UISP

UISP MCP Server

MCP server for Ubiquiti UISP's REST API (/nms/api/v2.1) - sites, devices, outages (the alerting surface), the event/audit log, data links, gateways, background tasks, available firmware, and speed tests across a UISP network/ISP-management instance - for AI assistants and the WYRE Conduit gateway.

Authentication

UISP authenticates with a static account token, generated in the UISP console under Settings -> Users -> API tokens (tokens can be issued in read-only or read/write mode - issue a read-only token for this connector). UISP has no shared multi-tenant endpoint: every deployment, including Ubiquiti's own hosted-cloud tier, runs at its own instance FQDN, so this connector requires both a token and a base URL. The token is sent as the x-auth-token header to <base URL>/nms/api/v2.1/.... In gateway mode both arrive per-request via the X-UISP-Api-Key and X-UISP-Base-URL headers; in local/stdio mode they're read once from UISP_API_KEY and UISP_BASE_URL.

Credential scope

Vendor-documented, not independently verified against a live instance (see Verification below): UISP's own console lets a token be issued in "Read Only" or "Read/Write" mode at creation time - a genuine, vendor-supported way to scope a token to reads before it's ever handed to this connector, unlike some vendors in this fleet whose keys always inherit their creating user's full permission set. This connector's own code only ever issues GET requests (see Scope below), but the enforcement of "no writes" for a Read/Write-mode token is UISP's, not this connector's - issuing a Read Only token is the customer's guarantee, not something this connector can force from the outside.

A closely-related finding worth stating plainly: UISP is simultaneously a network-management platform and a lightweight ISP CRM (UCRM) - a Site in this API can carry a linked ucrm.client reference that includes the real customer's name, and uisp_list_site_clients returns customer records. Several tools are classified isAdmin: true specifically for this reason even though they read like plain infrastructure inventory - see Scope below and this connector's entry in Conduit's vendor-config.ts for the full accounting.

Verification

This connector was built directly against UISP's own generated OpenAPI/Swagger specification (title UISP API, swagger: "2.0", basePath: /nms/api/v2.1, securityDefinitions.UserSecurity = the x-auth-token header) - every UISP installation publishes a live Swagger UI at https://<instance>/nms/api-docs/, and this connector's tools were verified one-by-one against that spec's 180 documented GET operations, not against secondary documentation or a naming convention. What it is not is independently verified against a live UISP instance: UISP is deployed per-ISP (self-hosted, or Ubiquiti's hosted-cloud tier requires an active ISP/network-operator account) and no such instance was available in this build environment to exercise a real token end-to-end. This is an environment limitation of the build, not a vendor-side approval gate - the hosted-cloud tier's own signup is genuinely self-serve for an ISP operator.

Configuration

Env var	Description
UISP_API_KEY	Account token issued by the UISP console.
UISP_BASE_URL	Base URL of the UISP instance, e.g. https://uisp.example.com.
MCP_TRANSPORT	stdio (default) or http.
AUTH_MODE	env (default, reads the vars above) or gateway (credentials arrive per-request via the X-UISP-Api-Key / X-UISP-Base-URL headers, injected by the Conduit gateway).
CONDUIT_S2S_SECRET	When set, the HTTP transport requires a valid X-Gateway-S2S header (Conduit sidecar auth) on every /mcp request.
LOG_LEVEL	debug | info (default) | warn | error.

Request limits

• HTTP request bodies are capped at 256 KiB (262144 bytes). After the X-Gateway-S2S check passes, a Content-Length above the cap returns 413 with a JSON-RPC error; bodies without Content-Length are capped by the MCP SDK transport. Unauthenticated requests still get 401 first.
• tools/call arguments are capped at 10,000 elements (every array item and object key at any depth). Larger inputs return an isError tool result and are never dispatched.

These limits address CVE-2026-111768 / GHSA-46jr-4wx8-v453 (memory exhaustion during validation) and GHSA-f897-62hf-6gxq (no request body / batch cap).

Tools

Sites

• uisp_list_sites - list sites (network locations - sites, endpoints, and clients - each optionally tied to a UCRM client/service record).
• uisp_get_site - get a single site's detail.
• uisp_search_sites - search sites/endpoints/clients by name, address, MAC address, or IP address.
• uisp_list_site_clients - list all client sites belonging to a given (parent) site.
• uisp_get_site_statistics - get upload/download traffic between a site and its parent site.
• uisp_get_site_traffic_summary - get a site's total upload/download for a given interval up to now.

Devices

• uisp_list_devices - list devices (hostname/IP/MAC, status, parent site).
• uisp_get_device - get a single device's status overview.
• uisp_get_device_detail - get a device's detail, optionally including interfaces and/or connected stations.
• uisp_get_device_statistics - get device telemetry (CPU/RAM/signal/temperature/throughput).
• uisp_list_device_interfaces - list a device's network interfaces, including configured IP addresses.
• uisp_get_device_by_mac - look up a device by its MAC address.
• uisp_list_discovered_devices - list devices discovered on the network but not yet added.

Outages

• uisp_list_outages - list network outages - UISP's alerting surface - filterable by device, type, and in-progress state.

Logs

• uisp_list_logs - list the UISP event/audit log (logins, device state changes, backups, upgrades).

Data Links

• uisp_list_data_links - list data links (the wireless/wired links UISP has mapped between devices and sites).
• uisp_get_data_link - get a single data link's detail.
• uisp_list_site_data_links - list data links attached to a given site.

Gateways

• uisp_list_gateways - list gateways (routers configured as network gateways) and their NetFlow/QoS/suspend configuration.
• uisp_get_gateway - get a single gateway's detail.

Tasks

• uisp_list_tasks - list background tasks (firmware upgrades, backups, mass operations) and their status.
• uisp_get_tasks_in_progress - get the number of tasks currently in progress.

Firmware

• uisp_list_firmwares - get the firmware versions available to UISP for its supported device models.

Speed Test

• uisp_get_speed_tests - get detail about running and recent speed tests.

System

• uisp_get_version - get the UISP version, deployment type, and build info. Useful as a credential/connectivity sanity check.
• uisp_get_network_statistics - get network-wide statistics (client/site counts, network health, signal/link/ISP scores, outage counts).
• uisp_get_summary - get badge-count-like values across the instance (unread logs/outages/firmwares, active client/site counts).

Scope

This is a deliberately narrow, read-only v1 surface covering exactly the core NOC/MSP monitoring workflow - site and device inventory, status, telemetry, outages, and the audit log - nothing else. UISP's own OpenAPI spec documents 325 paths (180 of them GET) across a much larger surface: full network/device configuration and provisioning, CRM/billing, user and API-token administration, device credential storage, backups, server administration, and a planning/simulation tool. This connector implements 27 GET operations from that spec, verified one-by-one, and excludes everything else by design, not by oversight.

Hard-excluded (device credential vault) - never implemented: GET /vault/credentials, /vault/credentials/devices, /vault/{deviceId}/credentials - this is literally a store of device login credentials; excluded outright regardless of verb.

Hard-excluded (API token / user / access-group administration - identity and credential management, not network data) - never implemented: GET /token, /token/{tokenId}, /users, /user, /user/totpauth, /access-groups/sites, /access-groups/sites/{groupId}, /nms/keep-alive, /nms/account/login/ubiquiti.

Hard-excluded (backups, restore, and support-bundle downloads - binary/sensitive, and restore is a write-adjacent maintenance action even where the read that feeds it is GET) - never implemented: GET /nms/backups, /nms/backups/{backupId}, /nms/backups/{backupId}/download-token, /nms/downloads/{token}, /nms/maintenance/backup, /nms/maintenance/backup/restore, /nms/maintenance/supportinfo, /devices/{deviceId}/backups, /devices/{deviceId}/backups/{backupId}, /devices/{id}/supportfile.

Hard-excluded (server administration and settings - can include mail-server/SMTP credentials and server-level config, not network/device data) - never implemented: GET /nms/settings, /nms/server-config, /nms/setup, /nms/mailserver, /nms/connection (returns the UISP server's own connection key), /nms/log-verbosity, /nms/update, /nms/update/log, /nms/traffic/blacklist, /nms/traffic/subnets, /nms/address, /nms/search, /nms/news, /nms/blog/posts, /nms/questionnaires/active, /nms/changed, /nms/server-time, /nms/heartbeat (unauthenticated liveness only - uisp_get_version is this connector's authenticated sanity check instead).

Hard-excluded (CRM/billing - a separate subsystem with its own customer-billing data model, out of a network-monitoring connector's scope) - never implemented: GET /crm/roles, /crm/service-plans.

Hard-excluded (GDPR/customer data export) - never implemented: GET /gdpr/clients/{id} - a formatted export of one customer's personal data.

Hard-excluded (raw device pass-through / UDAPI proxy) - never implemented: GET /devices/{deviceId}/udapi/{version}/{udapiUrl*} - a generic reverse-proxy into a device's own local API; UISP's own spec does not constrain this to GET semantics on the far side, so it is excluded as a category regardless of the outer verb, the same treatment unifi-mcp gives its analogous per-console connector-proxy path.

Hard-excluded (network discovery control-plane) - never implemented: GET /discovery/scan-status, /discovery/status/{deviceId} - status of an active network scan, which is triggered/controlled elsewhere in the API; excluded as part of that same discovery workflow rather than picked apart.

Hard-excluded (deep per-device configuration: DHCP, firewall, routing, VLANs, NetFlow, wireless/AirCube/AirMax/OLT/ONU config) - never implemented: every GET under /devices/erouters/*, /devices/uisprs/* (DHCP leases/servers, firewall filters/mangles/NATs/sets/settings, OSPF, routes, NetFlow), /devices/{id}/router/*, /devices/{id}/netflow, /devices/{id}/vlans, /devices/{id}/services, /devices/{id}/system, /devices/{id}/system/unms, /devices/{deviceId}/mac-table*, /devices/{deviceId}/interfaces/{interfaceName}, /devices/{deviceId}/interfaces/data-link/available, /devices/{deviceId}/location, and the entire family of per-device-model detail/config/station endpoints (/devices/aircubes/*, /airfibers/*, /airmaxes/*, /blackboxes/*, /epowers/*, /eswitches/*, /olts/*, /onus/*, /solarbeams/*, /toughswitches/*, /uispss/*, /waves/*, plus /devices/aps/profiles, /devices/ssids, /devices/models, /devices/macs, /devices/ips, /devices/unknown, /devices/import/status) - this connector's device surface is deliberately limited to identity/status/telemetry/interfaces (uisp_list_devices, uisp_get_device, uisp_get_device_detail, uisp_get_device_statistics, uisp_list_device_interfaces, uisp_get_device_by_mac, uisp_list_discovered_devices), not per-vendor-model configuration.

Hard-excluded (site sub-resources beyond the core six) - never implemented: GET /sites/{id}/images, /sites/{siteId}/images/{imageId} (binary), /sites/{siteId}/qos, /sites/{siteId}/slastats (UISP's own summary describes this as "for ISP and SLA score debugging"), /sites/{siteId}/traffic, /sites/{siteId}/traffic/interval, /sites/traffic (superseded for this connector's purposes by the implemented uisp_get_site_traffic_summary).

Hard-excluded (planning/simulation and field-installation tooling - not live network state) - never implemented: GET /simulation, /simulation/devices, /simulation/links, /installations/devices, /installations/{id}, /installations/{id}/{mac}/configuration.

Hard-excluded (misc) - never implemented: GET /devices/{id}/router/* (see above), /tasks/{batchId} (per-task item detail beyond the implemented list/in-progress-count), /airlink/proxy/* (RF link-planning map/elevation data files, unrelated to live network state), /nms/version/latest (checks for a newer UISP release; administrative, not monitoring data).

They can be added as a follow-up if there's demand, after a deliberate scope decision - not by default.

Development

npm install
npm run build
npm test
npm run lint   # tsc --noEmit

Docker

docker build -t uisp-mcp .
docker run -p 8080:8080 -e UISP_API_KEY=... -e UISP_BASE_URL=https://uisp.example.com uisp-mcp