One UniFi MCP server can now manage a fleet of controllers
3 hours ago
UniFi MCP Server 0.6.0 is the first published release since 0.2.6, and it includes the never-released 0.5.0. The headline is fleet mode: one server routing your AI agent's tool calls to many UniFi controllers. It stays off until you point it at a Postgres database.
Ask about this presentation
Chapters
Show transcriptHide transcript
UniFi MCP Server 0.6.0 is the first published release since 0.2.6, and it includes the never-released 0.5.0. The headline is fleet mode: one server routing your AI agent's tool calls to many UniFi controllers. It stays off until you point it at a Postgres database.
Slide text
unifi-mcp-server 0.6.0
One UniFi MCP server can now manage a fleet of controllers
Fleet mode stays off until you set DATABASE_URL.
Fleet modeEvery tool that talks to a controller now takes an optional controller argument. Without it, the call goes to the one you selected, then the default. Controllers and their encrypted API keys live in Postgres. A worker health-checks each one, so fleet-wide reads answer from its snapshots.
Every tool is now classed as read, write or destructive, and the caller's role decides which it may use, checked before any controller is contacted. With a database, the server issues its own API tokens. And every write lands in a hash-chained audit log you can stream to your security tooling.
Calls now share one connection per controller. On 500 simulated controllers, read five times each, a connection per call means 5,000 requests. Pooling brings that to 3,000. Add the Redis read cache and it's 1,000, which is 80 percent fewer.
You can now deploy the server with Ansible or Helm. The playbook covers the server alone, a single-server fleet, or a cluster behind nginx. The Helm chart runs it on Kubernetes, with credentials from an existing Secret. Ready-made prompts let an AI agent run the deployment for you.
On a single server, these switches matter most. Dry-run turns every write into a preview, whatever the model sends. Read-only registers only tools that change nothing. And a Prometheus endpoint counts every tool call and how long it took.
Two leaks are closed. The wireless network tools used to return the WPA passphrase in plain text, straight into the model's context. Now it comes back redacted. The audit log redacts credentials, is readable by its owner only, and with an audit key set, encrypts its payloads.
Several tools that failed on real controllers now work. Firewall policy lists accept values the models didn't know, and device details find a device by UUID, legacy ID or MAC address. Device search works in local API mode, and UniFi OS consoles report their backup schedule. 0.5.0 adds dozens more fixes, including the end of the four-minute retry hangs.
Coming from 0.2.6, four changes from 0.5.0 need your attention. HTTP transports refuse to start without an auth token, and bind to localhost by default, so set the token and send it as a bearer header. Nine write tools now need confirm set to true. Traffic route writes are gone for now. And device details use new field names.
To upgrade, pull 0.6.0, or the fleet image for Postgres and Redis. If you serve over HTTP and your client can't send a bearer token yet, fix that first. Those request savings come from a simulated fleet, so measure your own. Give it a database, and one UniFi MCP server can now manage your whole fleet of controllers.