runifi

# unifi-rmcp

MCP server and CLI for UniFi Network controllers: clients, devices, WLANs,
firewall, and health over stdio or streamable HTTP, with auth.

It exposes one MCP tool, `unifi`, plus the `runifi` CLI. Agents can inspect
clients, devices, WiFi networks, health, alarms, events, controller sysinfo, and
authenticated identity, and can use generated `official_*` / `unifi_*` actions
when their MCP auth scope permits it.

**30-second path:** set `UNIFI_URL` and `UNIFI_API_KEY`, then run
`npx -y @dinglebear/runifi health --json` -> start loopback HTTP with
`UNIFI_MCP_HOST=127.0.0.1 npx -y @dinglebear/runifi serve` -> call `tools/call` with
`{"action":"health"}`.

**Status:** operational RMCP upstream-client server. The preserved convenience
actions are read-oriented; generated mutating actions require `unifi:admin`
authorization. HTTP MCP supports loopback dev mode, static bearer tokens, and
Google OAuth through `lab-auth`.

**Not for:** replacing the UniFi console, storing controller credentials for
callers, bypassing UniFi permissions, generic HTTP proxying, multi-tenant
isolation, or passing UniFi API keys through MCP tool arguments.

## Contents

- [Naming](#naming)
- [Capabilities And Boundaries](#capabilities-and-boundaries)
- [Install](#install)
- [Quickstart](#quickstart)
- [Client Configuration](#client-configuration)
- [Runtime Surfaces](#runtime-surfaces)
- [MCP Tool Reference](#mcp-tool-reference)
- [CLI Reference](#cli-reference)
- [Configuration](#configuration)
- [Authentication](#authentication)
- [Safety And Trust Model](#safety-and-trust-model)
- [Architecture](#architecture)
- [Distribution Contract](#distribution-contract)
- [Development](#development)
- [Verification](#verification)
- [Deployment](#deployment)
- [Troubleshooting](#troubleshooting)
- [Related Servers](#related-servers)
- [Documentation](#documentation)
- [License](#license)

## Naming

| Surface | This repo |
|---|---|
| Repository | `unifi-rmcp` |
| Rust crate | `unifi-rmcp` |
| Binary / CLI | `runifi` |
| npm package | `@dinglebear/runifi` |
| npm binary aliases | `unifi-rmcp`, `runifi` |
| MCP tool | `unifi` |
| Config home | `~/.unifi-rmcp` on hosts, `/data` in containers |
| Env prefixes | `UNIFI_*`, `UNIFI_MCP_*`, `UNIFI_RMCP_*` for npm launcher controls |

The repo and npm package use the RMCP family name, while the shipped binary uses
the short Rust CLI name `runifi`.

## Capabilities And Boundaries

- Read connected wireless and wired clients, network devices, WLAN configs,
  site health, active alarms, recent events, controller sysinfo, and current
  authenticated user.
- Dispatch generated `official_*` actions for documented Network Integration API
  endpoints.
- Dispatch model-backed `unifi_*` internal controller actions and hybrid aliases
  such as `list_clients`, `list_devices`, `list_networks`, `list_wifi`, and
  `get_system_info`.
- Enforce `unifi:read` for read actions and `unifi:admin` for mutating actions
  in mounted HTTP MCP mode.
- Provide setup, doctor, and endpoint-verification commands for local runtime
  checks.

| This repo owns | UniFi owns | Explicitly out of scope |
|---|---|---|
| MCP/CLI projection, action registry, request validation, HTTP MCP auth policy, response shaping, generated action dispatch, setup checks, and endpoint verification. | Controller state, site/device/client data, UniFi users, API key issuance, upstream authorization, and actual network mutations. | Replacing the controller UI, credential brokerage, arbitrary HTTP proxying, long-lived polling, policy-as-code, multi-tenant sandboxing, and local gateway provisioning. |

## Install

| Path | Command | Best for | Notes |
|---|---|---|---|
| npm / npx | `npx -y @dinglebear/runifi --help` | Local MCP clients and quick trials. | Downloads the matching `runifi` binary from GitHub Releases. |
| Release installer | `curl -fsSL https://raw.githubusercontent.com/dinglebear-ai/runifi/main/scripts/install.sh \| bash` | Host installs without Node. | Installs `runifi` for the current Linux host. |
| Docker / Compose | `docker compose up -d` | Shared HTTP MCP deployments. | Reads `.env` and exposes container port `40030`. |
| Build from source | `cargo build --release` | Development and audits. | Produces `target/release/runifi`. |
| Plugin | `claude plugin install plugins/unifi` | Claude Code local plugin setup from this checkout. | Ships the skill and `.mcp.json`. No session hooks — plugin settings reach the server through `.mcp.json`'s `${user_config.*}` env block, so no manual setup step is needed. |

### npm / npx

Run the stdio MCP server or CLI without a manual binary install:

```bash
npx -y @dinglebear/runifi --help
npx -y @dinglebear/runifi mcp
npx -y @dinglebear/runifi health --json
```

The npm package downloads `runifi` during `postinstall`. Override download
behavior only when testing packaging:

| Variable | Purpose |
|---|---|
| `UNIFI_RMCP_SKIP_DOWNLOAD=1` | Skip postinstall binary download. |
| `UNIFI_RMCP_VERSION` or `UNIFI_RMCP_BINARY_VERSION` | Select the GitHub Release tag. |
| `UNIFI_RMCP_REPO` | Select the GitHub repo used for release downloads. |
| `UNIFI_RMCP_RELEASE_BASE_URL` | Select a custom release base URL. |

### Build From Source

```bash
git clone git@github.com:dinglebear-ai/runifi.git
cd runifi
cargo build --release
./target/release/runifi --help
```

Minimum supported Rust version: 1.86. The Cargo workspace has three members:
the root `unifi-rmcp` package, `crates/unifi` (reusable core), and `xtask`
(dev tooling). All members inherit Rust edition 2024 and MSRV 1.97.1 from the
workspace root.

## Quickstart

### 1. Create A UniFi API Key

In UniFi OS, go to Settings -> Admins & Users -> API Keys, create a key, and
copy it into `UNIFI_API_KEY`.

### 2. Configure The Controller

```bash
export UNIFI_URL=https://unifi.local
export UNIFI_API_KEY=...
export UNIFI_SITE=default
export UNIFI_SKIP_TLS_VERIFY=true
```

Set `UNIFI_LEGACY=true` only for older non-UDM controllers that do not use the
`/proxy/network` path prefix.

### 3. Run A Safe CLI Call

```bash
npx -y @dinglebear/runifi health --json
```

### 4. Start Loopback HTTP MCP

```bash
UNIFI_MCP_HOST=127.0.0.1 npx -y @dinglebear/runifi serve
```

In another shell:

```bash
curl -sf http://127.0.0.1:40030/health
```

### 5. Make A First MCP Call

```bash
curl -s -X POST http://127.0.0.1:40030/mcp \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"unifi","arguments":{"action":"health"}}}'
```

## Client Configuration

### Claude Code Stdio

```json
{
  "mcpServers": {
    "unifi": {
      "command": "npx",
      "args": ["-y", "unifi-rmcp", "mcp"],
      "env": {
        "UNIFI_URL": "https://unifi.local",
        "UNIFI_API_KEY": "...",
        "UNIFI_SITE": "default",
        "UNIFI_SKIP_TLS_VERIFY": "true"
      }
    }
  }
}
```

### Claude Code HTTP

```json
{
  "mcpServers": {
    "unifi": {
      "type": "http",
      "url": "http://127.0.0.1:40030/mcp",
      "headers": {
        "Authorization": "Bearer ${UNIFI_MCP_TOKEN}"
      }
    }
  }
}
```

### Codex / Labby Gateway

Register UniFi through Labby as an HTTP upstream when sharing one long-running
server, or run it directly as stdio for local-only use.

```toml
[mcp_servers.unifi]
command = "npx"
args = ["-y", "unifi-rmcp", "mcp"]
```

### Generic MCP JSON

```json
{
  "command": "runifi",
  "args": ["mcp"],
  "env": {
    "UNIFI_URL": "https://unifi.local",
    "UNIFI_API_KEY": "..."
  }
}
```

Do not put `UNIFI_API_KEY`, OAuth secrets, passwords, SSH keys, or upstream
bearer tokens in MCP tool arguments. Use env, config files, or the MCP client's
secret storage. MCP callers never provide credentials, tokens, keys, or secrets
as action arguments.

## Runtime Surfaces

| Surface | Status | Entry point | Purpose |
|---|---:|---|---|
| MCP stdio | Supported | `runifi mcp`, `npx -y @dinglebear/runifi mcp` | Local child-process MCP clients. |
| MCP HTTP | Supported | `runifi serve`, `POST /mcp` | Streamable HTTP MCP for local or shared server deployments. |
| CLI | Supported | `runifi <command>` | Scriptable parity and debugging. |
| Prompts | Supported | `network_summary` | Agent prompt for UniFi status summaries. |
| Resource | Supported | MCP tool schema resource | Client-side schema discovery. |
| REST API | Not shipped | N/A | UniFi already owns the REST APIs. |
| Web UI | Not shipped | N/A | UniFi already owns the controller UI. |

## MCP Tool Reference

One MCP tool is exposed: `unifi`. Pass the required `action` argument to select
the operation. The action enum is generated from the inventories in `data/`, so
the surface is large:

| Family | Actions | Mutating |
|---|---:|---:|
| `official_*` | 78 | 36 |
| `unifi_*` | 175 | 87 |
| Preserved convenience | 8 | 0 |
| Hybrid aliases | 5 | 0 |
| `help` | 1 | 0 |
| **Total** | **267** | **123** |

Counts are derived from `data/unifi_official_network_v10_3_58.json` and the
`runtime: true` entries of `data/unifi_internal_endpoint_models.json`.
`crates/unifi/src/capabilities.rs` is the source of truth at runtime.

### Preserved Convenience Actions

| Action | Description | Required params | Optional params |
|---|---|---|---|
| `clients` | Connected wireless and wired clients. | none | none |
| `devices` | Network devices: APs, switches, gateways. | none | none |
| `wlans` | WiFi network configurations. | none | none |
| `health` | Site health summary. | none | none |
| `alarms` | Active alarms and alerts. | none | none |
| `events` | Recent controller events. | none | `limit` |
| `sysinfo` | Controller system information. | none | none |
| `me` | Authenticated UniFi identity. | none | none |
| `help` | Built-in action documentation. | none | none |

### Generated Action Families

| Family | Description | Scope behavior |
|---|---|---|
| `official_*` | Documented Network Integration API operations under `/proxy/network/integration/