@mgcrea/mcp-unifi-protect 0.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Olivier Louvignes
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,300 @@
+# @mgcrea/mcp-unifi-protect
+
+Model Context Protocol server for a self-hosted **UniFi Protect** console — cameras, recorded
+events and smart detections, snapshots, footage export, and the lights, sensors, viewers and
+chimes attached to it. Read-only by default: the tools that change anything are not registered
+at all unless you ask for them.
+
+## Features
+
+- **Search recorded events over any time range** — motion, person / vehicle / animal / package /
+  licence-plate detections, doorbell rings — with each result already carrying its camera's
+  **name**, not just an id.
+- **Snapshots and footage** — capture a frame now, pull an event's thumbnail, export an MP4.
+  All written to disk by default, so a still frame does not silently cost you a context window.
+- **Devices** — cameras, lights, sensors (with their temperature, humidity and light readings),
+  viewers, chimes, live views and users.
+- **Shaped responses.** A console camera record is 8-15 KB of JSON; a list of ten is over 100 KB.
+  List tools return the fifteen fields anyone actually asks about. `get_*` returns everything.
+- **Stays up with no credentials**, reporting what to configure through `unifi_protect_auth_status`
+  rather than exiting and showing in your client as a bare `Connection closed`.
+
+## Security
+
+**Supply chain.** Three runtime dependencies: the MCP SDK, zod, and `undici`. Retry and backoff
+are hand-rolled; there is no HTTP client wrapper, no logger, no crypto library. `undici` earns its
+place by being the only way to scope the TLS exception below to this server's own requests — see
+the note there. Published from CI with provenance via OIDC trusted publishing; the container
+image is multi-arch, carries an SBOM, and is signed with cosign.
+
+**Your credentials.** The username and password come from the environment or a config file, and
+never leave this process except in the login request to your console. The resulting session
+cookie is cached at `~/.config/unifi-protect/session.json` with mode `600`.
+
+**Certificate verification is ON by default**, and disabling it is scoped to this server's own
+requests through an undici dispatcher — it is not `NODE_TLS_REJECT_UNAUTHORIZED`, so nothing else
+in the process is affected. (It previously _was_ process-wide, on the belief that a dispatcher
+could not be scoped without a dependency. It can, and `undici` is now that dependency.)
+
+Verifying takes two things together, and either alone achieves nothing: the certificate is
+self-signed, so `NODE_EXTRA_CA_CERTS` must point at it; **and** it is issued to `unifi.local` with
+no IP SAN, so `UNIFI_PROTECT_HOST` must be a host name that resolves to the console rather than its
+IP address. Reached by IP, verification fails on the host name however the certificate is trusted.
+See `.env.example` for the two commands. If the console has no name on your network, set
+`UNIFI_PROTECT_VERIFY_TLS=false`; the startup banner then prints `tls=UNVERIFIED` on every run.
+
+**Blast radius.** With the defaults, the worst an agent can do is read your cameras and write
+image files into the snapshot directory. With `UNIFI_PROTECT_ALLOW_WRITES=1` it can additionally
+reconfigure devices, stop a camera recording, and reboot a camera or the whole console. Use a
+Local-Access-Only account with View Only rights, and leave writes off unless you need them.
+
+## Configure
+
+| Variable                           | Required | Default                                | What it does                                                    |
+| ---------------------------------- | -------- | -------------------------------------- | --------------------------------------------------------------- |
+| `UNIFI_PROTECT_HOST`               | yes      | —                                      | Console IP or hostname. `https://` assumed, `:port` preserved   |
+| `UNIFI_PROTECT_USERNAME`           | yes      | —                                      | Console login                                                   |
+| `UNIFI_PROTECT_PASSWORD`           | yes      | —                                      | Its password                                                    |
+| `UNIFI_PROTECT_TOTP`               | no       | —                                      | 2FA code. Expires in ~30s — prefer `unifi_protect_auth_login`   |
+| `UNIFI_PROTECT_VERIFY_TLS`         | no       | `true`                                 | Verify the console's certificate (needs a host name, not an IP) |
+| `UNIFI_PROTECT_ALLOW_WRITES`       | no       | `false`                                | Register the 12 mutating tools                                  |
+| `UNIFI_PROTECT_SESSION_FILE`       | no       | `~/.config/unifi-protect/session.json` | Cached session, mode 600                                        |
+| `UNIFI_PROTECT_SNAPSHOT_DIR`       | no       | `~/.cache/unifi-protect`               | Where images and exports are written                            |
+| `UNIFI_PROTECT_CONFIG`             | no       | `~/.config/unifi-protect/config.json`  | Config file location                                            |
+| `UNIFI_PROTECT_MAX_RETRIES`        | no       | `3`                                    | Retries on 401 / 429 / 5xx                                      |
+| `UNIFI_PROTECT_MAX_DOWNLOAD_BYTES` | no       | `200000000`                            | Refuse a download larger than this                              |
+| `UNIFI_PROTECT_DEVICE_CACHE_TTL`   | no       | `60`                                   | Camera id→name cache lifetime, seconds                          |
+| `UNIFI_PROTECT_DEBUG`              | no       | —                                      | Verbose request logging to stderr                               |
+
+The config file mirrors these as camelCase JSON (`host`, `username`, `verifyTls`, …). It is
+strict: an unknown key is an error rather than a silent no-op. **Environment variables win over
+the file, field by field**, so a one-off `UNIFI_PROTECT_ALLOW_WRITES=0` still beats a file that
+says `true`.
+
+### Create an account for it
+
+UniFi OS → **Settings → Admins & Users → Add User → Local Access Only**, with Protect
+permissions and **View Only** unless you plan to enable writes.
+
+Use a local account rather than your Ubiquiti (SSO) one. Cloud accounts frequently cannot log in
+locally at all, and a scoped local account keeps this server away from the rest of the console.
+
+## Quick start
+
+**A. npx**
+
+```bash
+UNIFI_PROTECT_HOST=192.168.1.1 UNIFI_PROTECT_USERNAME=mcp UNIFI_PROTECT_PASSWORD=… \
+  npx -y @mgcrea/mcp-unifi-protect
+```
+
+**B. Docker (stdio)**
+
+```bash
+docker run --rm -i \
+  -e UNIFI_PROTECT_HOST=192.168.1.1 \
+  -e UNIFI_PROTECT_USERNAME=mcp \
+  -e UNIFI_PROTECT_PASSWORD=… \
+  ghcr.io/mgcrea/mcp-unifi-protect
+```
+
+**C. From source**
+
+```bash
+pnpm install && pnpm build
+node dist/cli.js
+```
+
+### Inspect the tools
+
+```bash
+printf '%s\n' \
+  '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"cli","version":"0"}}}' \
+  '{"jsonrpc":"2.0","method":"notifications/initialized"}' \
+  '{"jsonrpc":"2.0","id":2,"method":"tools/list"}' \
+| node dist/cli.js 2>/dev/null | jq -r '.result.tools[]?.name'
+```
+
+## Tools
+
+20 read tools, plus 9 more when writes are enabled.
+
+| Tool                                      | What it does                                                                                        | Writes                 |
+| ----------------------------------------- | --------------------------------------------------------------------------------------------------- | ---------------------- |
+| `unifi_protect_auth_status`               | Log in and make a real call, reporting whether the console is reachable and on what Protect version | —                      |
+| `unifi_protect_auth_login`                | Force a fresh login; the only way to supply a 2FA code                                              | —                      |
+| `unifi_protect_auth_logout`               | Drop the cached session and delete the session file                                                 | confirm                |
+| `unifi_protect_get_system_info`           | Console model, Protect version, storage, device counts                                              | —                      |
+| `unifi_protect_list_cameras`              | Every camera, summarized                                                                            | —                      |
+| `unifi_protect_get_camera`                | One camera's complete record (large)                                                                | —                      |
+| `unifi_protect_get_camera_snapshot`       | Capture a frame now, to a file or inline                                                            | —                      |
+| `unifi_protect_list_ptz_presets`          | A PTZ camera's saved preset slots                                                                   | —                      |
+| `unifi_protect_list_ptz_patrols`          | A PTZ camera's saved patrol routes                                                                  | —                      |
+| `unifi_protect_list_events`               | **Search recorded events over any time range**                                                      | —                      |
+| `unifi_protect_get_event`                 | One event's full detection metadata                                                                 | —                      |
+| `unifi_protect_get_event_thumbnail`       | The frame that triggered a detection                                                                | —                      |
+| `unifi_protect_export_video`              | Export footage as an MP4 on disk                                                                    | —                      |
+| `unifi_protect_list_lights`               | Floodlights, with state and brightness                                                              | —                      |
+| `unifi_protect_list_sensors`              | Sensors, with temperature / humidity / light readings                                               | —                      |
+| `unifi_protect_list_viewers`              | Viewport devices and what each displays                                                             | —                      |
+| `unifi_protect_list_chimes`               | Chimes, volume, paired doorbells                                                                    | —                      |
+| `unifi_protect_list_liveviews`            | Saved camera grid layouts                                                                           | —                      |
+| `unifi_protect_list_users`                | Who can sign in to Protect                                                                          | —                      |
+| `unifi_protect_request`                   | Escape hatch: call any private endpoint directly                                                    | GET only unless writes |
+| `unifi_protect_update_camera`             | Name, mic, status LED, OSD overlays                                                                 | ✅                     |
+| `unifi_protect_set_camera_recording_mode` | `always` / `never` / `detections` / `schedule`                                                      | ✅                     |
+| `unifi_protect_reboot_camera`             | Reboot one camera                                                                                   | ✅ confirm             |
+| `unifi_protect_update_light`              | Brightness, on/off, PIR sensitivity                                                                 | ✅                     |
+| `unifi_protect_update_sensor`             | Name, which capabilities report                                                                     | ✅                     |
+| `unifi_protect_update_viewer`             | Put a live view on a screen                                                                         | ✅                     |
+| `unifi_protect_update_chime`              | Volume, name                                                                                        | ✅                     |
+| `unifi_protect_update_nvr_settings`       | Console name, timezone, global recording                                                            | ✅                     |
+| `unifi_protect_reboot_nvr`                | Reboot the console                                                                                  | ✅ confirm             |
+
+## Worked example: what happened at the front door last night
+
+```jsonc
+// 1. Which cameras are there?
+{"name": "unifi_protect_list_cameras", "arguments": {}}
+// → [{ "id": "661a…", "name": "Front Door", "hasSmartDetect": true,
+//      "smartDetectTypes": ["person","package"], "recordingMode": "detections", … }]
+
+// 2. People seen overnight. Note the camera NAME comes back resolved.
+{"name": "unifi_protect_list_events", "arguments": {
+   "start": "2026-08-29T22:00:00Z", "end": "2026-08-30T07:00:00Z",
+   "types": ["smartDetectZone"], "smartDetectTypes": ["person"]}}
+// → { "count": 3, "events": [
+//     { "id": "9f3c1a02-…", "start": "2026-08-30T02:14:07.000Z", "camera": "Front Door",
+//       "smartDetectTypes": ["person"], "score": 94, "hasThumbnail": true }, … ] }
+
+// 3. Look at the one at 02:14 — pass the event's own id.
+{"name": "unifi_protect_get_event_thumbnail",
+ "arguments": {"eventId": "9f3c1a02-…", "output": "image"}}
+
+// 4. Pull the footage around it.
+{"name": "unifi_protect_export_video", "arguments": {
+   "cameraId": "661a…", "start": "2026-08-30T02:13:30Z", "end": "2026-08-30T02:15:00Z"}}
+// → { "path": "/Users/you/.cache/unifi-protect/front-door-….mp4", "bytes": 18432000 }
+```
+
+## Traps worth knowing
+
+**This wraps Protect's private API, not the official one.** Ubiquiti publishes an Integration
+API at `/proxy/protect/integration/v1` with an OpenAPI spec and an `X-API-KEY` header. It is not
+used here, because it has **no historical query capability at all** — the only query parameters
+in its entire spec are `channel`, `highQuality` and `qualities`, and events exist solely as a
+live WebSocket. "What happened last night" is unanswerable through it. The private API answers
+that, at the cost of being undocumented and liable to change between Protect releases. This was
+built and verified end-to-end against a live **UNVR running Protect 7.2.105**.
+`unifi_protect_get_system_info` reports the version you are actually running, and
+`unifi_protect_request` reaches any endpoint that moves.
+
+Two shapes already changed between 6.x and 7.x, both found by running this against a real
+console, and both now handled in either form:
+
+- **Storage moved.** 6.x had `nvr.storageInfo` with `totalSize` / `totalSpaceUsed`. By 7.2 that
+  key is gone; the numbers live under `nvr.systemInfo.storage` and `nvr.storageStats`, with
+  per-disk health in `systemInfo.ustorage.disks`.
+- **A camera has no `ledLevel`.** The 0-6 brightness that looks like it belongs there is a
+  _floodlight_ field; a camera's LED is the on/off `ledSettings.isEnabled`. Sub-objects also
+  deep-merge on PATCH, so setting one OSD overlay preserves the others — verified by writing to
+  a live camera and reading it back.
+- **An event's `thumbnail` field is not a thumbnail id you can use here.** It reads `e-<eventId>`
+  and belongs to the `thumbnails/<id>` endpoint; `events/<eventId>/thumbnail` — the one this
+  server calls — wants the bare event id. Passing the console's own value returns 404. So list
+  results report `hasThumbnail: true` rather than an id, and `unifi_protect_get_event_thumbnail`
+  takes the event's `id` (though it tolerates an `e-…` value too).
+
+**Times are milliseconds, and getting it wrong fails silently.** The console takes JavaScript
+millisecond timestamps. A Unix _seconds_ value is not rejected — it is read as a moment in 1970,
+so the query succeeds and returns an empty list, which reads as "nothing happened". Every time
+argument here accepts ISO 8601, a relative expression (`"2h ago"`, `"30m"`, `"7d"`) or `"now"`,
+and a ten-digit number is refused with the corrected value in the error.
+
+**Event search is always filtered by type.** Omitting `types` entirely triggers a pagination bug
+in Protect where the console ignores the window and returns the wrong slice. `unifi_protect_list_events`
+always sends an explicit list, defaulting to motion, smart detections and rings.
+
+**Footage only exists if the camera was recording.** An empty event search may mean the camera's
+recording mode is `never`, not that nothing happened. `unifi_protect_list_cameras` shows the mode.
+
+**Snapshots are forced.** Without that the console can return a cached frame minutes old, which
+is indistinguishable from a current one.
+
+**A cloud account may not work.** Ubiquiti SSO accounts frequently cannot log in locally. Create
+a Local Access Only user.
+
+## Troubleshooting
+
+**The server does not appear, or shows `Connection closed`.** It should never exit on missing
+credentials — run it by hand with the same environment and read stderr. Everything it logs goes
+to stderr, because stdout is the protocol channel.
+
+**Only `unifi_protect_auth_status` is listed.** No console is configured. Call that tool; it
+returns the setup steps as data.
+
+**A tool I expected is missing.** The write tools are not registered unless
+`UNIFI_PROTECT_ALLOW_WRITES=1`. That is the design, not a bug — an absent tool cannot be called,
+whereas a refused one invites an agent to keep trying.
+
+**`self-signed certificate` errors.** Verification is on by default and cannot pass against an IP address. Either address the console by name with `NODE_EXTRA_CA_CERTS` set, or `UNIFI_PROTECT_VERIFY_TLS=false`
+unless you have installed a trusted certificate on the console.
+
+**Everything returns 401.** Check the account is a local one, and that it has Protect
+permissions. `unifi_protect_auth_status` distinguishes "cannot log in" from "logged in but
+forbidden".
+
+**A tool that used to work now returns 404.** Compare the Protect version from
+`unifi_protect_get_system_info` against 7.2.105 above; an upgrade may have moved the endpoint.
+`unifi_protect_request` is the workaround while it is fixed — it reaches any path under
+`/proxy/protect/api` directly, which is how both of the 6.x→7.x changes above were pinned down.
+
+**Storage shows as nearly full.** That is normal on an NVR: `isRecycling: true` means the
+console continuously overwrites the oldest footage rather than stopping. `get_system_info` says
+so inline so it does not read as a fault.
+
+## What has been verified against real hardware
+
+Built and exercised end-to-end against a live **UNVR4 on Protect 7.2.105** with 12 cameras, one
+floodlight and one chime. Every read tool was run; the write tools were exercised with _no-op_
+writes — each value set to the value it already held — and the device state read back unchanged
+afterwards. That run is also what caught three bugs this README's earlier drafts described
+wrongly: the storage layout, the event-thumbnail id, and two camera fields that do not exist.
+
+Two tools remain **unverified for want of hardware**, and are marked here rather than left to look
+tested:
+
+- `unifi_protect_update_sensor` — no UP Sense device on the test console (`sensors` is empty).
+  Note that a Protect **floodlight has its own built-in PIR**, reported as `isPirMotionDetected`
+  and tuned via `pirSensitivity`; that is part of the light, so it is `unifi_protect_update_light`
+  that controls it, not this tool. A garden lamp is not a sensor device.
+- `unifi_protect_update_viewer` — no Viewport device on the test console.
+
+Both follow the same PATCH shape as the tools that were verified, so they are likely correct, but
+"likely" is the honest word until someone runs them.
+
+## Not implemented
+
+The realtime WebSocket at `/proxy/protect/ws/updates` is not wired up. It is a binary framed
+protocol, and because this server wraps the private API, event _history_ is already available
+over REST through `unifi_protect_list_events` — which is what the WebSocket would have been
+needed for. Node's global `WebSocket` follows the WHATWG signature and ignores a headers option,
+so attaching the session cookie would mean adding `ws` as a dependency.
+
+## Develop
+
+```bash
+pnpm install
+pnpm lint && pnpm format:check && pnpm typecheck && pnpm test && pnpm build
+```
+
+Publish:
+
+```bash
+pnpm dlx release-it            # bump, commit, tag
+git push --follow-tags         # CI publishes to npm + GHCR from the tag
+```
+
+## License
+
+MIT

package/dist/cli.d.ts

@@ -0,0 +1 @@
+export {}

package/dist/cli.js

@@ -0,0 +1,51 @@
+#!/usr/bin/env node
+import { B as loadConfig, G as BUILD_INFO, W as setupInstructions, i as createServer, z as isConfigured } from "./server-iu_3JECB.js";
+import { ZodError } from "zod";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+//#region src/cli.ts
+const stderrLogger = {
+	debug: (...args) => {
+		if (process.env.UNIFI_PROTECT_DEBUG) console.error("[unifi-protect-mcp]", ...args);
+	},
+	warn: (...args) => console.error("[unifi-protect-mcp]", ...args),
+	error: (...args) => console.error("[unifi-protect-mcp]", ...args)
+};
+/** Show a config mistake as its field messages, not 40 frames of zod internals. */
+const describeFatal = (err) => {
+	if (err instanceof ZodError) return err.issues.map((issue) => {
+		const path = issue.path.join(".");
+		return path ? `${path}: ${issue.message}` : issue.message;
+	}).join("\n");
+	return err instanceof Error ? err.message : String(err);
+};
+const main = async () => {
+	stderrLogger.warn(`${BUILD_INFO.name}@${BUILD_INFO.version} (git ${BUILD_INFO.gitCommit} ${BUILD_INFO.gitCommitDate}, node ${process.version})`);
+	const config = loadConfig();
+	const { server } = createServer({
+		config,
+		logger: stderrLogger
+	});
+	const transport = new StdioServerTransport();
+	await server.connect(transport);
+	stderrLogger.warn(`unifi-protect-mcp connected (host=${config.baseUrl ?? "MISSING"}, user=${config.username ?? "MISSING"}, writes=${config.allowWrites ? "ENABLED" : "disabled"}, tls=${config.verifyTls ? "verified" : "UNVERIFIED"})`);
+	if (!isConfigured(config)) {
+		stderrLogger.warn("  not configured — only unifi_protect_auth_status is available:");
+		for (const line of setupInstructions(config)) stderrLogger.warn(`  ${line}`);
+		stderrLogger.warn("  Call unifi_protect_auth_status for this same guidance in your client.");
+	}
+	const shutdown = (signal) => {
+		stderrLogger.warn(`received ${signal}, shutting down`);
+		process.exit(0);
+	};
+	process.on("SIGINT", () => shutdown("SIGINT"));
+	process.on("SIGTERM", () => shutdown("SIGTERM"));
+};
+main().catch((err) => {
+	console.error(`[unifi-protect-mcp] fatal: ${describeFatal(err)}`);
+	if (process.env.UNIFI_PROTECT_DEBUG && err instanceof Error) console.error(err.stack);
+	process.exit(1);
+});
+//#endregion
+export {};
+
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","names":[],"sources":["../src/cli.ts"],"sourcesContent":["#!/usr/bin/env node\nimport { StdioServerTransport } from \"@modelcontextprotocol/sdk/server/stdio.js\";\nimport { ZodError } from \"zod\";\n\nimport { BUILD_INFO } from \"./build-info.js\";\nimport { isConfigured, loadConfig, setupInstructions } from \"./config.js\";\nimport { createServer } from \"./server.js\";\n\n// Everything goes to stderr: stdout is the MCP protocol channel, and a stray\n// log line there corrupts the JSON-RPC stream — usually failing the client's\n// next parse, far from the cause.\n// oxlint-disable no-console -- this is the process entry point; stderr is the log channel.\nconst stderrLogger = {\n  debug: (...args: unknown[]) => {\n    if (process.env.UNIFI_PROTECT_DEBUG) console.error(\"[unifi-protect-mcp]\", ...args);\n  },\n  warn: (...args: unknown[]) => console.error(\"[unifi-protect-mcp]\", ...args),\n  error: (...args: unknown[]) => console.error(\"[unifi-protect-mcp]\", ...args),\n};\n\n/** Show a config mistake as its field messages, not 40 frames of zod internals. */\nconst describeFatal = (err: unknown): string => {\n  if (err instanceof ZodError) {\n    return err.issues\n      .map((issue) => {\n        const path = issue.path.join(\".\");\n        return path ? `${path}: ${issue.message}` : issue.message;\n      })\n      .join(\"\\n\");\n  }\n  return err instanceof Error ? err.message : String(err);\n};\n\nconst main = async (): Promise<void> => {\n  stderrLogger.warn(\n    `${BUILD_INFO.name}@${BUILD_INFO.version} (git ${BUILD_INFO.gitCommit} ${BUILD_INFO.gitCommitDate}, node ${process.version})`,\n  );\n\n  const config = loadConfig();\n  // Before anything can open a socket.\n\n  const { server } = createServer({ config, logger: stderrLogger });\n  const transport = new StdioServerTransport();\n  await server.connect(transport);\n\n  stderrLogger.warn(\n    `unifi-protect-mcp connected (host=${config.baseUrl ?? \"MISSING\"}, ` +\n      `user=${config.username ?? \"MISSING\"}, ` +\n      `writes=${config.allowWrites ? \"ENABLED\" : \"disabled\"}, ` +\n      `tls=${config.verifyTls ? \"verified\" : \"UNVERIFIED\"})`,\n  );\n\n  // Connecting successfully but exposing one tool is confusing unless we say\n  // why. The server no longer refuses to start over this, so the banner and\n  // unifi_protect_auth_status are the only channels left.\n  if (!isConfigured(config)) {\n    stderrLogger.warn(\"  not configured — only unifi_protect_auth_status is available:\");\n    for (const line of setupInstructions(config)) stderrLogger.warn(`  ${line}`);\n    stderrLogger.warn(\"  Call unifi_protect_auth_status for this same guidance in your client.\");\n  }\n\n  const shutdown = (signal: string): void => {\n    stderrLogger.warn(`received ${signal}, shutting down`);\n    process.exit(0);\n  };\n  process.on(\"SIGINT\", () => shutdown(\"SIGINT\"));\n  process.on(\"SIGTERM\", () => shutdown(\"SIGTERM\"));\n};\n\nmain().catch((err: unknown) => {\n  console.error(`[unifi-protect-mcp] fatal: ${describeFatal(err)}`);\n  if (process.env.UNIFI_PROTECT_DEBUG && err instanceof Error) console.error(err.stack);\n  process.exit(1);\n});\n"],"mappings":";;;;;AAYA,MAAM,eAAe;CACnB,QAAQ,GAAG,SAAoB;EAC7B,IAAI,QAAQ,IAAI,qBAAqB,QAAQ,MAAM,uBAAuB,GAAG,IAAI;CACnF;CACA,OAAO,GAAG,SAAoB,QAAQ,MAAM,uBAAuB,GAAG,IAAI;CAC1E,QAAQ,GAAG,SAAoB,QAAQ,MAAM,uBAAuB,GAAG,IAAI;AAC7E;;AAGA,MAAM,iBAAiB,QAAyB;CAC9C,IAAI,eAAe,UACjB,OAAO,IAAI,OACR,KAAK,UAAU;EACd,MAAM,OAAO,MAAM,KAAK,KAAK,GAAG;EAChC,OAAO,OAAO,GAAG,KAAK,IAAI,MAAM,YAAY,MAAM;CACpD,CAAC,CAAC,CACD,KAAK,IAAI;CAEd,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AACxD;AAEA,MAAM,OAAO,YAA2B;CACtC,aAAa,KACX,GAAG,WAAW,KAAK,GAAG,WAAW,QAAQ,QAAQ,WAAW,UAAU,GAAG,WAAW,cAAc,SAAS,QAAQ,QAAQ,EAC7H;CAEA,MAAM,SAAS,WAAW;CAG1B,MAAM,EAAE,WAAW,aAAa;EAAE;EAAQ,QAAQ;CAAa,CAAC;CAChE,MAAM,YAAY,IAAI,qBAAqB;CAC3C,MAAM,OAAO,QAAQ,SAAS;CAE9B,aAAa,KACX,qCAAqC,OAAO,WAAW,UAAU,SACvD,OAAO,YAAY,UAAU,WAC3B,OAAO,cAAc,YAAY,WAAW,QAC/C,OAAO,YAAY,aAAa,aAAa,EACxD;CAKA,IAAI,CAAC,aAAa,MAAM,GAAG;EACzB,aAAa,KAAK,iEAAiE;EACnF,KAAK,MAAM,QAAQ,kBAAkB,MAAM,GAAG,aAAa,KAAK,KAAK,MAAM;EAC3E,aAAa,KAAK,yEAAyE;CAC7F;CAEA,MAAM,YAAY,WAAyB;EACzC,aAAa,KAAK,YAAY,OAAO,gBAAgB;EACrD,QAAQ,KAAK,CAAC;CAChB;CACA,QAAQ,GAAG,gBAAgB,SAAS,QAAQ,CAAC;CAC7C,QAAQ,GAAG,iBAAiB,SAAS,SAAS,CAAC;AACjD;AAEA,KAAK,CAAC,CAAC,OAAO,QAAiB;CAC7B,QAAQ,MAAM,8BAA8B,cAAc,GAAG,GAAG;CAChE,IAAI,QAAQ,IAAI,uBAAuB,eAAe,OAAO,QAAQ,MAAM,IAAI,KAAK;CACpF,QAAQ,KAAK,CAAC;AAChB,CAAC"}