AI agents can now reconfigure your UniFi network—after asking nicely

What it does

UniFi MCP is a set of Model Context Protocol servers for Ubiquiti’s UniFi ecosystem. It exposes Network, Protect, and Access controllers as tool collections that AI agents can query and command. A separate REST and GraphQL API server offers the same capabilities for non-MCP clients, while a Cloudflare Worker relay lets cloud-hosted agents reach local controllers without opening ports.

The interesting bit

The project treats operational safety as a first-class feature. Every mutation runs through a preview-then-confirm flow, and responses automatically redact Wi-Fi passphrases, VPN keys, and API tokens so they never leak into agent context or logs. It also supports lazy tool discovery, exposing meta-tools first rather than flooding the prompt with all 180+ Network functions at once.

Key highlights

• Network server is stable with 180 tools; Protect and Access servers are in beta with 59 and 34 tools respectively.
• Built-in secret redaction masks sensitive fields like Wi-Fi passwords and VPN configurations by default.
• Cloud relay sidecar and worker gateway enable multi-location, read-only fan-out to cloud agents without port forwarding.
• Standalone unifi-api-server provides REST and GraphQL endpoints for dashboards and desktop apps that do not speak MCP.
• Supports multi-controller setups through prefixed environment variables.

Caveats

• Network MCP does not support accounts that require SSO MFA or local 2FA; you must use a dedicated local admin account without MFA.
• Protect, Access, Relay, Worker Gateway, and API Server are all currently in beta.
• Experimental API-key authentication is read-only and covers only a subset of tools.

Verdict

Worth a look if you run a UniFi stack and want to let AI agents handle routine network audits, camera checks, or access-log queries. Skip it if you need full production stability across every component or require MFA on your service accounts.