@owine/unifi-network-mcp 2.7.5 → 2.8.0

package/dist/tools/acl.js

@@ -92,6 +92,18 @@ function registerAclTools(server, client, readOnly = false) {
                 .array(zod_1.z.enum(["TCP", "UDP"]))
                 .optional()
                 .describe("Protocols this ACL rule will be applied to (TCP, UDP). When null, applies to all protocols"),
+            sourceFilter: zod_1.z
+                .unknown()
+                .optional()
+                .describe("Traffic source filter (opaque object — pass the structure the API expects)"),
+            destinationFilter: zod_1.z
+                .unknown()
+                .optional()
+                .describe("Traffic destination filter (opaque object — pass the structure the API expects)"),
+            enforcingDeviceFilter: zod_1.z
+                .unknown()
+                .optional()
+                .describe("IDs of the Switch-capable devices used to enforce the ACL rule. When null/omitted, the rule is provisioned to all switches on the site"),
             dryRun: zod_1.z
                 .boolean()
                 .optional()
@@ -99,13 +111,19 @@ function registerAclTools(server, client, readOnly = false) {
         },
         outputSchema: output_schemas_js_1.aclRuleOutputSchema,
         annotations: safety_js_1.WRITE_NOT_IDEMPOTENT,
-    }, async ({ siteId, type, name, enabled, action, description, protocolFilter, dryRun }) => {
+    }, async ({ siteId, type, name, enabled, action, description, protocolFilter, sourceFilter, destinationFilter, enforcingDeviceFilter, dryRun }) => {
         try {
             const body = { type, name, enabled, action };
             if (description !== undefined)
                 body.description = description;
             if (protocolFilter !== undefined)
                 body.protocolFilter = protocolFilter;
+            if (sourceFilter !== undefined)
+                body.sourceFilter = sourceFilter;
+            if (destinationFilter !== undefined)
+                body.destinationFilter = destinationFilter;
+            if (enforcingDeviceFilter !== undefined)
+                body.enforcingDeviceFilter = enforcingDeviceFilter;
             if (dryRun)
                 return (0, safety_js_1.formatDryRun)("POST", `/sites/${siteId}/acl-rules`, body);
             const data = await client.post(`/sites/${siteId}/acl-rules`, body);
@@ -132,6 +150,18 @@ function registerAclTools(server, client, readOnly = false) {
                 .array(zod_1.z.enum(["TCP", "UDP"]))
                 .optional()
                 .describe("Protocols this ACL rule will be applied to (TCP, UDP). When null, applies to all protocols"),
+            sourceFilter: zod_1.z
+                .unknown()
+                .optional()
+                .describe("Traffic source filter (opaque object — pass the structure the API expects)"),
+            destinationFilter: zod_1.z
+                .unknown()
+                .optional()
+                .describe("Traffic destination filter (opaque object — pass the structure the API expects)"),
+            enforcingDeviceFilter: zod_1.z
+                .unknown()
+                .optional()
+                .describe("IDs of the Switch-capable devices used to enforce the ACL rule. When null/omitted, the rule is provisioned to all switches on the site"),
             dryRun: zod_1.z
                 .boolean()
                 .optional()
@@ -139,13 +169,19 @@ function registerAclTools(server, client, readOnly = false) {
         },
         outputSchema: output_schemas_js_1.aclRuleOutputSchema,
         annotations: safety_js_1.WRITE,
-    }, async ({ siteId, aclRuleId, type, name, enabled, action, description, protocolFilter, dryRun }) => {
+    }, async ({ siteId, aclRuleId, type, name, enabled, action, description, protocolFilter, sourceFilter, destinationFilter, enforcingDeviceFilter, dryRun }) => {
         try {
             const body = { type, name, enabled, action };
             if (description !== undefined)
                 body.description = description;
             if (protocolFilter !== undefined)
                 body.protocolFilter = protocolFilter;
+            if (sourceFilter !== undefined)
+                body.sourceFilter = sourceFilter;
+            if (destinationFilter !== undefined)
+                body.destinationFilter = destinationFilter;
+            if (enforcingDeviceFilter !== undefined)
+                body.enforcingDeviceFilter = enforcingDeviceFilter;
             if (dryRun)
                 return (0, safety_js_1.formatDryRun)("PUT", `/sites/${siteId}/acl-rules/${aclRuleId}`, body);
             const data = await client.put(`/sites/${siteId}/acl-rules/${aclRuleId}`, body);

package/dist/tools/clients.js

@@ -8,7 +8,7 @@ const safety_js_1 = require("../utils/safety.js");
 const output_schemas_js_1 = require("../utils/output-schemas.js");
 function registerClientTools(server, client, readOnly = false) {
     server.registerTool("unifi_list_clients", {
-        description: "List currently connected clients at a site. Returns per client: id, name, type (WIRED/WIRELESS/VPN/TELEPORT), macAddress, ipAddress, connectedAt, uplinkDeviceId (the switch/AP they're attached to), access.type. NOTE: verified against 10.4.55 — the Integration API client schema is minimal and identical across types; it does NOT expose signal strength, channel, or per-port binding. Use for: who's online right now. Disconnected/historical clients are NOT in the Integration API.",
+        description: "List currently connected clients at a site. Returns per client: id, name, type (WIRED/WIRELESS/VPN/TELEPORT), macAddress, ipAddress, connectedAt, uplinkDeviceId (the switch/AP they're attached to), access.type. NOTE: verified against 10.5.43 — the Integration API client schema is minimal and identical across types; it does NOT expose signal strength, channel, or per-port binding. Use for: who's online right now. Disconnected/historical clients are NOT in the Integration API.",
         inputSchema: {
             siteId: zod_1.z.string().describe("Site ID"),
             offset: zod_1.z

package/dist/tools/devices.js

@@ -58,7 +58,7 @@ function registerDeviceTools(server, client, readOnly = false) {
         }
     });
     server.registerTool("unifi_get_device_statistics", {
-        description: "Get latest live statistics for a device. Returns: uptimeSec, lastHeartbeatAt, nextHeartbeatAt, loadAverage1/5/15Min, cpuUtilizationPct, memoryUtilizationPct, uplink (txRateBps, rxRateBps), interfaces.radios[] for APs ({frequencyGHz, txRetriesPct}). NOTE: verified against 10.4.55 — the Integration API does NOT expose per-switch-port byte/error/PoE-power counters here; port-level live stats are unavailable. Use for: device health and AP radio metrics. For config (channel, power, port assignment), use unifi_get_device.",
+        description: "Get latest live statistics for a device. Returns: uptimeSec, lastHeartbeatAt, nextHeartbeatAt, loadAverage1/5/15Min, cpuUtilizationPct, memoryUtilizationPct, uplink (txRateBps, rxRateBps), interfaces.radios[] for APs ({frequencyGHz, txRetriesPct}). NOTE: verified against 10.5.43 — the Integration API does NOT expose per-switch-port byte/error/PoE-power counters here; port-level live stats are unavailable. Use for: device health and AP radio metrics. For config (channel, power, port assignment), use unifi_get_device.",
         inputSchema: {
             siteId: zod_1.z.string().describe("Site ID"),
             deviceId: zod_1.z.string().describe("Device ID"),
@@ -75,7 +75,7 @@ function registerDeviceTools(server, client, readOnly = false) {
         }
     });
     server.registerTool("unifi_list_pending_devices", {
-        description: "List devices pending adoption across all sites (global endpoint, not site-scoped). Returns: basic device info per pending device (macAddress, model, ipAddress, firmwareVersion, etc. — exact per-row schema is not rendered in the 10.4.55 docs). Use for: discovering new devices on the network before calling unifi_adopt_device.",
+        description: "List devices pending adoption across all sites (global endpoint, not site-scoped). Returns: basic device info per pending device (macAddress, model, ipAddress, firmwareVersion, etc. — exact per-row schema is not rendered in the 10.5.43 docs). Use for: discovering new devices on the network before calling unifi_adopt_device.",
         inputSchema: {
             offset: zod_1.z
                 .number()

package/dist/tools/supporting.js

@@ -8,7 +8,7 @@ const safety_js_1 = require("../utils/safety.js");
 const output_schemas_js_1 = require("../utils/output-schemas.js");
 function registerSupportingTools(server, client) {
     server.registerTool("unifi_list_wans", {
-        description: "List WAN interface definitions at a site. Returns: id, name only (verified against 10.4.55 — the Integration API exposes no live link status or throughput rates here). Use for: WAN inventory, multi-WAN topology.",
+        description: "List WAN interface definitions at a site. Returns: id, name only (verified against 10.5.43 — the Integration API exposes no live link status or throughput rates here). Use for: WAN inventory, multi-WAN topology.",
         inputSchema: {
             siteId: zod_1.z.string().describe("Site ID"),
             offset: zod_1.z
@@ -38,7 +38,7 @@ function registerSupportingTools(server, client) {
         }
     });
     server.registerTool("unifi_list_vpn_tunnels", {
-        description: "List site-to-site VPN tunnels (IPsec, WireGuard, OpenVPN site-to-site) at a site. Returns: tunnel definitions per row (per-row schema not rendered in 10.4.55 docs — call to inspect). For roaming client VPN servers, see unifi_list_vpn_servers.",
+        description: "List site-to-site VPN tunnels (IPsec, WireGuard, OpenVPN site-to-site) at a site. Returns: tunnel definitions per row (per-row schema not rendered in 10.5.43 docs — call to inspect). For roaming client VPN servers, see unifi_list_vpn_servers.",
         inputSchema: {
             siteId: zod_1.z.string().describe("Site ID"),
             offset: zod_1.z

package/dist/tools/system.js

@@ -6,7 +6,7 @@ const safety_js_1 = require("../utils/safety.js");
 const output_schemas_js_1 = require("../utils/output-schemas.js");
 function registerSystemTools(server, client) {
     server.registerTool("unifi_get_info", {
-        description: "Get UniFi Network application info. Returns: applicationVersion. NOTE: verified against 10.4.55 on a UniFi OS console — the Integration API returns ONLY applicationVersion here; there is no isUniFiOSConsole or other field. Use for: version checks before calling version-gated tools.",
+        description: "Get UniFi Network application info. Returns: applicationVersion. NOTE: verified against 10.5.43 on a UniFi OS console — the Integration API returns ONLY applicationVersion here; there is no isUniFiOSConsole or other field. Use for: version checks before calling version-gated tools.",
         inputSchema: {},
         outputSchema: output_schemas_js_1.getInfoOutputSchema,
         annotations: safety_js_1.READ_ONLY,

package/dist/utils/output-schemas.d.ts

@@ -3,7 +3,7 @@
  * field optional, every nested object uses .passthrough() to allow
  * firmware/hardware-specific fields to flow through unchanged).
  *
- * Verified against UniFi Network API 10.4.55. Where the docs collapse
+ * Verified against UniFi Network API 10.5.43. Where the docs collapse
  * nested arrays/objects (e.g. interfaces.ports[], radios[]), the schema
  * uses passthrough records so the contract doesn't lock to fields we
  * haven't verified.
@@ -105,7 +105,7 @@ export declare const listVouchersOutputSchema: {
     readonly totalCount: z.ZodOptional<z.ZodNumber>;
 };
 export declare const createVouchersOutputSchema: {
-    readonly data: z.ZodArray<z.ZodObject<{
+    readonly vouchers: z.ZodArray<z.ZodObject<{
         id: z.ZodString;
         code: z.ZodOptional<z.ZodString>;
         name: z.ZodOptional<z.ZodString>;
@@ -120,10 +120,6 @@ export declare const createVouchersOutputSchema: {
         authorizedGuestCount: z.ZodOptional<z.ZodNumber>;
         expired: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$loose>>;
-    readonly offset: z.ZodOptional<z.ZodNumber>;
-    readonly limit: z.ZodOptional<z.ZodNumber>;
-    readonly count: z.ZodOptional<z.ZodNumber>;
-    readonly totalCount: z.ZodOptional<z.ZodNumber>;
 };
 export declare const firewallZoneOutputSchema: {
     id: z.ZodString;
@@ -205,6 +201,7 @@ export declare const aclRuleOutputSchema: {
     protocolFilter: z.ZodOptional<z.ZodArray<z.ZodString>>;
     sourceFilter: z.ZodOptional<z.ZodUnknown>;
     destinationFilter: z.ZodOptional<z.ZodUnknown>;
+    enforcingDeviceFilter: z.ZodOptional<z.ZodUnknown>;
     metadata: z.ZodOptional<z.ZodObject<{
         origin: z.ZodOptional<z.ZodString>;
     }, z.core.$loose>>;
@@ -220,6 +217,7 @@ export declare const listAclRulesOutputSchema: {
         protocolFilter: z.ZodOptional<z.ZodArray<z.ZodString>>;
         sourceFilter: z.ZodOptional<z.ZodUnknown>;
         destinationFilter: z.ZodOptional<z.ZodUnknown>;
+        enforcingDeviceFilter: z.ZodOptional<z.ZodUnknown>;
         metadata: z.ZodOptional<z.ZodObject<{
             origin: z.ZodOptional<z.ZodString>;
         }, z.core.$loose>>;

package/dist/utils/output-schemas.js

@@ -6,7 +6,7 @@ exports.listPendingDevicesOutputSchema = exports.listCountriesOutputSchema = exp
  * field optional, every nested object uses .passthrough() to allow
  * firmware/hardware-specific fields to flow through unchanged).
  *
- * Verified against UniFi Network API 10.4.55. Where the docs collapse
+ * Verified against UniFi Network API 10.5.43. Where the docs collapse
  * nested arrays/objects (e.g. interfaces.ports[], radios[]), the schema
  * uses passthrough records so the contract doesn't lock to fields we
  * haven't verified.
@@ -160,7 +160,7 @@ const WifiBroadcast = zod_1.z
     .passthrough();
 const ApplicationInfo = zod_1.z
     .object({
-    // Live-verified (10.4.55): only applicationVersion is returned.
+    // Live-verified (10.5.43): only applicationVersion is returned.
     applicationVersion: zod_1.z.string().optional(),
 })
     .passthrough();
@@ -262,6 +262,7 @@ const AclRule = zod_1.z
     protocolFilter: zod_1.z.array(zod_1.z.string()).optional(),
     sourceFilter: zod_1.z.unknown().optional(),
     destinationFilter: zod_1.z.unknown().optional(),
+    enforcingDeviceFilter: zod_1.z.unknown().optional(),
     metadata: Metadata.optional(),
 })
     .passthrough();
@@ -323,7 +324,7 @@ const TrafficMatchingList = zod_1.z
     metadata: Metadata.optional(),
 })
     .passthrough();
-// Verified against the live Integration API (10.4.55). The WAN and
+// Verified against the live Integration API (10.5.43). The WAN and
 // site-to-site-tunnel list rows are intentionally minimal in the API.
 const Wan = zod_1.z
     .object({
@@ -407,9 +408,12 @@ exports.listVouchersOutputSchema = {
     ...PaginationFields,
     data: zod_1.z.array(Voucher),
 };
+// NOTE: the Generate Vouchers endpoint does NOT return the standard
+// paginated envelope. Live-verified (10.5.43): it returns
+// `{ "vouchers": [ ...Voucher ] }` with no offset/limit/count/totalCount.
+// An over-tight schema here (e.g. requiring `data`) hard-fails every call.
 exports.createVouchersOutputSchema = {
-    ...PaginationFields,
-    data: zod_1.z.array(Voucher),
+    vouchers: zod_1.z.array(Voucher),
 };
 exports.firewallZoneOutputSchema = FirewallZone.shape;
 exports.listFirewallZonesOutputSchema = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owine/unifi-network-mcp",
-  "version": "2.7.5",
+  "version": "2.8.0",
   "description": "MCP server for the UniFi Network API",
   "main": "dist/index.js",
   "bin": {
@@ -22,7 +22,7 @@
   "engines": {
     "node": "^22.13.0 || ^24.0.0"
   },
-  "packageManager": "pnpm@11.6.0",
+  "packageManager": "pnpm@11.8.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/owine/unifi-network-mcp.git"
@@ -43,11 +43,11 @@
   "devDependencies": {
     "@eslint/js": "10.0.1",
     "@types/node": "24.13.2",
-    "@vitest/coverage-v8": "4.1.8",
+    "@vitest/coverage-v8": "4.1.9",
     "eslint": "10.5.0",
     "lefthook": "2.1.9",
     "typescript": "6.0.3",
-    "typescript-eslint": "8.61.0",
-    "vitest": "4.1.8"
+    "typescript-eslint": "8.61.1",
+    "vitest": "4.1.9"
   }
 }