UISP MCP Server
MCP server for Ubiquiti UISP's REST API (/nms/api/v2.1) - sites, devices, outages (the alerting surface), the event/audit log, data links, gateways, background tasks, available firmware, and speed tests across a UISP network/ISP-management instance - for AI assistants and the WYRE Conduit gateway.
Authentication
UISP authenticates with a static account token, generated in the UISP console under Settings -> Users -> API tokens (tokens can be issued in read-only or read/write mode - issue a read-only token for this connector). UISP has no shared multi-tenant endpoint: every deployment, including Ubiquiti's own hosted-cloud tier, runs at its own instance FQDN, so this connector requires both a token and a base URL. The token is sent as the x-auth-token header to <base URL>/nms/api/v2.1/.... In gateway mode both arrive per-request via the X-UISP-Api-Key and X-UISP-Base-URL headers; in local/stdio mode they're read once from UISP_API_KEY and UISP_BASE_URL.
Credential scope
Vendor-documented, not independently verified against a live instance (see Verification below): UISP's own console lets a token be issued in "Read Only" or "Read/Write" mode at creation time - a genuine, vendor-supported way to scope a token to reads before it's ever handed to this connector, unlike some vendors in this fleet whose keys always inherit their creating user's full permission set. This connector's own code only ever issues GET requests (see Scope below), but the enforcement of "no writes" for a Read/Write-mode token is UISP's, not this connector's - issuing a Read Only token is the customer's guarantee, not something this connector can force from the outside.
A closely-related finding worth stating plainly: UISP is simultaneously a network-management platform and a lightweight ISP CRM (UCRM) - a Site in this API can carry a linked ucrm.client reference that includes the real customer's name, and uisp_list_site_clients returns customer records. Several tools are classified isAdmin: true specifically for this reason even though they read like plain infrastructure inventory - see Scope below and this connector's entry in Conduit's vendor-config.ts for the full accounting.
Verification
This connector was built directly against UISP's own generated OpenAPI/Swagger specification (title UISP API, swagger: "2.0", basePath: /nms/api/v2.1, securityDefinitions.UserSecurity = the x-auth-token header) - every UISP installation publishes a live Swagger UI at https://<instance>/nms/api-docs/, and this connector's tools were verified one-by-one against that spec's 180 documented GET operations, not against secondary documentation or a naming convention. What it is not is independently verified against a live UISP instance: UISP is deployed per-ISP (self-hosted, or Ubiquiti's hosted-cloud tier requires an active ISP/network-operator account) and no such instance was available in this build environment to exercise a real token end-to-end. This is an environment limitation of the build, not a vendor-side approval gate - the hosted-cloud tier's own signup is genuinely self-serve for an ISP operator.
Configuration
| Env var | Description |
|---|---|
UISP_API_KEY | Account token issued by the UISP console. |
UISP_BASE_URL | Base URL of the UISP instance, e.g. https://uisp.example.com. |
MCP_TRANSPORT | stdio (default) or http. |
AUTH_MODE | env (default, reads the vars above) or gateway (credentials arrive per-request via the X-UISP-Api-Key / X-UISP-Base-URL headers, injected by the Conduit gateway). |
CONDUIT_S2S_SECRET | When set, the HTTP transport requires a valid X-Gateway-S2S header (Conduit sidecar auth) on every /mcp request. |
LOG_LEVEL | debug | info (default) | warn | error. |
Tools
Sites
uisp_list_sites- list sites (network locations - sites, endpoints, and clients - each optionally tied to a UCRM client/service record).uisp_get_site- get a single site's detail.uisp_search_sites- search sites/endpoints/clients by name, address, MAC address, or IP address.uisp_list_site_clients- list all client sites belonging to a given (parent) site.uisp_get_site_statistics- get upload/download traffic between a site and its parent site.uisp_get_site_traffic_summary- get a site's total upload/download for a given interval up to now.
Devices
uisp_list_devices- list devices (hostname/IP/MAC, status, parent site).uisp_get_device- get a single device's status overview.uisp_get_device_detail- get a device's detail, optionally including interfaces and/or connected stations.uisp_get_device_statistics- get device telemetry (CPU/RAM/signal/temperature/throughput).uisp_list_device_interfaces- list a device's network interfaces, including configured IP addresses.uisp_get_device_by_mac- look up a device by its MAC address.uisp_list_discovered_devices- list devices discovered on the network but not yet added.
Outages
uisp_list_outages- list network outages - UISP's alerting surface - filterable by device, type, and in-progress state.
Logs
uisp_list_logs- list the UISP event/audit log (logins, device state changes, backups, upgrades).
Data Links
uisp_list_data_links- list data links (the wireless/wired links UISP has mapped between devices and sites).uisp_get_data_link- get a single data link's detail.uisp_list_site_data_links- list data links attached to a given site.
Gateways
uisp_list_gateways- list gateways (routers configured as network gateways) and their NetFlow/QoS/suspend configuration.uisp_get_gateway- get a single gateway's detail.
Tasks
uisp_list_tasks- list background tasks (firmware upgrades, backups, mass operations) and their status.uisp_get_tasks_in_progress- get the number of tasks currently in progress.
Firmware
uisp_list_firmwares- get the firmware versions available to UISP for its supported device models.
Speed Test
uisp_get_speed_tests- get detail about running and recent speed tests.
System
uisp_get_version- get the UISP version, deployment type, and build info. Useful as a credential/connectivity sanity check.uisp_get_network_statistics- get network-wide statistics (client/site counts, network health, signal/link/ISP scores, outage counts).uisp_get_summary- get badge-count-like values across the instance (unread logs/outages/firmwares, active client/site counts).
Scope
This is a deliberately narrow, read-only v1 surface covering exactly the core NOC/MSP monitoring workflow - site and device inventory, status, telemetry, outages, and the audit log - nothing else. UISP's own OpenAPI spec documents 325 paths (180 of them GET) across a much larger surface: full network/device configuration and provisioning, CRM/billing, user and API-token administration, device credential storage, backups, server administration, and a planning/simulation tool. This connector implements 27 GET operations from that spec, verified one-by-one, and excludes everything else by design, not by oversight.
Hard-excluded (device credential vault) - never implemented: GET /vault/credentials, /vault/credentials/devices, /vault/{deviceId}/credentials - this is literally a store of device login credentials; excluded outright regardless of verb.
Hard-excluded (API token / user / access-group administration - identity and credential management, not network data) - never implemented: GET /token, /token/{tokenId}, /users, /user, /user/totpauth, /access-groups/sites, /access-groups/sites/{groupId}, /nms/keep-alive, /nms/account/login/ubiquiti.
Hard-excluded (backups, restore, and support-bundle downloads - binary/sensitive, and restore is a write-adjacent maintenance action even where the read that feeds it is GET) - never implemented: GET /nms/backups, /nms/backups/{backupId}, /nms/backups/{backupId}/download-token, /nms/downloads/{token}, /nms/maintenance/backup, /nms/maintenance/backup/restore, /nms/maintenance/supportinfo, /devices/{deviceId}/backups, /devices/{deviceId}/backups/{backupId}, /devices/{id}/supportfile.
Hard-excluded (server administration and settings - can include mail-server/SMTP credentials and server-level config, not network/device data) - never implemented: GET /nms/settings, /nms/server-config, /nms/setup, /nms/mailserver, /nms/connection (returns the UISP server's own connection key), /nms/log-verbosity, /nms/update, /nms/update/log, /nms/traffic/blacklist, /nms/traffic/subnets, /nms/address, /nms/search, /nms/news, /nms/blog/posts, /nms/questionnaires/active, /nms/changed, /nms/server-time, /nms/heartbeat (unauthenticated liveness only - uisp_get_version is this connector's authenticated sanity check instead).
Hard-excluded (CRM/billing - a separate subsystem with its own customer-billing data model, out of a network-monitoring connector's scope) - never implemented: GET /crm/roles, /crm/service-plans.
Hard-excluded (GDPR/customer data export) - never implemented: GET /gdpr/clients/{id} - a formatted export of one customer's personal data.
Hard-excluded (raw device pass-through / UDAPI proxy) - never implemented: GET /devices/{deviceId}/udapi/{version}/{udapiUrl*} - a generic reverse-proxy into a device's own local API; UISP's own spec does not constrain this to GET semantics on the far side, so it is excluded as a category regardless of the outer verb, the same treatment unifi-mcp gives its analogous per-console connector-proxy path.
Hard-excluded (network discovery control-plane) - never implemented: GET /discovery/scan-status, /discovery/status/{deviceId} - status of an active network scan, which is triggered/controlled elsewhere in the API; excluded as part of that same discovery workflow rather than picked apart.
Hard-excluded (deep per-device configuration: DHCP, firewall, routing, VLANs, NetFlow, wireless/AirCube/AirMax/OLT/ONU config) - never implemented: every GET under /devices/erouters/*, /devices/uisprs/* (DHCP leases/servers, firewall filters/mangles/NATs/sets/settings, OSPF, routes, NetFlow), /devices/{id}/router/*, /devices/{id}/netflow, /devices/{id}/vlans, /devices/{id}/services, /devices/{id}/system, /devices/{id}/system/unms, /devices/{deviceId}/mac-table*, /devices/{deviceId}/interfaces/{interfaceName}, /devices/{deviceId}/interfaces/data-link/available, /devices/{deviceId}/location, and the entire family of per-device-model detail/config/station endpoints (/devices/aircubes/*, /airfibers/*, /airmaxes/*, /blackboxes/*, /epowers/*, /eswitches/*, /olts/*, /onus/*, /solarbeams/*, /toughswitches/*, /uispss/*, /waves/*, plus /devices/aps/profiles, /devices/ssids, /devices/models, /devices/macs, /devices/ips, /devices/unknown, /devices/import/status) - this connector's device surface is deliberately limited to identity/status/telemetry/interfaces (uisp_list_devices, uisp_get_device, uisp_get_device_detail, uisp_get_device_statistics, uisp_list_device_interfaces, uisp_get_device_by_mac, uisp_list_discovered_devices), not per-vendor-model configuration.
Hard-excluded (site sub-resources beyond the core six) - never implemented: GET /sites/{id}/images, /sites/{siteId}/images/{imageId} (binary), /sites/{siteId}/qos, /sites/{siteId}/slastats (UISP's own summary describes this as "for ISP and SLA score debugging"), /sites/{siteId}/traffic, /sites/{siteId}/traffic/interval, /sites/traffic (superseded for this connector's purposes by the implemented uisp_get_site_traffic_summary).
Hard-excluded (planning/simulation and field-installation tooling - not live network state) - never implemented: GET /simulation, /simulation/devices, /simulation/links, /installations/devices, /installations/{id}, /installations/{id}/{mac}/configuration.
Hard-excluded (misc) - never implemented: GET /devices/{id}/router/* (see above), /tasks/{batchId} (per-task item detail beyond the implemented list/in-progress-count), /airlink/proxy/* (RF link-planning map/elevation data files, unrelated to live network state), /nms/version/latest (checks for a newer UISP release; administrative, not monitoring data).
They can be added as a follow-up if there's demand, after a deliberate scope decision - not by default.
Development
npm install
npm run build
npm test
npm run lint # tsc --noEmit
Docker
docker build -t uisp-mcp .
docker run -p 8080:8080 -e UISP_API_KEY=... -e UISP_BASE_URL=https://uisp.example.com uisp-mcp