# unifi_delete_oon_policy

Delete an OON policy. Requires confirmation.

Agent View of the PolicyLayer registry record for `unifi_delete_oon_policy`. HTML page: https://policylayer.com/tools/io-github-sirkirby-unifi-access-mcp/unifi-delete-oon-policy

## Facts

- Tool: `unifi_delete_oon_policy`
- Server: UniFi Access MCP (`pypi:unifi-protect-mcp`) — https://policylayer.com/tools/io-github-sirkirby-unifi-access-mcp.md
- Install: `npx -y pypi:unifi-protect-mcp`
- Homepage: https://github.com/sirkirby/unifi-mcp
- Risk category: Destructive (Critical risk)
- Registry record: grade F, identity unverified
- Server rate-limited: no
- Parameters: 0
- Recommended policy verdict: Hidden

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "unifi_delete_oon_policy",
    "arguments": {}
  }
}
```

## Why unifi_delete_oon_policy is rated Critical

This tool permanently removes policy configuration that cannot be recovered without manual restoration. While requiring confirmation mitigates accidental misuse, deletion is inherently irreversible and affects security posture of the access control system.

From the tool's own definition: "Tool name 'delete' combined with description 'Delete an OON policy' indicates irreversible removal of access control policy configuration. OON (Out-Of-Network) policies govern security rules for UniFi Access systems."

## Use case

AI agents call unifi_delete_oon_policy to permanently remove resources in UniFi Access MCP, typically in cleanup and lifecycle workflows. It does its job in a single call, and there is no undo.

## Recommended policy (PolicyLayer)

Verdict: **Hidden**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches UniFi Access MCP:

```json
{
  "version": "1",
  "default": "deny",
  "hide": [
    "unifi_delete_oon_policy"
  ]
}
```

## Other tools on UniFi Access MCP (271)

- `access_delete_visitor` — Destructive — https://policylayer.com/tools/io-github-sirkirby-unifi-access-mcp/access-delete-visitor.md
- `access_revoke_credential` — Destructive — https://policylayer.com/tools/io-github-sirkirby-unifi-access-mcp/access-revoke-credential.md
- `protect_alarm_delete_rule` — Destructive — https://policylayer.com/tools/io-github-sirkirby-unifi-access-mcp/protect-alarm-delete-rule.md
- `protect_delete_known_face` — Destructive — https://policylayer.com/tools/io-github-sirkirby-unifi-access-mcp/protect-delete-known-face.md
- `protect_delete_known_license_plate` — Destructive — https://policylayer.com/tools/io-github-sirkirby-unifi-access-mcp/protect-delete-known-license-plate.md
- `protect_delete_liveview` — Destructive — https://policylayer.com/tools/io-github-sirkirby-unifi-access-mcp/protect-delete-liveview.md
- `protect_delete_recording` — Destructive — https://policylayer.com/tools/io-github-sirkirby-unifi-access-mcp/protect-delete-recording.md
- `unifi_delete_acl_rule` — Destructive — https://policylayer.com/tools/io-github-sirkirby-unifi-access-mcp/unifi-delete-acl-rule.md
- `unifi_delete_ap_group` — Destructive — https://policylayer.com/tools/io-github-sirkirby-unifi-access-mcp/unifi-delete-ap-group.md
- `unifi_delete_backup` — Destructive — https://policylayer.com/tools/io-github-sirkirby-unifi-access-mcp/unifi-delete-backup.md
- `unifi_delete_client_group` — Destructive — https://policylayer.com/tools/io-github-sirkirby-unifi-access-mcp/unifi-delete-client-group.md
- `unifi_delete_content_filter` — Destructive — https://policylayer.com/tools/io-github-sirkirby-unifi-access-mcp/unifi-delete-content-filter.md
- `unifi_delete_dns_record` — Destructive — https://policylayer.com/tools/io-github-sirkirby-unifi-access-mcp/unifi-delete-dns-record.md
- `unifi_delete_dynamic_dns` — Destructive — https://policylayer.com/tools/io-github-sirkirby-unifi-access-mcp/unifi-delete-dynamic-dns.md
- `unifi_delete_firewall_group` — Destructive — https://policylayer.com/tools/io-github-sirkirby-unifi-access-mcp/unifi-delete-firewall-group.md
- `unifi_delete_firewall_policy` — Destructive — https://policylayer.com/tools/io-github-sirkirby-unifi-access-mcp/unifi-delete-firewall-policy.md
- `unifi_delete_port_forward` — Destructive — https://policylayer.com/tools/io-github-sirkirby-unifi-access-mcp/unifi-delete-port-forward.md
- `unifi_delete_port_profile` — Destructive — https://policylayer.com/tools/io-github-sirkirby-unifi-access-mcp/unifi-delete-port-profile.md
- `unifi_delete_wlan` — Destructive — https://policylayer.com/tools/io-github-sirkirby-unifi-access-mcp/unifi-delete-wlan.md
- `unifi_forget_client` — Destructive — https://policylayer.com/tools/io-github-sirkirby-unifi-access-mcp/unifi-forget-client.md
- `unifi_revoke_voucher` — Destructive — https://policylayer.com/tools/io-github-sirkirby-unifi-access-mcp/unifi-revoke-voucher.md
- `unifi_unauthorize_guest` — Destructive — https://policylayer.com/tools/io-github-sirkirby-unifi-access-mcp/unifi-unauthorize-guest.md
- `access_lock_door` — Execute — https://policylayer.com/tools/io-github-sirkirby-unifi-access-mcp/access-lock-door.md
- `access_reboot_device` — Execute — https://policylayer.com/tools/io-github-sirkirby-unifi-access-mcp/access-reboot-device.md
- `access_unlock_door` — Execute — https://policylayer.com/tools/io-github-sirkirby-unifi-access-mcp/access-unlock-door.md
- `protect_ptz_move` — Execute — https://policylayer.com/tools/io-github-sirkirby-unifi-access-mcp/protect-ptz-move.md
- `protect_ptz_preset` — Execute — https://policylayer.com/tools/io-github-sirkirby-unifi-access-mcp/protect-ptz-preset.md
- `protect_reboot_camera` — Execute — https://policylayer.com/tools/io-github-sirkirby-unifi-access-mcp/protect-reboot-camera.md
- `protect_trigger_chime` — Execute — https://policylayer.com/tools/io-github-sirkirby-unifi-access-mcp/protect-trigger-chime.md
- `unifi_batch` — Execute — https://policylayer.com/tools/io-github-sirkirby-unifi-access-mcp/unifi-batch.md
- …and 241 more: https://policylayer.com/tools/io-github-sirkirby-unifi-access-mcp.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=io-github-sirkirby-unifi-access-mcp · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/io-github-sirkirby-unifi-access-mcp