unifi_batch

What unifi_batch does on UniFi Access MCP

AI agents invoke unifi_batch to trigger actions in UniFi Access MCP. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call: builds kicked off, notifications sent, workflows started.

Why unifi_batch is rated High

This is an Execute tool because it orchestrates the execution of other UniFi operations in sequence or parallel. While the tool itself doesn't directly delete or move money, it can invoke any of the sibling tools (including destructive ones like access_delete_visitor) as a batch. An agent could use unifi_batch to execute multiple privileged operations atomically, amplifying the blast radius of any misuse.

From the tool's definition 'Execute multiple UniFi tools in a single request' indicates the tool runs/triggers other operations whose effects depend on what tools and arguments are batched together. The batch wrapper transforms individual tool calls into a compound operation.

The rule that runs unifi_batch safely

PolicyLayer is an MCP gateway: it sits between your AI agents and UniFi Access MCP, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For unifi_batch, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "unifi_batch": {
      "limits": [
        {
          "counter": "unifi_batch_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}

Questions about unifi_batch