UISP MCP server

UISP MCP Server

MCP server for Ubiquiti UISP's REST API (/nms/api/v2.1) - sites, devices, outages (the alerting surface), the event/audit log, data links, gateways, background tasks, available firmware, and speed tests across a UISP network/ISP-management instance - for AI assistants and the WYRE Conduit gateway.

Authentication

UISP authenticates with a static account token, generated in the UISP console under Settings -> Users -> API tokens (tokens can be issued in read-only or read/write mode - issue a read-only token for this connector). UISP has no shared multi-tenant endpoint: every deployment, including Ubiquiti's own hosted-cloud tier, runs at its own instance FQDN, so this connector requires both a token and a base URL. The token is sent as the x-auth-token header to /nms/api/v2.1/.... In gateway mode both arrive per-request via the X-UISP-Api-Key and X-UISP-Base-URL headers; in local/stdio mode they're read once from UISPAPIKEY and UISPBASEURL.

Credential scope

Vendor-documented, not independently verified against a live instance (see Verification below): UISP's own console lets a token be issued in "Read Only" or "Read/Write" mode at creation time - a genuine, vendor-supported way to scope a token to reads before it's ever handed to this connector, unlike some vendors in this fleet whose keys always inherit their creating user's full permission set. This connector's own code only ever issues GET requests (see Scope below), but the enforcement of "no writes" for a Read/Write-mode token is UISP's, not this connector's - issuing a Read Only token is the customer's guarantee, not something this connector can force from the outside.

A closely-related finding worth stating plainly: UISP is simultaneously a network-management platform and a lightweight ISP CRM (UCRM) - a Site in this API can carry a linked ucrm.client reference that includes the real customer's name, and uisplistsite_clients returns customer records. Several tools are classified isAdmin: true specifically for this reason even though they read like plain infrastructure inventory - see Scope below and this connector's entry in Conduit's vendor-config.ts for the full accounting.

Verification

This connector was built directly against UISP's own generated OpenAPI/Swagger specification (title UISP API, swagger: "2.0", basePath: /nms/api/v2.1, securityDefinitions.UserSecurity = the x-auth-token header) - every UISP installation publishes a live Swagger UI at https:///nms/api-docs/, and this connector's tools were verified one-by-one against that spec's 180 documented GET operations, not against secondary documentation or a naming convention. What it is not is independently verified against a live UISP instance: UISP is deployed per-ISP (self-hosted, or Ubiquiti's hosted-cloud tier requires an active ISP/network-operator account) and no such instance was available in this build environment to exercise a real token end-to-end. This is an environment limitation of the build, not a vendor-side approval gate - the hosted-cloud tier's own signup is genuinely self-serve for an ISP operator.

Configuration

Tools

Shortened. The full README is on GitHub.