Tool reference

unifi-mcp has 132 tools in 14 toolsets: 54 read, 55 write and 23 delete. It also has 5 prompts.

Each tool is labelled with the setting it needs:

Label	Registered when
🟢 read	Always
🟠 write	UNIFI_ALLOW_WRITES=true
🔴 delete	UNIFI_ALLOW_WRITES=true and UNIFI_ALLOW_DELETES=true

Every tool also needs its toolset to be enabled in UNIFI_TOOLSETS, which enables all toolsets by default. Most tools take an optional site argument, which defaults to UNIFI_SITE.

Contents

• overview: Sites, controller information and site health.
• devices: UniFi devices (gateways, switches, access points, PDUs): status, firmware, radios, adoption and maintenance.
• clients: Connected and known clients: lookup, blocking, reconnecting and naming.
• switching: Switch ports and port profiles, including PoE.
• wifi: WiFi networks (WLANs) and join QR codes.
• networks: Networks/VLANs, WAN links, local DNS records, bandwidth profiles and dynamic DNS.
• firewall: Port forwards, legacy firewall rules and groups, zone-based firewall policies and zones, and traffic rules.
• routing: Static routes and policy-based traffic routes.
• security: Threat management (IDS/IPS), country blocking and content filtering.
• vpn: VPN servers and site-to-site VPNs, RADIUS profiles and RADIUS accounts.
• hotspot: Hotspot vouchers, operators, guest authorization and the guest portal.
• monitoring: Events, alarms, traffic and DPI statistics, speed tests, logs and dashboards.
• admin: Site settings, administrators, backups, controller updates and site management.
• raw: A raw API escape hatch for anything the other tools don’t cover. It is limited to GET requests unless writes are enabled.

overview

Sites, controller information and site health.

Tool	Access	Summary
unifi_list_sites	🟢 read	List sites
unifi_get_system_info	🟢 read	Get controller system info
unifi_get_site_health	🟢 read	Get site health

unifi_list_sites

🟢 read

List the UniFi sites on the controller. The name field is the site ID used by the site argument of other tools.

No arguments.

unifi_get_system_info

🟢 read

Get controller/Network application version, hostname, timezone, uptime and update availability.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.

unifi_get_site_health

🟢 read

Get the health of each subsystem (WAN, LAN, WLAN, VPN, www) for a site: status, ISP, WAN IP, latency, throughput, device and client counts.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.

devices

UniFi devices (gateways, switches, access points, PDUs): status, firmware, radios, adoption and maintenance.

Tool	Access	Summary
unifi_list_devices	🟢 read	List devices
unifi_get_device	🟢 read	Get device details
unifi_get_firmware_status	🟢 read	Get firmware status
unifi_get_rf_scan	🟢 read	Get RF scan results
unifi_list_ap_groups	🟢 read	List AP groups
unifi_update_device	🟠 write	Update device settings
unifi_set_radio	🟠 write	Configure AP radio
unifi_set_outlet	🟠 write	Control power outlet
unifi_restart_device	🟠 write	Restart device
unifi_locate_device	🟠 write	Locate device (flash LED)
unifi_upgrade_device	🟠 write	Upgrade device firmware
unifi_rolling_upgrade	🟠 write	Start/cancel rolling upgrade
unifi_provision_device	🟠 write	Force provision device
unifi_adopt_device	🟠 write	Adopt device
unifi_move_device	🟠 write	Move device to another site
unifi_forget_device	🔴 delete	Forget (remove) device
unifi_run_rf_scan	🟠 write	Run RF scan
unifi_save_ap_group	🟠 write	Create/update AP group
unifi_delete_ap_group	🔴 delete	Delete AP group

unifi_list_devices

🟢 read

List UniFi network devices (gateways, switches, access points…) with state, model, firmware, uptime, load and client counts.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
type	"access_point" | "switch" | "gateway" | "other"		Only devices of this type
search	string		Case-insensitive substring filter on name, hostname, MAC, IP and similar fields
raw	boolean		Return the full unprocessed objects from the controller (large)

unifi_get_device

🟢 read

Get detailed information about one device by MAC: summary, switch ports, radio config and stats, uplink, LED and system stats.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
mac	string	yes	MAC address, e.g. aa:bb:cc:dd:ee:ff
raw	boolean		Return the full unprocessed objects from the controller (large)

unifi_get_firmware_status

🟢 read

Show each device’s current firmware and whether an upgrade is available. Optionally ask the controller to refresh its firmware cache first, and/or list the firmware images it knows about.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
refresh	boolean		Ask the controller to check for new device firmware first (cmd/productinfo)
include_available	boolean		Also list firmware images available to the controller (cmd/firmware list-available)

unifi_get_rf_scan

🟢 read

Get the state and results of an access point’s RF/spectrum scan (channel utilization and interference per channel). Start one with unifi_run_rf_scan.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
mac	string	yes	MAC address of the access point

unifi_list_ap_groups

🟢 read

List access point groups (used to choose which APs broadcast each WiFi network). Network 7.x+ (v2 API).

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.

unifi_update_device

🟠 write · destructive

Change a device’s settings: name, LED (on/off/site default, plus colour/brightness on LED-ring devices), enable/disable (disabling turns off its LED and radios; mainly supported on APs) and management IP (DHCP or static). Only the given fields change.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
mac	string	yes	MAC address, e.g. aa:bb:cc:dd:ee:ff
name	string		New display name
led	"on" | "off" | "default"		LED override; default follows the site-wide LED setting
led_color	string		LED colour as hex, e.g. #0000FF (LED-ring devices only)
led_brightness	integer		LED brightness 0-100 (LED-ring devices only)
disabled	boolean		true disables the device, false re-enables it
ip_config	object		Management IP configuration; static requires ip, netmask and gateway. A wrong static IP can make the device unreachable.
extra	object		Additional raw controller fields to set (advanced; field names as in the raw objects). Merged last.

unifi_set_radio

🟠 write · destructive

Change one radio on an access point: channel, channel width, transmit power and minimum RSSI. Only the given fields change. Clients on that radio will briefly disconnect.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
mac	string	yes	MAC address of the access point
radio	"ng" | "na" | "6e" | "ad"	yes	Radio: ng = 2.4 GHz, na = 5 GHz, 6e = 6 GHz, ad = 60 GHz
channel	"auto" | integer		‘auto’ or a channel number
channel_width	20 | 40 | 80 | 160 | 240 | 320		Channel width in MHz
tx_power_mode	"auto" | "high" | "medium" | "low" | "custom"		Transmit power mode
tx_power	integer		Transmit power in dBm (sets tx_power_mode=custom)
min_rssi	integer | null		Minimum RSSI in dBm (e.g. -75) below which clients are kicked; null disables it
extra	object		Additional raw controller fields to set (advanced; field names as in the raw objects). Merged last.

unifi_set_outlet

🟠 write · destructive

Switch an outlet on a UniFi SmartPower device (USP plug/strip/PDU) on or off, toggle its auto power-cycle (modem reset), or rename it. Only the given fields change.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
mac	string	yes	MAC address of the SmartPower device
index	integer	yes	Outlet index (see unifi_get_device outlets[].index)
on	boolean		Relay state: true = power on, false = power off
cycle_enabled	boolean		Automatically power-cycle the outlet when the internet connection drops
name	string		Outlet name

unifi_restart_device

🟠 write · destructive

Restart a UniFi device. reboot_type=hard also power-cycles PoE ports on switches (connected PoE devices will reboot too).

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
mac	string	yes	MAC address, e.g. aa:bb:cc:dd:ee:ff
reboot_type	"soft" | "hard"		soft (default) or hard

unifi_locate_device

🟠 write

Start or stop flashing a device’s LED so it can be found physically.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
mac	string	yes	MAC address, e.g. aa:bb:cc:dd:ee:ff
enabled	boolean	yes	true to start flashing, false to stop

unifi_upgrade_device

🟠 write · destructive

Upgrade a device to the latest firmware known to the controller, or to a specific firmware image URL. The device is offline while it upgrades and reboots. A wrong custom image can brick the device.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
mac	string	yes	MAC address, e.g. aa:bb:cc:dd:ee:ff
firmware_url	string		Upgrade to this firmware image instead of the latest (advanced)

unifi_rolling_upgrade

🟠 write · destructive

Start a rolling (one-at-a-time) firmware upgrade of all devices of the given types to the latest firmware, or cancel one in progress.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
action	"start" | "cancel"	yes
types	("uap" | "usw" | "ugw" | "uxg")[]		Device types to upgrade when starting (default all: uap, usw, ugw, uxg)

unifi_provision_device

🟠 write

Force the controller to re-push configuration to a device.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
mac	string	yes	MAC address, e.g. aa:bb:cc:dd:ee:ff

unifi_adopt_device

🟠 write

Adopt a device that is pending adoption (see unifi_list_devices, state=pending_adoption).

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
mac	string	yes	MAC address, e.g. aa:bb:cc:dd:ee:ff

unifi_move_device

🟠 write · destructive

Move an adopted device from this site to another site on the same controller.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
mac	string	yes	MAC address, e.g. aa:bb:cc:dd:ee:ff
target_site	string	yes	Destination site: its name (e.g. ‘branch’), description, or 24-character _id (see unifi_list_sites)

unifi_forget_device

🔴 delete · destructive

Remove a device from the site. It is factory-reset when next reachable and must be re-adopted to be used again.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
mac	string	yes	MAC address, e.g. aa:bb:cc:dd:ee:ff

unifi_run_rf_scan

🟠 write · destructive

Start an RF/spectrum scan on an access point. Its radios go offline for a few minutes while scanning, disconnecting clients. Fetch results with unifi_get_rf_scan.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
mac	string	yes	MAC address of the access point

unifi_save_ap_group

🟠 write

Create an access point group (omit id) or update one (pass id). device_macs replaces the group’s member list when given.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
id	string		AP group ID to update; omit to create
name	string		Group name (required when creating)
device_macs	string[]		MAC addresses of the APs in the group (replaces the current list)

unifi_delete_ap_group

🔴 delete · destructive

Delete an access point group. WiFi networks assigned to it must be moved to another group first.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
id	string	yes	AP group ID (the id field returned by the matching list tool)

clients

Connected and known clients: lookup, blocking, reconnecting and naming.

Tool	Access	Summary
unifi_list_clients	🟢 read	List connected clients
unifi_list_known_clients	🟢 read	List known clients
unifi_get_client	🟢 read	Get client details
unifi_block_client	🟠 write	Block client
unifi_unblock_client	🟠 write	Unblock client
unifi_reconnect_client	🟠 write	Reconnect (kick) client
unifi_forget_clients	🟠 write	Forget clients
unifi_update_client	🟠 write	Update client settings

unifi_list_clients

🟢 read

List clients that are currently connected, with IP, network, AP/switch port, signal, rates, usage and uptime.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
connection	"all" | "wired" | "wireless"		Filter by connection type (default all)
guests_only	boolean		Only guest clients
search	string		Case-insensitive substring filter on name, hostname, MAC, IP and similar fields
limit	integer		Maximum number of results (default 200)
raw	boolean		Return the full unprocessed objects from the controller (large)

unifi_list_known_clients

🟢 read

List all clients the controller has ever seen (including offline ones), with alias, note, fixed IP and block status.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
filter	"all" | "blocked" | "fixed_ip" | "noted" | "named"		Only blocked clients, clients with a fixed IP, clients with a note, or clients with an alias
search	string		Case-insensitive substring filter on name, hostname, MAC, IP and similar fields
limit	integer		Maximum number of results (default 200)
raw	boolean		Return the full unprocessed objects from the controller (large)

unifi_get_client

🟢 read

Get everything known about a client by MAC: stored settings plus live connection details if it is online.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
mac	string	yes	MAC address, e.g. aa:bb:cc:dd:ee:ff
raw	boolean		Return the full unprocessed objects from the controller (large)

unifi_block_client

🟠 write · destructive

Block a client from connecting to the network.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
mac	string	yes	MAC address, e.g. aa:bb:cc:dd:ee:ff

unifi_unblock_client

🟠 write

Unblock a previously blocked client.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
mac	string	yes	MAC address, e.g. aa:bb:cc:dd:ee:ff

unifi_reconnect_client

🟠 write

Disconnect a wireless client so it reconnects (useful to force a roam or re-authentication).

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
mac	string	yes	MAC address, e.g. aa:bb:cc:dd:ee:ff

unifi_forget_clients

🟠 write · destructive

Remove clients and their history (alias, note, fixed IP, statistics) from the controller.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
macs	string[]	yes	MAC addresses to forget

unifi_update_client

🟠 write

Set a known client’s alias (name) and note, or assign/clear a fixed IP (DHCP reservation). Only the fields given are changed.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
mac	string	yes	MAC address, e.g. aa:bb:cc:dd:ee:ff
name	string		Alias to show instead of the hostname (empty string clears it)
note	string		Free-text note (empty string clears it)
fixed_ip	string		IPv4 address to reserve for this client
network_id	string		Network ID the fixed IP belongs to (defaults to the client’s current network; see unifi_list_networks)
clear_fixed_ip	boolean		Remove the fixed IP reservation

switching

Switch ports and port profiles, including PoE.

Tool	Access	Summary
unifi_list_port_profiles	🟢 read	List switch port profiles
unifi_save_port_profile	🟠 write	Create/update switch port profile
unifi_delete_port_profile	🔴 delete	Delete switch port profile
unifi_list_switch_ports	🟢 read	List switch ports
unifi_set_switch_port	🟠 write	Configure switch port
unifi_reset_switch_port	🟠 write	Reset switch port override
unifi_power_cycle_port	🟠 write	Power-cycle PoE port

unifi_list_port_profiles

🟢 read

List switch port profiles (port configurations) with native/tagged networks and PoE settings.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.

unifi_save_port_profile

🟠 write · destructive

Create a switch port profile (omit id) or update one (pass id; only the given fields change). Ports using the profile are reprovisioned, which can briefly interrupt traffic.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
id	string		Port profile ID to update; omit to create
name	string		Profile name (required when creating)
native_network_id	string		Native (untagged) network ID (see unifi_list_networks)
tagged_vlan_mgmt	"auto" | "block_all" | "custom"		Tagged VLANs: auto (allow all), block_all (native VLAN only) or custom (allow all except excluded_network_ids)
excluded_network_ids	string[]		Network IDs NOT to tag on the port (used with tagged_vlan_mgmt=custom)
poe_mode	"auto" | "pasv24" | "passthrough" | "off"		PoE mode: auto (802.3af/at/bt), pasv24 (24V passive), passthrough, or off
speed	"auto" | integer		Link speed: ‘auto’ (autonegotiate) or a fixed speed in Mbps (10, 100, 1000, 2500, 10000…)
full_duplex	boolean		Full duplex when a fixed speed is set (default true)
isolation	boolean		Port isolation: block traffic to other isolated ports
storm_control	boolean		Enable broadcast/multicast/unicast storm control
op_mode	"switch" | "mirror" | "aggregate"		Operation mode: switch (normal), mirror (port mirroring) or aggregate (link aggregation)
extra	object		Additional raw controller fields to set (advanced; field names as in the raw objects). Merged last.

unifi_delete_port_profile

🔴 delete · destructive

Delete a switch port profile. Ports using it fall back to the default profile.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
id	string	yes	Port profile ID (the id field returned by the matching list tool)

unifi_list_switch_ports

🟢 read

List a switch’s ports with link state, speed, PoE, assigned profile and any per-port overrides configured on the device.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
mac	string	yes	MAC address of the switch

unifi_set_switch_port

🟠 write · destructive

Configure one switch port via a per-port override: name, enable/disable, port profile, native/tagged VLANs, PoE, speed, isolation, storm control. Only the given fields change; other ports are untouched. Disabling uses port security with no allowed MACs (blocks all traffic), as the UniFi UI does.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
mac	string	yes	MAC address of the switch
port_idx	integer	yes	Port number (see unifi_list_switch_ports)
name	string		Port name/label
enabled	boolean		false blocks all traffic on the port; true re-enables it
profile_id	string		Port profile ID to assign (see unifi_list_port_profiles)
native_network_id	string		Native (untagged) network ID (see unifi_list_networks)
tagged_vlan_mgmt	"auto" | "block_all" | "custom"		Tagged VLANs: auto (allow all), block_all (native VLAN only) or custom (allow all except excluded_network_ids)
excluded_network_ids	string[]		Network IDs NOT to tag on the port (used with tagged_vlan_mgmt=custom)
poe_mode	"auto" | "pasv24" | "passthrough" | "off"		PoE mode: auto (802.3af/at/bt), pasv24 (24V passive), passthrough, or off
speed	"auto" | integer		Link speed: ‘auto’ (autonegotiate) or a fixed speed in Mbps (10, 100, 1000, 2500, 10000…)
full_duplex	boolean		Full duplex when a fixed speed is set (default true)
isolation	boolean		Port isolation: block traffic to other isolated ports
storm_control	boolean		Enable broadcast/multicast/unicast storm control
op_mode	"switch" | "mirror" | "aggregate"		Operation mode: switch (normal), mirror (port mirroring) or aggregate (link aggregation)
extra	object		Additional raw controller fields to set (advanced; field names as in the raw objects). Merged last.

unifi_reset_switch_port

🟠 write · destructive

Remove the per-port override from one or more switch ports so they follow the default port profile again.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
mac	string	yes	MAC address of the switch
port_idx	integer[]	yes	Port numbers to reset

unifi_power_cycle_port

🟠 write · destructive

Power-cycle a PoE port on a switch, rebooting the device powered by it.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
mac	string	yes	MAC address of the switch
port_idx	integer	yes	Port number (see unifi_list_switch_ports)

wifi

WiFi networks (WLANs) and join QR codes.

Tool	Access	Summary
unifi_list_wlans	🟢 read	List WiFi networks
unifi_save_wlan	🟠 write	Create/update WiFi network
unifi_delete_wlan	🔴 delete	Delete WiFi network
unifi_get_wifi_qr	🟢 read	Get WiFi join string (QR)

unifi_list_wlans

🟢 read

List wireless networks (SSIDs) with security, bands, linked network and enabled state.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
raw	boolean		Return the full unprocessed objects from the controller (large)
include_secrets	boolean		Include secret fields such as passphrases and shared keys (redacted by default)

unifi_save_wlan

🟠 write · destructive

Create a WiFi network/SSID (no id) or update one (id; only the fields passed change): name, password, security, WPA3, VLAN network, bands, AP groups, guest/hidden/isolation, bandwidth profile, MAC filter, fast roaming, minimum data rates, enabled. On create, defaults are WPA2-PSK (or open without a passphrase), 2.4+5 GHz, the default network, bandwidth profile and all APs. Changes reconnect clients on that SSID.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
id	string		WLAN ID to update; omit to create
name	string		SSID (required on create)
passphrase	string		WPA passphrase (8-63 characters)
security	"open" | "wpapsk" | "wpaeap"		open, wpapsk (personal) or wpaeap (enterprise/RADIUS)
wpa_mode	"wpa2" | "wpa1" | "auto"		WPA version for WPA2/WPA mixed (default wpa2)
wpa3	"off" | "transition" | "only"		WPA3: off, transition (WPA2/WPA3 mixed) or only
network_id	string		Network (VLAN) the SSID bridges to (see unifi_list_networks)
ap_group_ids	string[]		AP groups that broadcast the SSID (default: all APs)
bands	("2g" | "5g" | "6g")[]		Radio bands, e.g. [‘2g’,‘5g’]
hidden	boolean		Hide the SSID
guest	boolean		Apply guest policies (guest portal / restrictions)
client_isolation	boolean		Block clients on this SSID from talking to each other
bandwidth_profile_id	string		Bandwidth profile (user group) ID, see unifi_list_bandwidth_profiles
radius_profile_id	string		RADIUS profile for security wpaeap, see unifi_list_radius_profiles
mac_filter	object | null		MAC address filter; null disables it
fast_roaming	boolean		802.11r fast roaming
bss_transition	boolean		802.11v BSS transition (helps steer clients between APs)
min_rate_2g_kbps	integer | null		Minimum 2.4 GHz data rate in kbps (e.g. 6000, 12000); null disables
min_rate_5g_kbps	integer | null		Minimum 5 GHz data rate in kbps; null disables
enabled	boolean
extra	object		Additional raw wlanconf fields, e.g. schedule_enabled + schedule_with_duration, uapsd_enabled, group_rekey, dtim_ng/dtim_na, pmf_mode, iapp_enabled. Merged last.

unifi_delete_wlan

🔴 delete · destructive

Delete a WiFi network (SSID). Clients connected to it are disconnected.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
id	string	yes	WLAN ID (the id field returned by the matching list tool)

unifi_get_wifi_qr

🟢 read

Get the standard WIFI: join string for an SSID, which phones understand when encoded as a QR code. NOTE: this reveals the WiFi password.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
id	string	yes	WLAN ID (the id field returned by the matching list tool)

networks

Networks/VLANs, WAN links, local DNS records, bandwidth profiles and dynamic DNS.

Tool	Access	Summary
unifi_list_networks	🟢 read	List networks
unifi_save_network	🟠 write	Create/update LAN or VLAN
unifi_delete_network	🔴 delete	Delete LAN or VLAN
unifi_list_wans	🟢 read	List WAN connections
unifi_update_wan	🟠 write	Update WAN settings
unifi_list_dns_records	🟢 read	List local DNS records
unifi_save_dns_record	🟠 write	Create/update local DNS record
unifi_delete_dns_record	🔴 delete	Delete local DNS record
unifi_list_bandwidth_profiles	🟢 read	List bandwidth profiles
unifi_save_bandwidth_profile	🟠 write	Create/update bandwidth profile
unifi_delete_bandwidth_profile	🔴 delete	Delete bandwidth profile
unifi_list_dynamic_dns	🟢 read	List dynamic DNS
unifi_save_dynamic_dns	🟠 write	Create/update dynamic DNS

unifi_list_networks

🟢 read

List configured networks (LANs/VLANs, WANs, VPNs) with subnet, VLAN ID and DHCP settings.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
raw	boolean		Return the full unprocessed objects from the controller (large)
include_secrets	boolean		Include secret fields such as passphrases and shared keys (redacted by default)

unifi_save_network

🟠 write · destructive

Create a LAN/VLAN network (no id) or update one (id; only the fields passed change). Handles purposes corporate (regular LAN), guest and vlan-only. On create, DHCP is enabled with a range derived from the subnet unless given. Use unifi_update_wan for WANs and unifi_save_vpn for VPNs. Changing subnet/VLAN/DHCP disrupts connected clients.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
id	string		Network ID to update; omit to create
name	string		Network name (required on create)
purpose	"corporate" | "guest" | "vlan-only"		corporate (default), guest, or vlan-only (VLAN with no gateway/DHCP)
vlan	integer | null		VLAN ID; null removes VLAN tagging
subnet	string		Gateway IP and prefix, e.g. 192.168.10.1/24
dhcp_enabled	boolean		Run the DHCP server on this network
dhcp_start	string		First address of the DHCP range
dhcp_stop	string		Last address of the DHCP range
dhcp_lease_seconds	integer		DHCP lease time in seconds (default 86400)
dhcp_dns	string[]		DNS servers handed out by DHCP (up to 4); empty array reverts to the gateway
dhcp_gateway	string | null		Override the gateway handed out by DHCP; null reverts to automatic
domain_name	string		Domain name handed out by DHCP
igmp_snooping	boolean
isolated	boolean		Network isolation: block traffic to other local networks
internet_access	boolean		Allow internet access (false blocks it)
mdns	boolean		Enable multicast DNS forwarding for this network
enabled	boolean
extra	object		Additional raw networkconf fields, e.g. DHCP options (dhcpd_ntp_1, dhcpd_boot_enabled/dhcpd_boot_server/dhcpd_boot_filename, dhcpd_tftp_server, dhcpd_wins_1) or IPv6 (ipv6_interface_type, ipv6_ra_enabled). Merged last.

unifi_delete_network

🔴 delete · destructive

Delete a LAN/VLAN network (purpose corporate, guest or vlan-only). WAN networks cannot be deleted here; VPNs use unifi_delete_vpn. Clients on the network lose connectivity.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
id	string	yes	Network ID (the id field returned by the matching list tool)

unifi_list_wans

🟢 read

List WAN interfaces with connection type, VLAN, static/PPPoE settings, failover/load-balancing and Smart Queues, plus live WAN health.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.

unifi_update_wan

🟠 write · destructive

Change a WAN interface’s connection type (DHCP/static/PPPoE), VLAN, DNS, failover/load balancing or Smart Queues. Only the fields passed change. A wrong setting can take the site offline.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
id	string	yes	WAN network (see unifi_list_wans) ID (the id field returned by the matching list tool)
type	"dhcp" | "static" | "pppoe"		Connection type
static_ip	string		Static WAN IP (type static)
netmask	string		Static WAN netmask, e.g. 255.255.255.0
gateway	string		Static WAN gateway
dns	string[]		Manual DNS servers; empty array reverts to ISP-provided DNS
pppoe_username	string
pppoe_password	string
vlan	integer | null		WAN VLAN ID (some ISPs require one); null disables
load_balance_type	"failover-only" | "weighted"		failover-only uses this WAN only when higher-priority WANs fail; weighted load-balances
load_balance_weight	integer		Weight for weighted load balancing
failover_priority	integer		Failover priority (lower is preferred)
smart_queues	boolean		Enable Smart Queues (SQM) to reduce bufferbloat
download_kbps	integer		Smart Queues / ISP download rate in kbps
upload_kbps	integer		Smart Queues / ISP upload rate in kbps
extra	object		Additional raw controller fields to set (advanced; field names as in the raw objects). Merged last.

unifi_list_dns_records

🟢 read

List local DNS records served by the gateway (v2 static-dns; UniFi Network 8.2+).

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.

unifi_save_dns_record

🟠 write

Create (no id) or update (id; only fields passed change) a local DNS record served by the gateway (UniFi Network 8.2+). For A/AAAA the value is an IP; for CNAME a hostname; for MX/SRV set priority (and weight/port for SRV).

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
id	string		Record ID to update; omit to create
type	"A" | "AAAA" | "CNAME" | "MX" | "TXT" | "SRV" | "NS"		Record type (default A on create)
name	string		Record name (domain), e.g. nas.home.arpa (required on create)
value	string		Record value: IP address, target hostname or text (required on create)
ttl	integer		TTL in seconds; 0 = automatic
priority	integer		MX/SRV priority
weight	integer		SRV weight
port	integer		SRV port
enabled	boolean
extra	object		Additional raw controller fields to set (advanced; field names as in the raw objects). Merged last.

unifi_delete_dns_record

🔴 delete · destructive

Delete a local DNS record.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
id	string	yes	DNS record ID (the id field returned by the matching list tool)

unifi_list_bandwidth_profiles

🟢 read

List bandwidth profiles (user groups) that cap client download/upload rates; assign them to WLANs or clients.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.

unifi_save_bandwidth_profile

🟠 write

Create (no id) or update (id) a bandwidth profile (user group). Rates are in kbps; -1 means unlimited.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
id	string		Profile ID to update; omit to create
name	string		Profile name (required on create)
download_kbps	integer		Download cap in kbps (-1 = unlimited)
upload_kbps	integer		Upload cap in kbps (-1 = unlimited)

unifi_delete_bandwidth_profile

🔴 delete · destructive

Delete a bandwidth profile (user group). The default profile cannot be deleted.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
id	string	yes	Bandwidth profile ID (the id field returned by the matching list tool)

unifi_list_dynamic_dns

🟢 read

List dynamic DNS configurations (passwords redacted unless include_secrets).

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
include_secrets	boolean		Include secret fields such as passphrases and shared keys (redacted by default)

unifi_save_dynamic_dns

🟠 write

Create (no id) or update (id) a dynamic DNS configuration on the gateway.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
id	string		Entry ID to update; omit to create
service	string		Provider, e.g. dyndns, noip, afraid, duckdns, dnspark, easydns, namecheap, zoneedit, cloudflare or custom (required on create)
hostname	string		Hostname to update (required on create)
login	string		Username / login
password	string		Password or API token
server	string		Update server (custom service)
interface	string		WAN interface: wan (default) or wan2
extra	object		Additional raw controller fields to set (advanced; field names as in the raw objects). Merged last.

firewall

Port forwards, legacy firewall rules and groups, zone-based firewall policies and zones, and traffic rules.

Tool	Access	Summary
unifi_list_port_forwards	🟢 read	List port forwards
unifi_save_port_forward	🟠 write	Create or update port forward
unifi_delete_port_forward	🔴 delete	Delete port forward
unifi_list_firewall_rules	🟢 read	List firewall rules (legacy)
unifi_save_firewall_rule	🟠 write	Create or update firewall rule (legacy)
unifi_delete_firewall_rule	🔴 delete	Delete firewall rule (legacy)
unifi_list_firewall_groups	🟢 read	List firewall groups
unifi_save_firewall_group	🟠 write	Create or update firewall group
unifi_delete_firewall_group	🔴 delete	Delete firewall group
unifi_list_firewall_policies	🟢 read	List firewall policies (zone-based)
unifi_save_firewall_policy	🟠 write	Create or update firewall policy (zone-based)
unifi_delete_firewall_policy	🔴 delete	Delete firewall policy (zone-based)
unifi_get_firewall_policy_ordering	🟢 read	Get firewall policy order
unifi_set_firewall_policy_ordering	🟠 write	Reorder firewall policies
unifi_list_firewall_zones	🟢 read	List firewall zones
unifi_save_firewall_zone	🟠 write	Create or update firewall zone
unifi_delete_firewall_zone	🔴 delete	Delete firewall zone
unifi_list_traffic_rules	🟢 read	List traffic rules
unifi_save_traffic_rule	🟠 write	Create or update traffic rule
unifi_delete_traffic_rule	🔴 delete	Delete traffic rule

unifi_list_port_forwards

🟢 read

List port forwarding rules.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.

unifi_save_port_forward

🟠 write · destructive

Create a port forward (name, external_port and forward_ip required) or update one by id. Defaults on create: WAN interface ‘wan’, protocol tcp_udp, any source, enabled.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
id	string		Port forward ID to update (only the fields passed are changed). Omit to create a new one.
name	string
enabled	boolean
wan_interface	"wan" | "wan2" | "both"		WAN interface to listen on
protocol	"tcp_udp" | "tcp" | "udp"
source	string		Allowed source: ‘any’ or an IP/CIDR
destination_ip	string		WAN IP to match (‘any’ for all WAN IPs; newer Network versions)
external_port	string		External port or range, e.g. ‘443’ or ‘8000-8100’
forward_ip	string		Internal IP to forward to
forward_port	string		Internal port or range (defaults to external_port on create)
log	boolean		Log forwarded connections
extra	object		Additional raw controller fields to set (advanced; field names as in the raw objects). Merged last.

unifi_delete_port_forward

🔴 delete · destructive

Delete a port forwarding rule.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
id	string	yes	Port forward ID (the id field returned by the matching list tool)

unifi_list_firewall_rules

🟢 read

List classic firewall rules (WAN_IN, LAN_IN, …). On Network 9+ with zone-based firewall use unifi_list_firewall_policies instead.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
raw	boolean		Return the full unprocessed objects from the controller (large)

unifi_save_firewall_rule

🟠 write · destructive

Create a classic firewall rule (name, ruleset and action required) or update one by id. Not for zone-based firewall (Network 9+ with zones migrated) — use unifi_save_firewall_policy there. On create, rule_index defaults to the next free index from 2000 in the ruleset (rules before the predefined ones).

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
id	string		Firewall rule ID to update (only the fields passed are changed). Omit to create a new one.
name	string
enabled	boolean
ruleset	"WAN_IN" | "WAN_OUT" | "WAN_LOCAL" | "LAN_IN" | "LAN_OUT" | "LAN_LOCAL" | "GUEST_IN" | "GUEST_OUT" | "GUEST_LOCAL" | "WANv6_IN" | "WANv6_OUT" | "WANv6_LOCAL" | "LANv6_IN" | "LANv6_OUT" | "LANv6_LOCAL" | "GUESTv6_IN" | "GUESTv6_OUT" | "GUESTv6_LOCAL"
rule_index	integer		Order within the ruleset (2000-2999 run before predefined rules, 4000+ after)
action	"accept" | "drop" | "reject"
protocol	string		all (default), tcp, udp, tcp_udp, icmp, or another protocol name/number
protocol_match_excepted	boolean		Match every protocol except the one given
src_network_id	string		Source network ID
src_network_type	"NETv4" | "ADDRv4"		NETv4 = whole subnet, ADDRv4 = gateway IP of the network
src_address	string		Source IP/CIDR
src_mac	string		Source MAC address
src_group_ids	string[]		Source firewall group IDs (address and/or port group)
src_port	string		Source port(s) (tcp/udp only)
dst_network_id	string
dst_network_type	"NETv4" | "ADDRv4"
dst_address	string		Destination IP/CIDR
dst_group_ids	string[]		Destination firewall group IDs
dst_port	string		Destination port(s) (tcp/udp only)
states	("new" | "established" | "related" | "invalid")[]		Connection states to match (none = all states)
logging	boolean
extra	object		Additional raw controller fields to set (advanced; field names as in the raw objects). Merged last.

unifi_delete_firewall_rule

🔴 delete · destructive

Delete a classic firewall rule.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
id	string	yes	Firewall rule ID (the id field returned by the matching list tool)

unifi_list_firewall_groups

🟢 read

List firewall groups (address groups, IPv6 address groups and port groups) referenced by firewall rules and policies.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.

unifi_save_firewall_group

🟠 write · destructive

Create a firewall group (name and type required) or update one by id. members replaces the whole member list. The type of an existing group cannot be changed.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
id	string		Firewall group ID to update (only the fields passed are changed). Omit to create a new one.
name	string
type	"address-group" | "ipv6-address-group" | "port-group"
members	string[]		IPs/CIDRs (address groups) or ports/ranges like ‘80’ or ‘8000-8100’ (port groups)
extra	object		Additional raw controller fields to set (advanced; field names as in the raw objects). Merged last.

unifi_delete_firewall_group

🔴 delete · destructive

Delete a firewall group. The controller refuses to delete groups still referenced by rules or policies.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
id	string	yes	Firewall group ID (the id field returned by the matching list tool)

unifi_list_firewall_policies

🟢 read

List zone-based firewall policies (UniFi Network 9.0+). Predefined (system) policies are hidden unless include_predefined is set.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
include_predefined	boolean		Also return predefined/system policies
raw	boolean		Return the full unprocessed objects from the controller (large)

unifi_save_firewall_policy

🟠 write · destructive

Create a zone-based firewall policy (name, action, source and destination required) or update one by id (Network 9.0+). source/destination: {zone_id, matching_target: ANY|IP|NETWORK|CLIENT|REGION|…, ips | network_ids | client_macs, port_matching_type, port | port_group_id}; on update they are merged into the current endpoint. Use unifi_list_firewall_zones for zone IDs. Predefined policies cannot be changed.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
id	string		Firewall policy ID to update (only the fields passed are changed). Omit to create a new one.
name	string
description	string
enabled	boolean
action	"ALLOW" | "BLOCK" | "REJECT"
source	object		Policy endpoint; extra controller fields are passed through
destination	object		Policy endpoint; extra controller fields are passed through
protocol	string		all (default), tcp, udp, tcp_udp, icmp, icmpv6, …
ip_version	"BOTH" | "IPV4" | "IPV6"
connection_state_type	"ALL" | "RESPOND_ONLY" | "CUSTOM"
connection_states	("NEW" | "ESTABLISHED" | "RELATED" | "INVALID")[]		With connection_state_type=CUSTOM
create_allow_respond	boolean		For ALLOW policies: also create the return-traffic policy
logging	boolean
schedule	object		e.g. {mode: ‘ALWAYS’} (default) or a custom schedule object
extra	object		Additional raw controller fields to set (advanced; field names as in the raw objects). Merged last.

unifi_delete_firewall_policy

🔴 delete · destructive

Delete a user-defined zone-based firewall policy (predefined policies are refused).

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
id	string	yes	Firewall policy ID (the id field returned by the matching list tool)

unifi_get_firewall_policy_ordering

🟢 read

Get the evaluation order of user-defined policies between a source and destination zone (beforeSystemDefined / afterSystemDefined policy ID lists). Uses the official integration API, so it requires API-key authentication (UNIFI_API_KEY) and Network 9.0+.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
source_zone_id	string	yes	Source zone ID (v2 _id from unifi_list_firewall_zones, or integration API id)
destination_zone_id	string	yes	Destination zone ID

unifi_set_firewall_policy_ordering

🟠 write · destructive

Set the evaluation order of user-defined policies between two zones. Pass every policy ID from unifi_get_firewall_policy_ordering, reordered (IDs are the integration API’s). Uses the official integration API, so it requires API-key authentication (UNIFI_API_KEY) and Network 9.0+.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
source_zone_id	string	yes	Source zone ID
destination_zone_id	string	yes	Destination zone ID
before_system_defined	string[]	yes	Policy IDs evaluated before the predefined policies, in order
after_system_defined	string[]		Policy IDs evaluated after the predefined policies, in order

unifi_list_firewall_zones

🟢 read

List zone-based firewall zones and the networks in each (UniFi Network 9.0+).

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
raw	boolean		Return the full unprocessed objects from the controller (large)

unifi_save_firewall_zone

🟠 write · destructive

Create a custom firewall zone (name required) or update one by id: rename it and/or set which networks it contains (network_ids replaces the list). System-defined zones cannot be renamed. Uses the official integration API, so it requires API-key authentication (UNIFI_API_KEY) and Network 9.0+.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
id	string		Firewall zone ID to update (only the fields passed are changed). Omit to create a new one.
name	string
network_ids	string[]		Network IDs in the zone (see unifi_list_networks)

unifi_delete_firewall_zone

🔴 delete · destructive

Delete a custom firewall zone (system-defined zones are refused). Uses the official integration API, so it requires API-key authentication (UNIFI_API_KEY) and Network 9.0+.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
id	string	yes	Firewall zone ID (the id field returned by the matching list tool)

unifi_list_traffic_rules

🟢 read

List traffic management rules (block/allow/limit by app, domain, IP, region or internet) from the v2 API.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
raw	boolean		Return the full unprocessed objects from the controller (large)

unifi_save_traffic_rule

🟠 write · destructive

Create a traffic rule (action and matching_target required) or update one by id. Targets default to all clients on create. matching_target picks what is matched: INTERNET (all traffic), DOMAIN (domains), APP (app_ids), APP_CATEGORY (app_category_ids), IP (ip_addresses), REGION (regions). Setting a bandwidth limit makes it a rate-limiting rule.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
id	string		Traffic rule ID to update (only the fields passed are changed). Omit to create a new one.
description	string		Rule name/description
enabled	boolean
action	"BLOCK" | "ALLOW"
matching_target	"INTERNET" | "DOMAIN" | "APP" | "APP_CATEGORY" | "IP" | "REGION"
all_clients	boolean		Apply to all clients (default on create when no clients/networks are given)
client_macs	string[]		Apply to these client MAC addresses
network_ids	string[]		Apply to all clients on these network IDs (see unifi_list_networks)
domains	string[]		Domains, e.g. [‘example.com’] (matching_target=DOMAIN)
ip_addresses	string[]		IPs or CIDRs (matching_target=IP)
app_ids	integer[]		DPI application IDs (matching_target=APP)
app_category_ids	integer[]		DPI category IDs (matching_target=APP_CATEGORY)
regions	string[]		ISO country codes, e.g. [‘CN’,‘RU’] (matching_target=REGION)
download_limit_kbps	integer		Download limit (enables the bandwidth limit)
upload_limit_kbps	integer		Upload limit (enables the bandwidth limit)
remove_bandwidth_limit	boolean		Disable the bandwidth limit
schedule	object		e.g. {mode:‘ALWAYS’} (default) or {mode:‘EVERY_DAY’, time_range_start:‘22:00’, time_range_end:‘06:00’, …}
extra	object		Additional raw controller fields to set (advanced; field names as in the raw objects). Merged last.

unifi_delete_traffic_rule

🔴 delete · destructive

Delete a traffic management rule.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
id	string	yes	Traffic rule ID (the id field returned by the matching list tool)

routing

Static routes and policy-based traffic routes.

Tool	Access	Summary
unifi_list_routes	🟢 read	List static routes
unifi_save_route	🟠 write	Create or update static route
unifi_delete_route	🔴 delete	Delete static route
unifi_list_traffic_routes	🟢 read	List traffic routes
unifi_save_traffic_route	🟠 write	Create or update traffic route
unifi_delete_traffic_route	🔴 delete	Delete traffic route

unifi_list_routes

🟢 read

List user-defined static routes. With active=true, return the gateway’s live routing table instead (stat/routing; not available on every version).

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
active	boolean		Return the active routing table (including system routes)

unifi_save_route

🟠 write · destructive

Create a static route (name and destination required; next_hop for type=nexthop, interface for type=interface) or update one by id. Defaults on create: type nexthop, distance 1, enabled.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
id	string		Route ID to update (only the fields passed are changed). Omit to create.
name	string
enabled	boolean
type	"nexthop" | "interface" | "blackhole"		nexthop: via a gateway IP; interface: out of an interface (WAN1/WAN2 or a network ID); blackhole: drop
destination	string		Destination network in CIDR form, e.g. 10.20.0.0/16
next_hop	string		Next-hop IP address (type=nexthop)
interface	string		Interface (type=interface), e.g. WAN1, WAN2 or a network ID
distance	integer		Administrative distance
extra	object		Additional raw controller fields to set (advanced; field names as in the raw objects). Merged last.

unifi_delete_route

🔴 delete · destructive

Delete a static route.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
id	string	yes	Route ID (the id field returned by the matching list tool)

unifi_list_traffic_routes

🟢 read

List traffic routes (policy-based routing): which clients/networks and destinations are sent out a specific WAN or VPN client.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
raw	boolean		Return the full unprocessed objects

unifi_save_traffic_route

🟠 write · destructive

Create a traffic route (description, matching_target and network_id required) or update one by id. Routes matching traffic from the target clients/networks via network_id (a WAN or VPN client network; see unifi_list_networks). matching_target: DOMAIN (domains), IP (ip_addresses), REGION (regions) or INTERNET (all traffic; requires explicit client_macs/network_ids). Targets default to all clients for DOMAIN/IP/REGION.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
id	string		Traffic route ID to update (only the fields passed are changed). Omit to create.
description	string		Route name
enabled	boolean
matching_target	"DOMAIN" | "IP" | "REGION" | "INTERNET"
network_id	string		Network ID to route through (WAN or VPN client)
all_clients	boolean		Apply to all clients (default on create when no clients/networks are given)
client_macs	string[]		Apply to these client MAC addresses
network_ids	string[]		Apply to all clients on these network IDs (see unifi_list_networks)
domains	string[]		Domains (matching_target=DOMAIN)
ip_addresses	string[]		IPs or CIDRs (matching_target=IP)
regions	string[]		ISO country codes (matching_target=REGION)
kill_switch	boolean		Block the traffic if the route’s interface/VPN is down
next_hop	string		Optional next-hop IP
extra	object		Additional raw controller fields to set (advanced; field names as in the raw objects). Merged last.

unifi_delete_traffic_route

🔴 delete · destructive

Delete a traffic route (policy-based route).

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
id	string	yes	Traffic route ID (the id field returned by the matching list tool)

security

Threat management (IDS/IPS), country blocking and content filtering.

Tool	Access	Summary
unifi_get_security_settings	🟢 read	Get security settings
unifi_update_threat_management	🟠 write	Update threat management / DPI
unifi_update_country_blocking	🟠 write	Update country/region blocking
unifi_list_threats	🟢 read	List detected threats
unifi_list_content_filters	🟢 read	List content filters
unifi_save_content_filter	🟠 write	Create/update content filter
unifi_delete_content_filter	🔴 delete	Delete content filter

unifi_get_security_settings

🟢 read

Get threat management (IDS/IPS mode, categories, protected networks), traffic identification (DPI) and country/region blocking (geo-IP) settings. Optionally list the IPS categories the controller supports (Network 8+).

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
include_categories	boolean		Also fetch the catalog of available IPS categories (v2 API, Network 8+)

unifi_update_threat_management

🟠 write · destructive

Change IDS/IPS (threat management) and traffic identification settings. Only the fields given are changed. ips_mode: disabled, ids (detect only), ips (detect and block), ipsInline (inline blocking, newer gateways). Changing IPS mode can briefly interrupt traffic and raise gateway CPU load.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
ips_mode	"disabled" | "ids" | "ips" | "ipsInline"		Threat management mode
enabled_categories	string[]		IPS signature categories to enable (see unifi_get_security_settings include_categories)
enabled_networks	string[]		Network IDs protected by threat management
dpi_enabled	boolean		Traffic identification (DPI)
device_fingerprinting	boolean		Device identification / fingerprinting
extra	object		Additional raw fields for the ‘ips’ setting (e.g. honeypot or ad blocking keys on your version)

unifi_update_country_blocking

🟠 write · destructive

Configure geo-IP (country/region) blocking on the gateway (stored in the ‘usg’ site setting). Field names are version-dependent: on some Network 9+ releases region blocking moved into the zone-based firewall UI; check unifi_get_security_settings first.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
enabled	boolean		Turn country blocking on or off
mode	"block" | "allow"		block = block listed countries; allow = allow only listed countries
countries	string[]		ISO 3166-1 alpha-2 country codes, e.g. [‘CN’,‘RU’]
direction	"both" | "ingress" | "egress"		Traffic direction to filter

unifi_list_threats

🟢 read

List IDS/IPS threat events detected by the gateway (newest first): signature, category, source/destination, action taken.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
hours	number		Look back this many hours (default 24)
limit	integer		Maximum number of results (default 100)

unifi_list_content_filters

🟢 read

List content filtering profiles (blocked categories, safe search, target networks/clients). v2 API, Network 8.1+.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
raw	boolean		Return the full controller objects

unifi_save_content_filter

🟠 write

Create a content filtering profile (no id) or update one (id; only given fields change). v2 API, Network 8.1+.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
id	string		Content filter ID (the id field returned by the matching list tool)
name	string
enabled	boolean
blocked_categories	string[]		Category identifiers as used by the controller (see raw output of unifi_list_content_filters)
safe_search	string[]		Search engines to force safe search on, e.g. [‘GOOGLE’,‘BING’,‘YOUTUBE’]
network_ids	string[]		Networks the filter applies to
client_macs	string[]		Clients the filter applies to
allow_list	string[]		Domains always allowed
block_list	string[]		Domains always blocked
extra	object		Additional raw controller fields to set (advanced; field names as in the raw objects). Merged last.

unifi_delete_content_filter

🔴 delete · destructive

Delete a content filtering profile.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
id	string	yes	Content filter ID (the id field returned by the matching list tool)

vpn

VPN servers and site-to-site VPNs, RADIUS profiles and RADIUS accounts.

Tool	Access	Summary
unifi_list_vpns	🟢 read	List VPNs
unifi_save_vpn	🟠 write	Create/update VPN
unifi_delete_vpn	🔴 delete	Delete VPN
unifi_list_radius_profiles	🟢 read	List RADIUS profiles
unifi_save_radius_profile	🟠 write	Create/update RADIUS profile
unifi_delete_radius_profile	🔴 delete	Delete RADIUS profile
unifi_list_radius_accounts	🟢 read	List RADIUS accounts
unifi_save_radius_account	🟠 write	Create/update RADIUS account
unifi_delete_radius_account	🔴 delete	Delete RADIUS account

unifi_list_vpns

🟢 read

List VPN servers (WireGuard, OpenVPN, L2TP), VPN clients and site-to-site VPNs configured on the gateway. Use raw: true to see every field.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
raw	boolean		Return the full unprocessed objects from the controller (large)
include_secrets	boolean		Include secret fields such as pre-shared keys, private keys and passwords (redacted by default)

unifi_save_vpn

🟠 write · destructive

Create (no id; kind required) or update (id; only fields passed change) a VPN server, VPN client or site-to-site VPN. Typed fields cover the common settings; anything else (IPsec proposals, OpenVPN/WireGuard client configuration, peer keys) goes in extra using the controller’s field names — inspect an existing VPN with unifi_list_vpns raw: true to see them, since they vary between Network versions. WireGuard server peers (users) and imported client config files are not covered by this tool; use unifi_api_request.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
id	string		VPN ID to update; omit to create
kind	"wireguard-server" | "openvpn-server" | "l2tp-server" | "wireguard-client" | "openvpn-client" | "ipsec-site-to-site" | "openvpn-site-to-site"		VPN type (required on create)
name	string		Name (required on create)
enabled	boolean
subnet	string		Tunnel/client address pool as gateway/prefix, e.g. 192.168.3.1/24 (VPN servers)
port	integer		Listen port (WireGuard default 51820, OpenVPN 1194)
wan_interface	string		WAN to listen on: wan (default) or wan2 (L2TP/OpenVPN/WireGuard servers)
pre_shared_key	string		IPsec pre-shared key (L2TP server, IPsec site-to-site)
peer_ip	string		Remote peer public IP or hostname (site-to-site)
local_ip	string		Local WAN IP used for the tunnel (IPsec site-to-site)
remote_subnets	string[]		Remote networks reachable over the tunnel, CIDR (site-to-site)
radius_profile_id	string		RADIUS profile authenticating L2TP users (see unifi_list_radius_profiles)
dns	string[]		DNS servers given to VPN clients; empty array = automatic
extra	object		Additional raw controller fields to set (advanced; field names as in the raw objects). Merged last.

unifi_delete_vpn

🔴 delete · destructive

Delete a VPN server, VPN client or site-to-site VPN. Connected VPN users/tunnels drop.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
id	string	yes	VPN ID (the id field returned by the matching list tool)

unifi_list_radius_profiles

🟢 read

List RADIUS profiles used by WPA-Enterprise WiFi, 802.1X switch ports and L2TP VPN (secrets redacted unless include_secrets).

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
include_secrets	boolean		Include secret fields such as pre-shared keys, private keys and passwords (redacted by default)

unifi_save_radius_profile

🟠 write

Create (no id) or update (id; only fields passed change) a RADIUS profile pointing at external RADIUS servers. Server lists replace the existing ones.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
id	string		Profile ID to update; omit to create
name	string		Name (required on create)
auth_servers	object[]		Authentication servers
accounting_enabled	boolean
acct_servers	object[]		Accounting servers
vlan_enabled	boolean		Assign VLANs from RADIUS attributes
extra	object		Additional raw controller fields to set (advanced; field names as in the raw objects). Merged last.

unifi_delete_radius_profile

🔴 delete · destructive

Delete a RADIUS profile. The built-in default profile cannot be deleted.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
id	string	yes	RADIUS profile ID (the id field returned by the matching list tool)

unifi_list_radius_accounts

🟢 read

List users of the built-in RADIUS server (used for L2TP VPN and WPA-Enterprise). Passwords redacted unless include_secrets.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
include_secrets	boolean		Include secret fields such as pre-shared keys, private keys and passwords (redacted by default)

unifi_save_radius_account

🟠 write

Create (no id) or update (id) a user of the built-in RADIUS server. For per-user VLAN assignment set vlan together with tunnel_type 13 (VLAN) and tunnel_medium_type 6 (802).

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
id	string		Account ID to update; omit to create
name	string		Username (required on create)
password	string		Password (required on create)
vlan	integer		VLAN ID to assign to this user
tunnel_type	integer		RADIUS Tunnel-Type (3 = L2TP, 13 = VLAN)
tunnel_medium_type	integer		RADIUS Tunnel-Medium-Type (1 = IPv4, 6 = 802)
extra	object		Additional raw controller fields to set (advanced; field names as in the raw objects). Merged last.

unifi_delete_radius_account

🔴 delete · destructive

Delete a user of the built-in RADIUS server.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
id	string	yes	RADIUS account ID (the id field returned by the matching list tool)

hotspot

Hotspot vouchers, operators, guest authorization and the guest portal.

Tool	Access	Summary
unifi_list_vouchers	🟢 read	List hotspot vouchers
unifi_create_vouchers	🟠 write	Create hotspot vouchers
unifi_revoke_voucher	🟠 write	Revoke hotspot voucher
unifi_authorize_guest	🟠 write	Authorize guest
unifi_unauthorize_guest	🟠 write	Unauthorize guest
unifi_list_hotspot_operators	🟢 read	List hotspot operators
unifi_save_hotspot_operator	🟠 write	Create/update hotspot operator
unifi_delete_hotspot_operator	🔴 delete	Delete hotspot operator
unifi_get_guest_portal_settings	🟢 read	Get guest portal settings
unifi_update_guest_portal_settings	🟠 write	Update guest portal settings

unifi_list_vouchers

🟢 read

List guest hotspot vouchers with code, duration, usage and status.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.

unifi_create_vouchers

🟠 write

Create guest hotspot vouchers and return their codes.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
count	integer		Number of vouchers (default 1)
minutes	integer	yes	Validity once redeemed, in minutes (e.g. 1440 = 1 day)
uses	integer		Times each voucher can be used: 1 = single use (default), 0 = unlimited, n = n uses
note	string		Note to attach to the vouchers
up_kbps	integer		Upload limit in kbps
down_kbps	integer		Download limit in kbps
data_limit_mb	integer		Data transfer limit in MB

unifi_revoke_voucher

🟠 write · destructive

Delete/revoke a hotspot voucher.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
id	string	yes	Voucher ID (the id field returned by the matching list tool)

unifi_authorize_guest

🟠 write

Authorize a guest client on a hotspot/guest portal network, optionally with time, bandwidth and data limits.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
mac	string	yes	MAC address, e.g. aa:bb:cc:dd:ee:ff
minutes	integer		Authorization duration in minutes (default: portal setting)
up_kbps	integer		Upload limit in kbps
down_kbps	integer		Download limit in kbps
data_limit_mb	integer		Data transfer limit in MB

unifi_unauthorize_guest

🟠 write

Revoke a guest client’s hotspot authorization.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
mac	string	yes	MAC address, e.g. aa:bb:cc:dd:ee:ff

unifi_list_hotspot_operators

🟢 read

List hotspot operator accounts (staff who can log in to the hotspot manager to issue vouchers).

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.

unifi_save_hotspot_operator

🟠 write

Create a hotspot operator (no id; name and password required) or update one (id; only given fields change).

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
id	string		Hotspot operator ID (the id field returned by the matching list tool)
name	string
password	string		Operator password
note	string

unifi_delete_hotspot_operator

🔴 delete · destructive

Delete a hotspot operator account.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
id	string	yes	Hotspot operator ID (the id field returned by the matching list tool)

unifi_get_guest_portal_settings

🟢 read

Get guest portal / hotspot settings: authentication method, session length, voucher/password/payment options, redirect, allowed subnets.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
include_secrets	boolean		Include the portal password and payment/RADIUS secrets

unifi_update_guest_portal_settings

🟠 write · destructive

Change guest portal settings. Only the fields given are changed; use extra for any other guest_access field.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
portal_enabled	boolean		Enable the guest portal
auth	"none" | "hotspot" | "password" | "facebook" | "custom" | "radius"		Authentication: none (click-through), hotspot (vouchers/payment/etc.), password, …
session_minutes	integer		How long a guest stays authorized, in minutes
password	string		Portal password (auth=password, or password option under hotspot)
voucher_enabled	boolean
password_enabled	boolean
redirect_url	string		Redirect guests here after authorizing; empty string disables
extra	object		Additional raw controller fields to set (advanced; field names as in the raw objects). Merged last.

monitoring

Events, alarms, traffic and DPI statistics, speed tests, logs and dashboards.

Tool	Access	Summary
unifi_list_events	🟢 read	List recent events
unifi_list_alarms	🟢 read	List alarms
unifi_archive_alarms	🟠 write	Archive alarms
unifi_get_traffic_report	🟢 read	Get traffic/usage report
unifi_get_dpi_stats	🟢 read	Get DPI statistics
unifi_get_speedtest_results	🟢 read	Get speed test history
unifi_run_speedtest	🟠 write	Run WAN speed test
unifi_list_rogue_aps	🟢 read	List neighbouring/rogue APs
unifi_get_system_log	🟢 read	Get system log
unifi_list_client_sessions	🟢 read	List client sessions
unifi_list_guest_authorizations	🟢 read	List guest authorizations
unifi_list_anomalies	🟢 read	List anomalies
unifi_get_dashboard	🟢 read	Get dashboard metrics

unifi_list_events

🟢 read

List recent controller events (client connects/roams, device restarts, upgrades…). Uses the classic event log and falls back to the v2 system log (device and client alerts) on Network versions where the classic log is gone or empty. For other log classes use unifi_get_system_log.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
hours	integer		Look back this many hours (default 24)
limit	integer		Maximum number of results (default 100)

unifi_list_alarms

🟢 read

List controller alarms (alerts). By default only active (unarchived) alarms are returned.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
include_archived	boolean		Include archived alarms
limit	integer		Maximum number of results (default 100)

unifi_archive_alarms

🟠 write

Archive one alarm by ID, or all alarms when no ID is given.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
id	string		Alarm ID; omit to archive all alarms

unifi_get_traffic_report

🟢 read

Get historical time-series statistics. scope=site for whole-site traffic and client counts, gw for gateway CPU/memory/WAN traffic, ap for per-AP traffic, user for per-client traffic (pass macs).

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
scope	"site" | "gw" | "ap" | "user"	yes	What to report on
interval	"5minutes" | "hourly" | "daily" | "monthly"		Bucket size (default hourly)
hours	number		Look back this many hours (default: 12 for 5minutes, 168 for hourly, 720 for daily, 8760 for monthly)
macs	string[]		Limit to these device/client MACs (ap and user scopes)
attrs	string[]		Override the attributes to fetch, e.g. [‘rx_bytes’,‘tx_bytes’,‘time’]

unifi_get_dpi_stats

🟢 read

Get deep packet inspection (traffic identification) statistics, by application or by category: site-wide, or per client when macs are given. Requires traffic identification to be enabled.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
by	"app" | "category"		Group by application or category (default category)
macs	string[]		Client MACs to report on instead of the whole site

unifi_get_speedtest_results

🟢 read

Get historical WAN speed test results run by the gateway.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
hours	number		Look back this many hours (default 168)

unifi_run_speedtest

🟠 write

Start a WAN speed test on the gateway. Results appear in unifi_get_speedtest_results after a minute or so.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.

unifi_list_rogue_aps

🟢 read

List nearby access points seen by your APs (neighbours and potential rogue APs).

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
hours	integer		Seen within this many hours (default 24)
rogue_only	boolean		Only APs flagged as rogue
limit	integer		Maximum number of results (default 100)

unifi_get_system_log

🟢 read

Read the v2 system log (Network 8+), one class at a time, paged: device-alert, client-alert, admin-activity (logins and config changes), update-alert, threat-alert (IPS/honeypot), vpn-alert, triggers (traffic/firewall rule hits), next-ai-alert.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
class	"device-alert" | "client-alert" | "admin-activity" | "update-alert" | "threat-alert" | "vpn-alert" | "triggers" | "next-ai-alert"		Log class (default device-alert)
hours	number		Look back this many hours (default 168)
page	integer		Page number, from 0
page_size	integer		Entries per page (default 50)
raw	boolean		Return raw entries

unifi_list_client_sessions

🟢 read

List client connection sessions (association history): when each client connected, for how long, to which AP/network, and traffic used.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
mac	string		Only sessions for this client
type	"all" | "user" | "guest"		Client type (default all)
hours	number		Look back this many hours (default 168)
limit	integer		Maximum number of results (default 100)

unifi_list_guest_authorizations

🟢 read

List hotspot/guest portal authorizations (who was authorized, how, when and until when).

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
hours	number		Look back this many hours (default 168)
limit	integer		Maximum number of results (default 100)

unifi_list_anomalies

🟢 read

List anomalies the controller detected (e.g. high latency, DNS timeouts, poor WiFi experience) per client/device. Not available on every Network version.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
hours	number		Look back this many hours (default 24)
limit	integer		Maximum number of results (default 100)

unifi_get_dashboard

🟢 read

Get the aggregated dashboard the UniFi UI shows: WAN/ISP quality history (latency, packet loss, availability, throughput), WiFi experience and client mix. v2 API, Network 7.4+; large response.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
hours	number		History window in hours (default 24)

admin

Site settings, administrators, backups, controller updates and site management.

Tool	Access	Summary
unifi_get_site_settings	🟢 read	Get site settings
unifi_update_site_setting	🟠 write	Update site setting
unifi_create_site	🟠 write	Create site
unifi_rename_site	🟠 write	Rename site
unifi_delete_site	🔴 delete	Delete site
unifi_list_admins	🟢 read	List administrators
unifi_invite_admin	🟠 write	Invite administrator
unifi_revoke_admin	🔴 delete	Revoke administrator
unifi_list_backups	🟢 read	List backups
unifi_create_backup	🟠 write	Create backup
unifi_delete_backup	🔴 delete	Delete backup
unifi_check_updates	🟢 read	Check for updates

unifi_get_site_settings

🟢 read

Get site-wide settings. Each setting is an object identified by key, e.g. mgmt (auto-upgrade, LEDs, SSH), country, locale, ntp, snmp, rsyslogd (remote syslog), connectivity, guest_access, ips, dpi, usg (gateway: DNS, geo-IP, UPnP…), radius, network_optimization, super_mgmt. Omit key to list all keys.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
key	string		Setting key to return in full; omit to list available keys
include_secrets	boolean		Include secret fields such as passwords and shared keys (redacted by default)

unifi_update_site_setting

🟠 write · destructive

Change fields of one site setting object (see unifi_get_site_settings for keys and current field names). Only the given fields change. Examples: key=mgmt {led_enabled:false} or {auto_upgrade:true, auto_upgrade_hour:3}; key=rsyslogd {enabled:true, ip:‘10.0.0.5’, port:514}; key=ntp {ntp_server_1:‘pool.ntp.org’}.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
key	string	yes	Setting key, e.g. mgmt, ntp, rsyslogd, connectivity, usg
changes	object	yes	Fields to set, using the controller’s field names

unifi_create_site

🟠 write

Create a new site on the controller. Returns its API name (used as site by other tools).

Argument	Type	Required	Description
description	string	yes	Display name of the new site

unifi_rename_site

🟠 write

Change a site’s display name (description). The API name stays the same.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
description	string	yes	New display name

unifi_delete_site

🔴 delete · destructive

Delete a site and all of its configuration. Devices on it must be removed or moved first. This cannot be undone.

Argument	Type	Required	Description
site_name	string	yes	API name of the site to delete (see unifi_list_sites name)

unifi_list_admins

🟢 read

List administrator accounts for a site, or for all sites (all_sites: true).

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
all_sites	boolean		List admins across all sites

unifi_invite_admin

🟠 write

Invite an administrator to the site by email (re-sends the invite if they already exist). On UniFi OS consoles admins are usually managed in UniFi OS instead; this may not be supported there.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
name	string	yes	Admin’s name
email	string	yes	Admin’s email address
role	"admin" | "readonly"		admin (default) or readonly
allow_adopt	boolean		Allow adopting devices
allow_restart	boolean		Allow restarting devices
sso	boolean		Allow UI SSO (cloud) login (default true)

unifi_revoke_admin

🔴 delete · destructive

Remove an administrator’s access to the site. Super admins cannot be revoked this way.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
admin_id	string	yes	Admin ID (see unifi_list_admins id)

unifi_list_backups

🟢 read

List the controller’s stored (auto) backups.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.

unifi_create_backup

🟠 write

Generate a controller backup and return the controller-relative download path. Generating can take a while on large installs.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
days	integer		Days of statistics history to include: -1 = all (default), 0 = settings only, or 7/30/90/180/365

unifi_delete_backup

🔴 delete · destructive

Delete a stored backup file.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
filename	string	yes	Backup filename (see unifi_list_backups)

unifi_check_updates

🟢 read

Report whether a newer Network application version is available, and which devices have firmware upgrades. With refresh: true (requires writes enabled) the controller first re-checks Ubiquiti’s servers for device firmware.

Argument	Type	Required	Description
site	string		Site name/ID as used in the API (e.g. ‘default’). Defaults to the configured site. See unifi_list_sites.
refresh	boolean		Ask the controller to re-check for device firmware first

raw

A raw API escape hatch for anything the other tools don’t cover. It is limited to GET requests unless writes are enabled.

Tool	Access	Summary
unifi_api_request	🟢 read	Raw UniFi API request

unifi_api_request

🟢 read · destructive

Call any UniFi Network API endpoint directly, for anything the other tools don’t cover. path is relative to the Network application, e.g. /api/s/default/stat/ccode, /v2/api/site/default/trafficroutes or /integration/v1/sites (official API, API-key auth). All HTTP methods are allowed.

Argument	Type	Required	Description
method	"GET" | "POST" | "PUT" | "DELETE" | "PATCH"		HTTP method (default GET)
path	string	yes	Path relative to the Network application, starting with /
query	object		Query string parameters
body	any		JSON request body

Prompts

Prompts are ready-made requests that tell the model which tools to call and what to report. In Claude Code they appear as slash commands, such as /mcp__unifi__network_health_check.

network_health_check

Overall health review of a UniFi site: WAN, devices, clients, alarms and recent problems.

Argument	Required	Description
site		Site name (defaults to the configured site)

troubleshoot_client

Investigate why a specific client (by MAC, name or IP) has connectivity problems.

Argument	Required	Description
client	yes	Client MAC address, name, hostname or IP
site		Site name (defaults to the configured site)

security_review

Review the site’s security posture: threat management, firewall, port forwards, WiFi security and admins.

Argument	Required	Description
site		Site name (defaults to the configured site)

firmware_review

List devices and the controller with available updates and propose a safe upgrade order.

Argument	Required	Description
site		Site name (defaults to the configured site)

wifi_optimization

Analyse WiFi channels, utilisation, interference and client experience and suggest improvements.

Argument	Required	Description
site		Site name (defaults to the configured site)