mcpctl/templates/unifi-network.yaml

name: unifi-network
version: "2.0.0"
description: UniFi Network MCP server for managing UniFi network devices, clients, and configuration
packageName: "unifi-network-mcp"
runtime: node
transport: STDIO
repositoryUrl: https://github.com/sirkirby/unifi-mcp
healthCheck:
  # list_sites calls the controller (/api/self/sites), so a pass proves the
  # whole path: egress to the controller port, TLS, login, session. The old
  # template disabled the probe entirely on the belief that STDIO probes only
  # worked for npm packages — that stopped being true once readiness probes
  # started going through the MCP proxy, and the gap let this server sit at
  # "healthy" for months without ever reaching the controller.
  tool: list_sites
  arguments: {}
  intervalSeconds: 60
  timeoutSeconds: 15
env:
  - name: UNIFI_TARGETS
    description: >-
      JSON array of controllers. One object per controller:
      {"id", "base_url", "controller_type", "default_site", "auth":
      {"username","password"}, "verify_ssl"}.

      controller_type is "classic" for a self-hosted UniFi Network controller
      (login /api/login, no path prefix) or "unifi_os" for a UDM/UniFi OS
      console (login /api/auth/login, API under /proxy/network). Choosing the
      wrong one sends every request to a path that 404s while the server still
      starts cleanly.

      base_url must carry the real controller port — a self-hosted controller
      is usually :8443, and :443 on the same host is often an unrelated
      service. Note that MCP server pods only egress 80/443 by default, so any
      other port needs an explicit NetworkPolicy (Pulumi
      `mcpctl.serverEgressTargets`).
    required: true
    defaultValue: >-
      [{"id": "home", "base_url": "https://unifi.example.com:8443",
      "controller_type": "classic", "default_site": "default",
      "auth": {"username": "CHANGE_ME", "password": "CHANGE_ME"},
      "verify_ssl": false}]