Rust MCP server and CLI for UniFi Network controller operations.
$git clone https://github.com/dinglebear-ai/runifiInstalls into the current project.
Install runifi by running `git clone https://github.com/dinglebear-ai/runifi`, then use it for the current task and follow its documentation at https://github.com/dinglebear-ai/runifi.
| 1 | # unifi-rmcp |
| 2 | |
| 3 | `unifi-rmcp` is a Rust MCP server and CLI for managing Ubiquiti UniFi Network |
| 4 | controllers through official, internal, and hybrid UniFi API actions. |
| 5 | |
| 6 | It exposes one MCP tool, `unifi`, plus the `runifi` CLI. Agents can inspect |
| 7 | clients, devices, WiFi networks, health, alarms, events, controller sysinfo, and |
| 8 | authenticated identity, and can use generated `official_*` / `unifi_*` actions |
| 9 | when their MCP auth scope permits it. |
| 10 | |
| 11 | **30-second path:** set `UNIFI_URL` and `UNIFI_API_KEY`, then run |
| 12 | `npx -y unifi-rmcp health --json` -> start loopback HTTP with |
| 13 | `UNIFI_MCP_HOST=127.0.0.1 npx -y unifi-rmcp serve` -> call `tools/call` with |
| 14 | `{"action":"health"}`. |
| 15 | |
| 16 | **Status:** operational RMCP upstream-client server. The preserved convenience |
| 17 | actions are read-oriented; generated mutating actions require `unifi:admin` |
| 18 | authorization. HTTP MCP supports loopback dev mode, static bearer tokens, and |
| 19 | Google OAuth through `lab-auth`. |
| 20 | |
| 21 | **Not for:** replacing the UniFi console, storing controller credentials for |
| 22 | callers, bypassing UniFi permissions, generic HTTP proxying, multi-tenant |
| 23 | isolation, or passing UniFi API keys through MCP tool arguments. |
| 24 | |
| 25 | ## Contents |
| 26 | |
| 27 | - [Naming](#naming) |
| 28 | - [Capabilities And Boundaries](#capabilities-and-boundaries) |
| 29 | - [Install](#install) |
| 30 | - [Quickstart](#quickstart) |
| 31 | - [Client Configuration](#client-configuration) |
| 32 | - [Runtime Surfaces](#runtime-surfaces) |
| 33 | - [MCP Tool Reference](#mcp-tool-reference) |
| 34 | - [CLI Reference](#cli-reference) |
| 35 | - [Configuration](#configuration) |
| 36 | - [Authentication](#authentication) |
| 37 | - [Safety And Trust Model](#safety-and-trust-model) |
| 38 | - [Architecture](#architecture) |
| 39 | - [Distribution Contract](#distribution-contract) |
| 40 | - [Development](#development) |
| 41 | - [Verification](#verification) |
| 42 | - [Deployment](#deployment) |
| 43 | - [Troubleshooting](#troubleshooting) |
| 44 | - [Related Servers](#related-servers) |
| 45 | - [Documentation](#documentation) |
| 46 | - [License](#license) |
| 47 | |
| 48 | ## Naming |
| 49 | |
| 50 | | Surface | This repo | |
| 51 | |---|---| |
| 52 | | Repository | `unifi-rmcp` | |
| 53 | | Rust crate | `unifi-rmcp` | |
| 54 | | Binary / CLI | `runifi` | |
| 55 | | npm package | `unifi-rmcp` | |
| 56 | | npm binary aliases | `unifi-rmcp`, `runifi` | |
| 57 | | MCP tool | `unifi` | |
| 58 | | Config home | `~/.unifi-rmcp` on hosts, `/data` in containers | |
| 59 | | Env prefixes | `UNIFI_*`, `UNIFI_MCP_*`, `UNIFI_RMCP_*` for npm launcher controls | |
| 60 | |
| 61 | The repo and npm package use the RMCP family name, while the shipped binary uses |
| 62 | the short Rust CLI name `runifi`. |
| 63 | |
| 64 | ## Capabilities And Boundaries |
| 65 | |
| 66 | - Read connected wireless and wired clients, network devices, WLAN configs, |
| 67 | site health, active alarms, recent events, controller sysinfo, and current |
| 68 | authenticated user. |
| 69 | - Dispatch generated `official_*` actions for documented Network Integration API |
| 70 | endpoints. |
| 71 | - Dispatch model-backed `unifi_*` internal controller actions and hybrid aliases |
| 72 | such as `list_clients`, `list_devices`, `list_networks`, `list_wifi`, and |
| 73 | `get_system_info`. |
| 74 | - Enforce `unifi:read` for read actions and `unifi:admin` for mutating actions |
| 75 | in mounted HTTP MCP mode. |
| 76 | - Provide setup, doctor, and endpoint-verification commands for local runtime |
| 77 | checks. |
| 78 | |
| 79 | | This repo owns | UniFi owns | Explicitly out of scope | |
| 80 | |---|---|---| |
| 81 | | MCP/CLI projection, action registry, request validation, HTTP MCP auth policy, response shaping, generated action dispatch, setup checks, and endpoint verification. | Controller state, site/device/client data, UniFi users, API key issuance, upstream authorization, and actual network mutations. | Replacing the controller UI, credential brokerage, arbitrary HTTP proxying, long-lived polling, policy-as-code, multi-tenant sandboxing, and local gateway provisioning. | |
| 82 | |
| 83 | ## Install |
| 84 | |
| 85 | | Path | Command | Best for | Notes | |
| 86 | |---|---|---|---| |
| 87 | | npm / npx | `npx -y unifi-rmcp --help` | Local MCP clients and quick trials. | Downloads the matching `runifi` binary from GitHub Releases. | |
| 88 | | Release installer | `curl -fsSL https://raw.githubusercontent.com/jmagar/runifi/main/scripts/install.sh \| bash` | Host installs without Node. | Installs `runifi` for the current Linux host. | |
| 89 | | Docker / Compose | `docker compose up -d` | Shared HTTP MCP deployments. | Reads `.env` and exposes container port `40030`. | |
| 90 | | Build from source | `cargo build --release` | Development and audits. | Produces `target/release/runifi`. | |
| 91 | | Plugin | `claude plugin install plugins/unifi` | Claude Code local plugin setup from this checkout. | Uses the packaged setup hook, skill, and local runtime metadata. | |
| 92 | |
| 93 | ### npm / npx |
| 94 | |
| 95 | Run the stdio MCP server or CLI without a manual binary install: |
| 96 | |
| 97 | ```bash |
| 98 | npx -y unifi-rmcp --help |
| 99 | npx -y unifi-rmcp mcp |
| 100 | npx -y unifi-rmcp health --json |
| 101 | ``` |
| 102 | |
| 103 | The npm package downloads `runifi` during `postinstall`. Override download |
| 104 | behavior only when testing packaging: |
| 105 | |
| 106 | | Variable | Purpose | |
| 107 | |---|---| |
| 108 | | `UNIFI_RMCP_SKIP_DOWNLOAD=1` | Skip postinstall binary download. | |
| 109 | | `UNIFI_RMCP_VERSION` or `UNIFI_RMCP_BINARY_VERSION` | Select the GitHub Release tag. | |
| 110 | | `UNIFI_RMCP_REPO` | Select the GitHub repo used for release downloads. | |
| 111 | | `UNIFI_RMCP_RELEA |