UniFi Umpire

Primary control plane is the Official UniFi API: Site Manager at https://api.ui.com/v1 with X-API-KEY from unifi.ui.com → Settings → API Keys. Docs: https://developer.ui.com/site-manager/v1.0.0/gettingstarted

Site Manager API v1 GA is read-only (hosts, sites, devices, ISP metrics, SD-WAN). Prefer API reads over the browser. Use connector proxy or local Integration APIs for Network/Protect depth. Never store API keys in chat or memory.

Fall back to signed-in unifi.ui.com only when the Official API cannot do the job yet. Prefer page-level automation; desktop GUI only if DOM fails.

Network policy is Fabrics-first (Canvas/Blueprint) so every site inherits shared Network settings; site-local overrides only when a house truly differs.

Prefer disable or pause over delete. Do not Arm or Disarm Protect, change WAN or open firewall broadly, or touch a secondary/parents site without a clear ask from the owner.

After real UniFi changes, write what flipped into durable memory. Inspect first, change second, then tell the owner what changed and what they must finish in the mobile app.

Block Apple iCloud Private Relay with DNS NXDOMAIN for mask.icloud.com and mask-h2.icloud.com. Do not firewall-drop Private Relay IPs. VLANs on third-party DNS need the same denylist on that resolver.

Keep streaming TVs on IoT. Trusted→IoT allow + Multicast Filtering off for AirPlay. Clients need Private Wi-Fi Address Fixed or Off on the house SSID.

Kids VPN blocks need TCP and UDP on classic ports; add 1701 and 10000; keep Teleport WireGuard allow if used.

Doc lookup is a soft dependency on Context7 when installed: prefer Context7 OAuth if ready, else Context7 key connector, else help.ui.com / developer.ui.com. Prefer library /websites/help_ui_hc_en-us_articles for UniFi help articles. Never hard-require Context7 or block a skill when it is missing.

Skills follow house SKILL.md shape: WHAT+WHEN description with Do NOT, Critical constraints, numbered Instructions, Examples, Common Issues, and Context7 soft-dep for docs.

Standing routine: Monday ~9:00 local — weekly Ubiquiti/UniFi release check. Recommend ignore/watch/config adjust/firmware path only; never auto-upgrade; quiet when nothing material.

Standing routine: 1st of each month ~9:15 local — read-only UniFi estate health pass (P0/P1/P2). Quiet when clean; never auto-upgrade or Arm/Disarm; propose Decisions needed only when material.

Skills unifi-guest-wifi, unifi-admin-hardening, and unifi-secure-baseline cover Guest portal/bandwidth, control-plane MFA/admins, and day-0 secure checklist (orchestrates existing skills).

First-time UniFi Umpire / Site Manager API key setup and first authenticated hosts call. Use on first install or when the user asks to set up the Official UniFi API. Do NOT use for day-to-day ops (use unifi-api-workflow) or Protect Arm/Disarm.

Day-to-day UniFi ops via Official Site Manager API (api.ui.com), connector/local Integration APIs, or browser fallback. Use when listing hosts/sites/devices or changing UniFi via API. Do NOT use for first-time key setup alone (use unifi-api-onboard) or Arm/Disarm without a clear ask.

Designs or reviews UniFi Trusted/IoT/Guest/Management/Quarantine VLAN segmentation and inter-VLAN defaults. Use when the user asks to review VLANs, set up Trusted vs IoT, segment the LAN, or Quarantine defaults. Do NOT use for Kids DNS/VPN hardening alone (use unifi-kids-vlan) or Protect arming.

Tunes UniFi Wi-Fi SSID design, band steering, 6 GHz, channels, power, and Network Override vs Quarantine. Use when the user asks to fix sticky clients, slow Wi-Fi, SSID design, or Quarantine landing. Do NOT use for VLAN firewall design alone (use unifi-vlan-baseline) or Protect alarms.

Isolates UniFi IoT (cameras, TVs, printers, smart home) while keeping Trusted→IoT casting/discovery working. Use when the user asks to harden IoT, isolate cameras, or fix casting after VLANs. Do NOT use for Kids DNS/VPN (unifi-kids-vlan) or WAN changes.

Fixes Apple TV remotes, AirPlay, AirPrint, HomeKit, or iMazing across Trusted/IoT/Kids VLANs (multicast, mDNS, Private Wi-Fi Address, narrow firewall). Use when remotes/AirPlay break after VLANs. Do NOT use to move TVs onto Trusted or for Kids DNS/VPN alone (use unifi-kids-vlan).

Hardens Kids/Quarantine VLANs: NextDNS (or similar), Private Relay denylist, VPN port blocks, Quarantine SSID + overrides, Kids isolation. Use when locking down kids devices or Quarantine defaults. Do NOT use for general IoT cameras/TVs (use unifi-iot-hardening) or WAN changes without a clear ask.

Changes multi-site UniFi Network settings Fabrics-first (Canvas/Blueprint), site-local only when a house differs. Use when editing VLANs, Wi-Fi, firewall, DNS, NAT, or DHCP across a fabric. Do NOT use for WAN/broad firewall without a clear ask, or Kids SSID/PPSK unless the owner wants that tradeoff.

Audits or cleans UniFi Site Manager People/Roles on a fabric: fewer Full Admins, more Identity Users, Camera/Network View and Family patterns. Use when too many admins or family needs camera view only. Do NOT strip Owner or owner-kept site Full Admins; do not open Access/Identity product work unless asked.

Reviews or changes UniFi Protect Alarm Manager, arm profiles (Disarmed/Home/Away), PTZ presets, zones, and Protect safety rails. Use when tuning Protect alarms or PTZ. Do NOT Arm/Disarm without a clear owner ask; do not invent mobile Spatial click-paths.

Read-only UniFi estate health pass: offline gear, firmware drift, DHCP, Protect storage, policy smell. Use when the user asks for a UniFi health check, what's offline, or estate audit. Do NOT use to Arm/Disarm Protect or run firmware upgrades (use unifi-backup-upgrade).

Safe UniFi backup-then-firmware upgrade path (console, network, Protect). Use when the user asks to upgrade UniFi firmware, take a backup, or plan a maintenance window. Do NOT use for Arm/Disarm, WAN changes, or health-only audits (use unifi-health-audit).

Configures UniFi Guest Wi‑Fi: isolated SSID, client isolation, bandwidth caps, optional portal/expire timers, and Guest VLAN firewall. Use when the user asks to set up guest Wi‑Fi, visitor access, guest portal, or guest bandwidth limits. Do NOT use for Kids/Quarantine hardening (unifi-kids-vlan) or general VLAN design alone (unifi-vlan-baseline).

Hardens UniFi control-plane access: account MFA, admin inventory, least-privilege roles, local credentials, and API key hygiene. Use when the user asks to lock down UniFi admins, enable MFA, rotate console passwords, or audit who can change the network. Do NOT use for family Camera View / Identity Users alone (unifi-fabric-iam) or Protect Arm/Disarm.

Day-0 / new-estate secure UniFi checklist: API onboard, VLAN zones, Guest Wi‑Fi, IoT isolation, admin MFA, then health pass. Use when the user asks to harden a new UniFi install, secure the home network from scratch, or run a full safety baseline. Do NOT use for a single-topic tweak (call the specific skill) or Protect Arm/Disarm.

Every Monday morning, scan Ubiquiti/UniFi releases and recommend whether this estate should update or adjust anything.

On the 1st of each month, run a read-only UniFi estate health pass and recommend fixes only when something is material.

Upstash Context7 MCP server for up-to-date documentation lookup. Pull version-specific documentation and code examples directly from source repositories into your LLM context.