← Back to search

@owine/unifi-protect-mcp

GitHub Actions Scanned 26d ago

MCP server for UniFi Protect Integration API

B
85 / 100

Versions

2.10.0latest
Jul 28, 2026
2.9.0
Jul 21, 2026
2.8.3
Jul 13, 2026
2.8.2
Jul 7, 2026
2.8.1
Jun 30, 2026
+ show 23 moreshow less
2.8.0
Jun 22, 2026
2.7.5
Jun 16, 2026
2.7.4
Jun 9, 2026
2.7.3
Jun 2, 2026
2.7.2
May 26, 2026
2.7.1
May 25, 2026
2.7.0
May 15, 2026
2.6.0
May 13, 2026
2.5.0
May 13, 2026
2.4.0
May 11, 2026
2.3.3
May 4, 2026
2.3.2
Apr 28, 2026
2.3.1
Apr 7, 2026
2.3.0
Apr 1, 2026
2.2.1
Mar 31, 2026
2.2.0
Mar 15, 2026
2.1.0
Mar 10, 2026
2.0.2
Mar 10, 2026
2.0.1
Feb 17, 2026
2.0.0
Feb 12, 2026
1.1.0
Feb 12, 2026
1.0.0
Feb 11, 2026
0.9.0
Feb 11, 2026
PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 43

protect_enable_arm_alarm
annotations: none low

Enable the arm alarm using the currently selected arm profile. Only available when using local alarm manager.

dryRun boolean
protect_get_snapshot
annotations: none low

Get a JPEG snapshot from a camera. Returns a base64-encoded image/jpeg (rendered directly by MCP clients). Use highQuality=true for full-resolution capture; set channel=package to capture from the secondary package camera on doorbells with hasPackageCamera=true.

id string
protect_list_files
annotations: none low

List files of a given type (only 'animations' is currently supported — clips uploadable to G4 Doorbell screens). Returns array; each record (7.1.83 docs): name (server-generated), type, originalName, path.

protect_trigger_alarm_webhook
annotations: none low

Trigger an alarm manager webhook by ID. This fires an external alarm action.

id string
protect_upload_file
annotations: none low

Upload a base64-encoded file to UniFi Protect

fileType string base64Data string
protect_list_${cfg.plural}
annotations: none low

List all ${cfg.label.toLowerCase()}s managed by UniFi Protect. Returns array; each ${cfg.label.toLowerCase()} includes: ${cfg.returns}.

id string
protect_get_${cfg.singular}
annotations: none low

Get full details for a specific ${cfg.label.toLowerCase()} by ID. Returns: ${cfg.returns}.

id string
protect_update_${cfg.singular}
annotations: none low

Update ${cfg.label.toLowerCase()} settings (partial update via PATCH)

id string
protect_list_cameras
annotations: none low

List all cameras managed by UniFi Protect. Returns array; each camera includes (Integration API 7.1.83-verified fields): id, mac, name, modelKey, state (CONNECTED/DISCONNECTED), activePatrolSlot, hasPackageCamera, hdrType, isMicEnabled, micVolume, videoMode, featureFlags (hasHdr, hasMic, hasSpeaker, hasLedStatus, smartDetectTypes[], smartDetectAudioTypes[], videoModes[], supportFullHdSnapshot), lcdMessage (type, resetAt, text), ledSettings (isEnabled, floodLed, welcomeLed), osdSettings (isNameEnabled, isDateEnabled, isLogoEnabled, isDebugEnabled, overlayLocation), smartDetectSettings (objectTypes[], audioTypes[]). The Integration API does NOT expose recording state, motion timestamps, connection/last-seen, firmware, host, or per-channel stream config.

id string
protect_get_camera
annotations: none low

Get details for a specific camera by ID. The Protect Integration API returns the SAME field set as protect_list_cameras entries (id, mac, name, modelKey, state, activePatrolSlot, hasPackageCamera, hdrType, isMicEnabled, micVolume, videoMode, featureFlags, lcdMessage, ledSettings, osdSettings, smartDetectSettings) — there is no extended/by-id-only payload (confirmed live on 7.1.83). Recording state, motion events, zones, and channel/RTSP config are NOT exposed by this API surface.

id string
protect_disable_arm_alarm
annotations: none low

Disable the arm alarm. Only available when using local alarm manager.

dryRun boolean
protect_set_current_arm_profile
annotations: none low

Set the current arm profile to be used when enabling the arm alarm. Only available when using local alarm manager.

dryRun boolean armProfileId string
protect_update_arm_profile
annotations: none low

Update an existing arm profile (partial update via PATCH). Only available when using local alarm manager.

id string dryRun boolean
protect_get_rtsp_streams
annotations: none low

Get active RTSPS stream sessions for a camera. Returns the per-quality stream URLs currently published (keys typically: high, medium, low, package). Empty/missing keys mean no session is currently active at that quality — use protect_create_rtsp_stream to start one.

id string
protect_update_camera
annotations: none low

Update camera settings (partial update via PATCH)

id string
protect_create_rtsp_stream
annotations: none low

Create an RTSPS stream session for a camera

id string
protect_delete_rtsp_stream
annotations: none low

Stop and delete an active RTSPS stream session for a camera

id string
protect_create_talkback
annotations: none low

Create a talkback (two-way audio) session for a camera. Returns: url, codec, samplingRate, bitsPerSample (the audio config for encoding outbound audio).

id string
protect_disable_mic
annotations: none low

IRREVERSIBLE: Permanently disable the microphone on a camera. Can only be re-enabled by factory resetting the camera.

id string
protect_start_ptz_patrol
annotations: none low

Start PTZ patrol on a camera at a given slot

id string slot number
protect_stop_ptz_patrol
annotations: none low

Stop PTZ patrol on a camera

id string
protect_goto_ptz_preset
annotations: none low

Move camera PTZ to a preset position

id string slot number
protect_get_info
annotations: none low

Get UniFi Protect application information. Returns: applicationVersion (string).

protect_list_nvrs
annotations: none low

Get the NVR (Network Video Recorder) console info. NOTE: despite the name, the Protect Integration API's /nvrs endpoint returns a SINGLE NVR object, not an array. Returns: id, modelKey, name, doorbellSettings (defaultMessageText, defaultMessageResetTimeoutMs, customMessages[], customImages[]), armMode (status, armedAt, willBeArmedAt, breachDetectedAt, breachEventCount, breachTriggerEventId, breachEventId).

protect_subscribe_devices
annotations: none low

Connect to the device update WebSocket and collect messages for a specified duration (1-30s). Returns {messages, duration, error?}; each message has {type: 'add'|'update'|'remove', modelKey: 'camera'|'light'|'sensor'|..., id, payload: partial device fields that changed}. Use to detect state changes like isRecording flipping, battery drops, or new devices being adopted — fields delivered are only those that changed, not the full device object.

protect_subscribe_events
annotations: none low

Connect to the Protect event WebSocket and collect messages for a specified duration (1-30s). Returns {messages, duration, error?}; each event message includes: id, type ('motion' | 'ring' | 'smartDetectZone' | 'smartDetectLine' | 'sensorMotion' | 'sensorAlarm' | 'fingerprint' | 'nfcCard' | ...), start, end (null while ongoing), camera/sensor id, score, smartDetectTypes (['person','vehicle','animal','package','license_plate','face']), metadata (e.g. detected license plate text, NFC card id, fingerprint id, ULP user match).

protect_list_liveviews
annotations: none low

List all live views (camera grid layouts shown on viewers / in the Protect UI). Returns array; each liveview includes (Integration API 7.1.83-verified): id, modelKey, name, isDefault, isGlobal, layout (number, slot count), owner (user ID), slots (array of {cameras: string[], cycleMode, cycleInterval}). NOTE: slots use a `cameras` string-array, not a single `cameraId`.

id string
protect_get_liveview
annotations: none low

Get details for a specific live view by ID. Returns: id, modelKey, name, isDefault, isGlobal, layout, owner, slots (each slot: cameras string[], cycleMode, cycleInterval). The full slot list is needed when updating because PATCH replaces the slots array.

id string
protect_create_liveview
annotations: none low

Create a new live view

protect_update_liveview
annotations: none low

Update an existing live view (full replacement via PUT-style PATCH — include all fields)

id string
protect_list_arm_profiles
annotations: none low

List all arm profiles (only available when using the local alarm manager — the standalone NVR alarm system, not Protect cloud alerts). Returns array; each profile (7.1.83 docs): id, name, automations[], creator, schedules[], recordEverything, activationDelay (0 | 60000 | 300000 | 600000), createdAt, updatedAt.

name string dryRun boolean schedules array automations array recordEverything boolean
protect_create_arm_profile
annotations: none low

Create a new arm profile. Only available when using local alarm manager.

name string dryRun boolean schedules array automations array recordEverything boolean
protect_delete_arm_profile
annotations: none low

Delete an arm profile by ID. Only available when using local alarm manager.

id string dryRun boolean
protect_list_users
annotations: none low

List all Protect users (filtered by the API key's access permissions). Returns array; each user includes (Integration API 7.1.83-verified): id, modelKey, name, firstName, lastName, email, ucoreUserId. The Integration API does NOT expose roles, permissions, login history, groups, or notification settings.

id string
protect_get_user
annotations: none low

Get details for a specific Protect user by ID. Returns the same fields as protect_list_users entries: id, modelKey, name, firstName, lastName, email, ucoreUserId.

id string
protect_list_ulp_users
annotations: none low

List all UniFi Identity (ULP) users. Returns array; each ULP user includes (Integration API 7.1.83-verified): id, modelKey, firstName, lastName, fullName, status (e.g. ACTIVE). Enrolled-credential detail (NFC cards, fingerprints) is NOT exposed by this API surface.

id string
protect_get_ulp_user
annotations: none low

Get details for a specific UniFi Identity (ULP) user by ID. Returns: id, modelKey, firstName, lastName, fullName, status.

id string
protect_play_siren
annotations: none low

Activate the siren alarm for a duration. Tracks status and can be stopped early.

id string dryRun boolean
protect_stop_siren
annotations: none low

Stop an active siren

id string dryRun boolean
protect_test_siren_sound
annotations: none low

Test the siren sound for 5 seconds at the specified volume

id string dryRun boolean volume number
protect_test_speaker_sound
annotations: none low

Test the speaker sound at the specified volume

id string dryRun boolean volume number
protect_activate_relay_output
annotations: none low

Control a relay output. Set state to \"on\"/\"off\" to set explicitly, or omit to toggle. When state is \"on\", pulseDuration auto-turns off after the given milliseconds.

id string state enum dryRun boolean outputId number pulseDuration number
protect_trigger_alarm_hub_output
annotations: none low

Trigger an alarm hub output channel. Used to turn on/off connected sirens, lights, or other actuators.

id string delay number dryRun boolean enable boolean duration number outputId number

Permissions 2

network medium
Server uses network capabilities via: fetch()
env_vars low
Server uses env_vars capabilities via: process.env

Scan Findings 96

info
Tool: protect_enable_arm_alarm manifest_parser · 85%
info
Tool: protect_disable_arm_alarm manifest_parser · 85%
info
Tool: protect_list_users manifest_parser · 85%
info
Tool: protect_get_user manifest_parser · 85%
info
Tool: protect_list_ulp_users manifest_parser · 85%
info
Tool: protect_get_ulp_user manifest_parser · 85%
info
Tool: protect_play_siren manifest_parser · 85%
info
Tool: protect_stop_siren manifest_parser · 85%
info
Tool: protect_test_siren_sound manifest_parser · 85%
info
Tool: protect_test_speaker_sound manifest_parser · 85%
info
Tool: protect_activate_relay_output manifest_parser · 85%
info
Tool: protect_trigger_alarm_hub_output manifest_parser · 85%
info
Transport: stdio manifest_parser · 90%
info
Required env vars (5) manifest_parser · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 70%
low
Permission: env_vars access detected permission_analyzer · 90%
info
SBOM generated: 13 components sbom_generator · 100%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%
low
Tool 'protect_list_files' has no annotations annotation_checker · 100%
low
Tool 'protect_trigger_alarm_webhook' has no annotations annotation_checker · 100%
low
Tool 'protect_upload_file' has no annotations annotation_checker · 100%
low
Tool 'protect_list_${cfg.plural}' has no annotations annotation_checker · 100%
low
Tool 'protect_get_${cfg.singular}' has no annotations annotation_checker · 100%
low
Tool 'protect_update_${cfg.singular}' has no annotations annotation_checker · 100%
low
Tool 'protect_list_cameras' has no annotations annotation_checker · 100%
low
Tool 'protect_get_camera' has no annotations annotation_checker · 100%
low
Tool 'protect_get_snapshot' has no annotations annotation_checker · 100%
low
Tool 'protect_get_rtsp_streams' has no annotations annotation_checker · 100%
low
Tool 'protect_update_camera' has no annotations annotation_checker · 100%
low
Tool 'protect_create_rtsp_stream' has no annotations annotation_checker · 100%
low
Tool 'protect_delete_rtsp_stream' has no annotations annotation_checker · 100%
low
Tool 'protect_create_talkback' has no annotations annotation_checker · 100%
low
Tool 'protect_disable_mic' has no annotations annotation_checker · 100%
low
Tool 'protect_start_ptz_patrol' has no annotations annotation_checker · 100%
low
Tool 'protect_stop_ptz_patrol' has no annotations annotation_checker · 100%
low
Tool 'protect_goto_ptz_preset' has no annotations annotation_checker · 100%
low
Tool 'protect_get_info' has no annotations annotation_checker · 100%
low
Tool 'protect_list_nvrs' has no annotations annotation_checker · 100%
low
Tool 'protect_subscribe_devices' has no annotations annotation_checker · 100%
low
Tool 'protect_subscribe_events' has no annotations annotation_checker · 100%
low
Tool 'protect_list_liveviews' has no annotations annotation_checker · 100%
low
Tool 'protect_get_liveview' has no annotations annotation_checker · 100%
low
Tool 'protect_create_liveview' has no annotations annotation_checker · 100%
low
Tool 'protect_update_liveview' has no annotations annotation_checker · 100%
low
Tool 'protect_list_arm_profiles' has no annotations annotation_checker · 100%
low
Tool 'protect_create_arm_profile' has no annotations annotation_checker · 100%
low
Tool 'protect_set_current_arm_profile' has no annotations annotation_checker · 100%
low
Tool 'protect_update_arm_profile' has no annotations annotation_checker · 100%
low
Tool 'protect_delete_arm_profile' has no annotations annotation_checker · 100%
low
Tool 'protect_enable_arm_alarm' has no annotations annotation_checker · 100%
low
Tool 'protect_disable_arm_alarm' has no annotations annotation_checker · 100%
low
Tool 'protect_list_users' has no annotations annotation_checker · 100%
low
Tool 'protect_get_user' has no annotations annotation_checker · 100%
low
Tool 'protect_list_ulp_users' has no annotations annotation_checker · 100%
low
Tool 'protect_get_ulp_user' has no annotations annotation_checker · 100%
low
Tool 'protect_play_siren' has no annotations annotation_checker · 100%
low
Tool 'protect_stop_siren' has no annotations annotation_checker · 100%
low
Tool 'protect_test_siren_sound' has no annotations annotation_checker · 100%
low
Tool 'protect_test_speaker_sound' has no annotations annotation_checker · 100%
low
Tool 'protect_activate_relay_output' has no annotations annotation_checker · 100%
low
Tool 'protect_trigger_alarm_hub_output' has no annotations annotation_checker · 100%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Buffer.from base64 in owine-unifi-protect-mcp-5c6f10a/src/tools/files.ts:90 entropy_analyzer · 75%
info
package.json metadata manifest_parser · 100%
info
Tool: protect_list_files manifest_parser · 85%
info
Tool: protect_trigger_alarm_webhook manifest_parser · 85%
info
Tool: protect_upload_file manifest_parser · 85%
info
Tool: protect_stop_ptz_patrol manifest_parser · 85%
info
Tool: protect_list_${cfg.plural} manifest_parser · 85%
info
Tool: protect_get_${cfg.singular} manifest_parser · 85%
info
Tool: protect_update_${cfg.singular} manifest_parser · 85%
info
Tool: protect_list_cameras manifest_parser · 85%
info
Tool: protect_get_camera manifest_parser · 85%
info
Tool: protect_get_snapshot manifest_parser · 85%
info
Tool: protect_get_rtsp_streams manifest_parser · 85%
info
Tool: protect_update_camera manifest_parser · 85%
info
Tool: protect_create_rtsp_stream manifest_parser · 85%
info
Tool: protect_delete_rtsp_stream manifest_parser · 85%
info
Tool: protect_create_talkback manifest_parser · 85%
info
Tool: protect_disable_mic manifest_parser · 85%
info
Tool: protect_start_ptz_patrol manifest_parser · 85%
info
Tool: protect_goto_ptz_preset manifest_parser · 85%
info
Tool: protect_get_info manifest_parser · 85%
info
Tool: protect_list_nvrs manifest_parser · 85%
info
Tool: protect_subscribe_devices manifest_parser · 85%
info
Tool: protect_subscribe_events manifest_parser · 85%
info
Tool: protect_list_liveviews manifest_parser · 85%
info
Tool: protect_get_liveview manifest_parser · 85%
info
Tool: protect_create_liveview manifest_parser · 85%
info
Tool: protect_update_liveview manifest_parser · 85%
info
Tool: protect_list_arm_profiles manifest_parser · 85%
info
Tool: protect_create_arm_profile manifest_parser · 85%
info
Tool: protect_set_current_arm_profile manifest_parser · 85%
info
Tool: protect_update_arm_profile manifest_parser · 85%
info
Tool: protect_delete_arm_profile manifest_parser · 85%