unifi-mcp-server (us-all/unifi-mcp-server) is an MCP server listed on the M8ven Trust Index. It scores 56 out of 100, grade D. It declares 56 tools. No publisher has claimed this listing.

Back to MCP Trust IndexM8ven
D
Caution
56/100

unifi-mcp-server

UniFi semantic-analysis MCP — 54 tools on Site Manager API and Cloud Connector. 8 workflow Prompts (4 fleet-ops + 4 MSP). Read-only.

→ us-all/unifi-mcp-server· listed on glama

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

us-all

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

Glamanot scored here

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
⚠️
Known vulnerabilities in dependencies: 4 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
✅
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
✅
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 2 credentials: UNIFI_API_KEY, UNIFI_LOCAL_PASS
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// tools this server exposes56 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

list-sites-overview

Get a health overview of all UniFi sites with status, issues, and device counts

analyze-site-health

Analyze health of a specific site by name (e.g., 'USM'). Returns device status, WAN info, reboot detection

detect-recent-reboots

Detect devices that rebooted within a time window. Checks all sites by default

compare-sites

Side-by-side comparison of all (or selected) sites: device count, online %, WAN avg/min uptime, gateway. Use to spot fleet outliers.

firmware-inventory

Group all devices by firmware version + model and surface outdated devices. Helps detect fleet inconsistency and pending upgrades.

wan-uptime-trend

Aggregate WAN uptime across all sites with severity flagging (default threshold 95%). Returns per-WAN sorted by lowest uptime first.

top-clients-by-bandwidth

Top N clients by bandwidth on a site (combined / tx-only / rx-only). Requires Cloud Connector (UNIFI_API_KEY_OWNER).

list-hosts

List all UniFi console hosts (UDM, UDM Pro, Cloud Key, etc.)

get-host

Get detailed information about a specific host by ID

list-sites

List all sites with statistics (device counts, WAN status, ISP info)

list-devices

List all devices across hosts (switches, APs, gateways, cameras)

get-isp-metrics

Get ISP performance metrics. May be unavailable depending on account

query-isp-metrics

Query ISP metrics with filters. May be unavailable depending on account

list-sdwan-configs

List all SD-WAN configurations

get-sdwan-config

Get a specific SD-WAN configuration by ID

get-sdwan-config-status

Get the status of a specific SD-WAN configuration

get-app-info

Get UniFi Network application info for a host

list-local-sites

List local sites on a specific console

get-device-details

List all devices with details (firmware, features) for a site

get-device-by-id

Get detailed info for a specific device by ID

get-device-statistics

Get latest statistics for a specific device

list-pending-devices

List devices pending adoption on a host

list-site-clients

List connected clients for a site (default limit: 50)

get-client-details

Get detailed info for a specific client by ID

list-networks

List network configurations (VLANs, subnets) for a site

get-network-details

Get detailed info for a specific network by ID

get-network-references

Get references for a specific network (what uses this network)

list-wifi-broadcasts

List WiFi broadcast configurations (SSIDs) for a site

get-wifi-broadcast-details

Get detailed info for a specific WiFi broadcast

list-vouchers

List hotspot vouchers for a site

get-voucher-details

Get details for a specific voucher

list-firewall-zones

List firewall zones for a site

get-firewall-zone

Get details for a specific firewall zone

list-firewall-policies

List firewall policies for a site

get-firewall-policy

Get details for a specific firewall policy

get-firewall-policy-ordering

Get the ordering of user-defined firewall policies

list-acl-rules

List access control (ACL) rules for a site

get-acl-rule

Get details for a specific ACL rule

get-acl-rule-ordering

Get the ordering of user-defined ACL rules

list-dns-policies

List DNS policies for a site

get-dns-policy

Get details for a specific DNS policy

list-traffic-matching-lists

List traffic matching lists for a site

get-traffic-matching-list

Get details for a specific traffic matching list

list-wans

List WAN interfaces for a site

list-vpn-tunnels

List site-to-site VPN tunnels

list-vpn-servers

List VPN servers for a site

list-radius-profiles

List RADIUS profiles for a site

list-device-tags

List device tags for a site

list-dpi-categories

List DPI application categories

list-dpi-applications

List DPI applications

list-countries

List countries (reference data)

get-port-errors

Per-port rx/tx errors, dropped, link state, flap counters (linkDownCount, stpChangeCount, anomalies), and SFP DDM (Rx/Tx Power dBm, temperature, voltage, TX/RX fault) for a switch. Source: legacy /stat/device port_table. Requires LAN-reachable controller.

list-port-flap-summary

Fleet-wide port instability ranking: iterates all switches on the local controller and ranks ports by flap score (linkDownCount*2 + stpChangeCount + rx/tx errors). Surfaces unstable cables/transceivers across the site. Counters reset on switch reboot.

summarize-site

Deep aggregated site view: devices + WAN status + (opt) clients + networks + WiFi broadcasts in one call. Replaces 4-5 round-trips. Connector-dependent fields auto-skip when owner key absent. Renders an Apps SDK card on ChatGPT clients (Claude clients receive the same JSON text).

site-health-timeline

Per-site health snapshot over a lookback window: devices with stability scores, reboots, WAN uptime, optional client count. Replaces 5+ sequential calls (devices + wan + reboots + clients). Caveats[] surfaces partial-data and API limitations.

search-tools

Discover available tools by natural language query. Returns matching tool names + descriptions across all categories. Use this first to navigate the 54-tool surface efficiently.

// known CVEs in dependencies4 high8 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

highundici@8.4.0GHSA-38rv-x7px-6hhq

undici WebSocket client vulnerable to denial of service via cumulative fragment bypass

highundici@8.4.0GHSA-4cwx-7wf7-3272

undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives

highundici@8.4.0GHSA-vmh5-mc38-953g

undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent

highundici@8.4.0GHSA-vxpw-j846-p89q

undici WebSocket client vulnerable to denial of service via fragment count bypass

lowundici@8.4.0GHSA-35p6-xmwp-9g52

undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
configTOKEN_BUDGET
🔐 secretUNIFI_API_KEY"": "<your-key>",
configUNIFI_API_KEY_OWNER"": "<owner-key-or-same-key-if-role=owner>"
configUNIFI_API_URL❌ https://api.ui.com/v1 API base URL
configUNIFI_DISABLE❌ — Comma-sep denylist. Ignored when UNIFI_TOOLS is set.
configUNIFI_LOCAL_INSECURESelf-signed cert handling: set =true for stock UDM Pro
🔐 secretUNIFI_LOCAL_PASSconditional — Controller local account password (required when UNIFI_LOCAL_URL set).
configUNIFI_LOCAL_SITE❌ default Site slug for legacy /api/s/{site}/.
configUNIFI_LOCAL_URL❌ — Local controller URL (e.g. https://10.10.1.1). Setting this + USER/PASS enables 2 local category tools.
configUNIFI_LOCAL_USERconditional — Controller local account username (required when UNIFI_LOCAL_URL set). Viewer/Limited-Admin role is sufficient.
configUNIFI_TOOLS❌ — Comma-sep allowlist of categories.
// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

56/56 tools missing one or more hints — list-sites-overview (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); analyze-site-health (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); detect-recent-reboots (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +53 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Tool test coverage

18/56 tools referenced in tests (32%)

Write tests that reference each tool by name so every tool has at least one test.

Production dependencies are patched

0 critical, 4 high severity in production deps — undici@8.4.0 (high), undici@8.4.0 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 4 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/us-all/unifi-mcp-server?variant=verified)](https://m8ven.ai/mcp/us-all/unifi-mcp-server)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: 4a3e0163f470496b948bf6e54129dd65a3ebfb4e
code hash: 5cd3b3d5223d83830d1001778ffafa1315691080b546ea37b5565bca6128b2b1
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client