Get the evaluation order of user-defined firewall policies for a specific (source zone, destination zone) pair Read unifi_get_firewall_zone Get a firewall zone by ID (same fields as the list entry). Read unifi_get_info Get UniFi Network application info. Returns: applicationVersion. NOTE: verified against 10.5.43 on a UniFi OS Read unifi_get_lag Get full details of a LAG including its type (LOCAL/SWITCH_STACK/MULTI_CHASSIS) and member ports. Read unifi_get_mc_lag_domain Get full details of an MC-LAG Domain (peer switches and member LAGs). Read unifi_get_network Get a network/VLAN by ID. Returns the list fields PLUS (live-verified) zoneId, isolationEnabled, internetAcces Read unifi_get_network_references Get all objects that reference this network (WiFi broadcasts, firewall zones, etc.). Returns: { referenceResou Read unifi_get_switch_stack Get full details of a Switch Stack including all members and stacking topology. Returns the same fields as the Read unifi_get_traffic_matching_list Get a specific traffic matching list by ID (full items array). Read unifi_get_voucher Get a specific hotspot voucher by ID (same fields as the list entry). Read unifi_get_wifi Get full configuration for a WiFi broadcast (SSID), including all optional fields not always returned by list: Read unifi_list_acl_rules List ACL rules (switch/AP-level access control lists, distinct from zone-based firewall policies) at a site. R Read unifi_list_clients List currently connected clients at a site. Returns per client: id, name, type (WIRED/WIRELESS/VPN/TELEPORT), Read unifi_list_countries List countries/regions (global) for geo-IP firewall rules. Returns: code (ISO alpha-2, e.g. Read unifi_list_device_tags List device tags at a site. Tags group APs/switches for selective WiFi broadcast (via broadcastingDeviceFilter Read unifi_list_devices List all adopted devices (gateways, switches, APs) at a site. Returns: id, name, model, macAddress, ipAddress, Read unifi_list_dns_policies List DNS policies (local DNS records and forward rules served by the gateway) at a site. Returns: id, type (A_ Read unifi_list_dpi_applications List individual DPI applications (global) — specific apps/services like Read unifi_list_dpi_categories List DPI categories (global, not site-scoped) — high-level traffic groupings like Read unifi_list_firewall_policies List firewall policies (zone-based rules) at a site. Returns: id, name, enabled, action (object with type fiel Read unifi_list_firewall_zones List firewall zones (groupings of networks for zone-based firewalling) at a site. Returns: id, name, networkId Read unifi_list_lags List LAGs (Link Aggregation Groups — bonded switch ports) at a site. Returns: id, type (LOCAL/SWITCH_STACK/MUL Read unifi_list_mc_lag_domains List MC-LAG (Multi-Chassis Link Aggregation) Domains — pairs of switches presenting as one for LAG redundancy. Read unifi_list_networks List all networks (VLANs/LAN segments) at a site. Returns: id, name, management (UNMANAGED/GATEWAY/SWITCH), en Read unifi_list_pending_devices List devices pending adoption across all sites (global endpoint, not site-scoped). Returns: basic device info Read unifi_list_radius_profiles List RADIUS profiles (auth/accounting server configurations referenced by WiFi WPA-Enterprise, switch 802.1X p Read unifi_list_sites List all sites the API key has access to. Returns: id (the siteId every other tool requires), internalReferenc Read unifi_list_switch_stacks List Switch Stacks (multiple physical switches managed as one logical unit) at a site. Returns: id, name, memb Read unifi_list_traffic_matching_lists List traffic matching lists at a site — named collections of ports or IPs reused in firewall/ACL rules. Return Read unifi_list_vouchers List hotspot/guest-portal vouchers at a site. Returns: id, code, name, createdAt, activatedAt (when first gues Read unifi_list_vpn_servers List VPN servers (roaming/client-access VPNs: WireGuard, OpenVPN, L2TP, Teleport) at a site. Returns: id, type Read unifi_list_vpn_tunnels List site-to-site VPN tunnels (IPsec, WireGuard, OpenVPN site-to-site) at a site. Returns: tunnel definitions Read unifi_list_wans List WAN interface definitions at a site. Returns: id, name only (verified against 10.5.43 — the Integration A Read unifi_list_wifi List all WiFi broadcasts (SSIDs) at a site. Returns: id, name (SSID), enabled, type (STANDARD/IOT_OPTIMIZED),
EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

Yaver 1060 tools
adminautomation
Nodebench 824 tools
adminautomation
UnClick 813 tools
adminautomation
Binance MCP Server 734 tools
adminautomation
Fortimanager 584 tools
adminautomation
Crow 573 tools
adminautomation
Mcp 571 tools
adminautomation
GoHighLevel MCP Server 566 tools
adminautomation
FAQ

Questions about UniFi Network MCP Server

Can an AI agent delete data through the UniFi Network MCP Server MCP server? +

Yes. The UniFi Network MCP Server server exposes 11 destructive tools including unifi_bulk_delete_vouchers, unifi_delete_acl_rule, unifi_delete_dns_policy. These permanently remove resources with no undo. PolicyLayer blocks destructive tools by default so they never reach the upstream server.

How do I prevent bulk modifications through UniFi Network MCP Server? +

The UniFi Network MCP Server server has 19 write tools including unifi_authorize_guest, unifi_create_acl_rule, unifi_create_dns_policy. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach UniFi Network MCP Server.

How many tools does the UniFi Network MCP Server MCP server expose? +

74 tools across 4 categories: Destructive, Execute, Read, Write. 42 are read-only. 32 can modify, create, or delete data.

How do I enforce a policy on UniFi Network MCP Server? +

Register the UniFi Network MCP Server MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every UniFi Network MCP Server tool call.

Deterministic rules across all 74 UniFi Network MCP Server tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON UNIFI NETWORK →

Instant setup, no code required.

74 UniFi Network MCP Server tools catalogued and risk-classified — across an index of 43,000+ MCP servers.

// GET IN TOUCH

Have a question or want to learn more? Send us a message.

Message sent.

We'll get back to you soon.