UniFi Gateway MCP server

by pete-builds·io.github.pete-builds/unifi·v0.23.0

No reviews yet

Safe-by-default UniFi MCP: Network + Protect + Access, multi-site, dry-run, audit log.

B73/100grade B

Write a review Install

What users say

No reviews yet

Be the first

Safety scan

B73/100

full report

Adoption

Growing

24 stars

Reviews

Write one

Nobody has reviewed UniFi Gateway yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

UniFi Gateway tools

No tool declarations could be read from the package source. They show once the server is installed.

Public scan report

scanner v0.1.5 · 2026-09-19 · same rubric, same numbers if you re-run it

no findings

–Code scanpackage could not be scannedn/a
–Live reliabilityno gateway calls yet and no remote to proben/a
–Tool poisoningtools not inspected (local package is not executed); not countedn/a
Auth qualitystatic API keys via environment variables6/15
Maintenancelast push 1 days ago15/15
Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10

Overall 73/100. Components that don't apply are left out of the denominator. Any critical finding is an F.Rubric Appeal a finding JSON

Install directly

claude mcp add unifi -- docker run -i --rm ghcr.io/pete-builds/mcp-unifi:0.23.0

Add to Cursor

UniFi Gateway: common questions

Is UniFi Gateway MCP server safe?: Mostly: it is graded B (73/100). Read the UniFi Gateway safety report
How do I install UniFi Gateway?: It runs on your machine. Copy the Claude Code, Claude Desktop or Cursor config from the install section.
Does UniFi Gateway need an API key?: Yes. The registry entry asks for UNIFI_API_KEY, UNIFI_ACCESS_API_KEY.
Is UniFi Gateway maintained?: The last commit was 2 days ago (2026-09-18). The latest release is v0.23.0.
What can I use instead of UniFi Gateway?: Servers from other publishers that do the same job: SSH — policy-gated remote access MCP server.

Alternatives to UniFi Gateway

Same job from other publishers: the closest match first, then the best rated.

SSH — policy-gated remote access
Policy-gated, audited SSH for Linux and Windows hosts: roles, approvals, and an audit log.
not reviewed
Established
B

Run it through the gateway

Local package. It runs on your machine, not through the gateway.

Rating: —
Safety grade: B · 73/100
Stars: 24
Downloads/wk: –
Price: Free
Licence: MIT
Transport: Local · oci
Version: 0.23.0
Category: Everything else
Last release: 2026-09-18

Credentials it needs

STUB_MODEWhen true, the server returns realistic mock data and requires no UniFi hardware. Defaults to true so the image is functional out of the box.
UNIFI_HOSTIP address or hostname of the UniFi OS gateway (UCG-Fiber, UDM Pro, etc). Required when STUB_MODE=false and MCP_UNIFI_CONTROLLERS_FILE is unset.
UNIFI_API_KEYsecretLocal API key generated under Settings -> Control Plane -> Integrations on the gateway. Required when STUB_MODE=false and MCP_UNIFI_CONTROLLERS_FILE is unset.
UNIFI_SITEUniFi controller site name. Defaults to 'default'.
UNIFI_VERIFY_SSLWhether to verify the gateway's TLS certificate. Defaults to false because most home gateways use a self-signed cert.
MCP_UNIFI_CONTROLLERS_FILEPath to a YAML file describing multiple named controllers for multi-site management. When set, the legacy UNIFI_HOST / UNIFI_API_KEY env vars are ignored. Each entry needs name, host, api_key, and optionally port, site, verify_ssl.
MCP_UNIFI_MODULES_ENABLEDComma-separated list of modules to load. Known values: 'network', 'protect', 'access'. Defaults to 'network'. Set to 'network,protect,access' to enable Protect and Access tools alongside Network. Access currently ships read-only; door unlocks and credential issuance require session-token auth and are deferred.
UNIFI_ACCESS_HOSTUniFi Access hub IP or hostname. Required when the access module is enabled and STUB_MODE=false. Often the same host as UNIFI_HOST.
UNIFI_ACCESS_API_KEYsecretUniFi Access API key. Separate from the Network API key; generated on the Access controller's developer settings. Required when the access module is enabled and STUB_MODE=false.
UNIFI_ACCESS_PORTHTTPS port for the Access hub. Defaults to 12445 (the direct Access app port).
MCP_UNIFI_AUDIT_SINKAudit log sink. One of 'file' (default), 'stdout', or 'syslog'. Every tool call is recorded to a JSONL stream with secrets scrubbed.
MCP_UNIFI_AUDIT_PATHPath for the audit log file when MCP_UNIFI_AUDIT_SINK=file. Defaults to audit.jsonl in the process CWD.

Own this server?

Claim it to keep the listing current and reply to reviews. Claiming never changes the grade or hides a review.

Claim listing

Badge for your README

Shows the safety grade and links back to this page. It updates itself after every scan and review.

[![mcp.market](https://mcp.market/badge/pete-builds-unifi.svg)](https://mcp.market/server/pete-builds-unifi)

How the badge works