Safe Omada MCP

Security-focused MCP server for TP-Link Omada Open API workflows.

At a Glance

• Production-safe baseline uses stdio
• Omada credentials are environment-only
• Capability profiles and category gating control what tools are exposed
• HTTP remains in the codebase only as an explicitly unsafe, lab-only path
• Validated against live Omada Controller 6.x environments and designed around the documented 5.x/6.x Open API surface

Quick Start

Option 1: Use with Claude Desktop via Docker

1. Pull or build an image:

   docker pull ghcr.io/gaspareduard/omada-mcp:latest

   If you do not publish an image yet, build locally instead:

   npm run docker:build

2. Edit your Claude Desktop MCP config:

   • macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
   • Windows: %APPDATA%\Claude\claude_desktop_config.json

3. Add the server entry:

   {
     "mcpServers": {
       "safe-omada": {
         "command": "docker",
         "args": [
           "run",
           "-i",
           "--rm",
           "-e", "OMADA_BASE_URL=https://your-omada-controller.local",
           "-e", "OMADA_CLIENT_ID=your-client-id",
           "-e", "OMADA_CLIENT_SECRET=your-client-secret",
           "-e", "OMADA_OMADAC_ID=your-omadac-id",
           "-e", "OMADA_SITE_ID=your-site-id",
           "-e", "OMADA_STRICT_SSL=true",
           "ghcr.io/gaspareduard/omada-mcp:latest"
         ]
       }
     }
   }

4. Restart Claude Desktop and verify the server by listing sites or devices.

Option 2: Run the container directly

docker run --rm -it \
  --env-file .env \
  ghcr.io/gaspareduard/omada-mcp:latest

Option 3: Run locally for development

npm install
npm run build
npm start

Configuration

The server reads configuration from environment variables. See .env.example for the complete reference.

Required Omada Variables

Variable	Required	Default	Description
OMADA_BASE_URL	Yes	-	Base URL of the Omada controller
OMADA_CLIENT_ID	Yes	-	OAuth client ID from Omada Platform Integration
OMADA_CLIENT_SECRET	Yes	-	OAuth client secret
OMADA_OMADAC_ID	Yes	-	Omada controller ID (omadacId)
OMADA_SITE_ID	No	-	Optional default site ID
OMADA_STRICT_SSL	No	true	Enforce TLS certificate validation
OMADA_TIMEOUT	No	30000	HTTP timeout in milliseconds

Capability and Logging

Variable	Required	Default	Description
OMADA_CAPABILITY_PROFILE	No	safe-read	Built-in profile: safe-read, ops-write, admin, compatibility
OMADA_TOOL_CATEGORIES	No	profile default	Explicit category override
MCP_SERVER_LOG_LEVEL	No	info	debug, info, warn, error, silent
MCP_SERVER_LOG_FORMAT	No	plain	plain, json, or gcp-json

Capability Profiles

Profile	Intended use
safe-read	Default read-only operational visibility
ops-write	Limited operational write actions
admin	Full documented tool surface, including admin mutations
compatibility	Reserved for future controller-specific fallback modules

Destructive Tool Confirmation Gate

The four restore tools (restoreController, restoreControllerFromFileServer, restoreSites, restoreSitesFromFileServer) enforce a two-step confirmation: without confirmDangerous: true the tool returns a warning explaining the action is irreversible and that a force recovery or factory reset may be required if something goes wrong.

Scope of this protection: this gate is effective in conversational AI sessions where the warning is surfaced to a human who then decides whether to confirm. It does not prevent a fully autonomous agent from passing confirmDangerous: true programmatically without human review.

True human-in-the-loop enforcement requires one or both of:

• MCP client approval mode — Claude Desktop and compatible MCP hosts can be configured to require explicit human approval before any tool call executes. This is the only reliable technical gate against autonomous execution.
• Capability profile restriction — the restore tools require maintenance:rw, which is only granted under ops-write or admin. Keeping the deployment on the default safe-read profile blocks all restore tools entirely.

Optional HTTP Lab Mode

HTTP is not part of the supported production baseline.

It only starts when both of these are set:

• MCP_SERVER_USE_HTTP=true
• MCP_UNSAFE_ENABLE_HTTP=true

Use it only for local lab/debug scenarios.

Variable	Required	Default	Description
MCP_SERVER_USE_HTTP	No	false	Legacy lab-only switch
MCP_UNSAFE_ENABLE_HTTP	No	false	Explicit acknowledgement required
MCP_HTTP_PORT	No	3000	HTTP port
MCP_HTTP_BIND_ADDR	No	127.0.0.1	Loopback bind address only (127.0.0.1 or ::1)
MCP_HTTP_PATH	No	/mcp	MCP endpoint path
MCP_HTTP_ENABLE_HEALTHCHECK	No	true	Enable health check
MCP_HTTP_HEALTHCHECK_PATH	No	/healthz	Health check path
MCP_HTTP_ALLOW_CORS	No	true	Enable CORS
MCP_HTTP_ALLOWED_ORIGINS	No	127.0.0.1, localhost	Allowed origins
MCP_HTTP_NGROK_ENABLED	No	false	Legacy placeholder; disabled in safe baseline
MCP_HTTP_NGROK_AUTH_TOKEN	No	-	Legacy placeholder

Development and Validation

Common Commands

Task	Command
Run dev server	npm run dev
Build	npm run build
Lint + type-check	npm run check
Unit tests	npm test
Coverage gates	npm run test:coverage
Symlink integrity	npm run symlinks:check
README/tool sync	node scripts/check-readme-sync.mjs
Tool/test mapping	node scripts/check-tool-tests.mjs

Inspector

Use the MCP Inspector when you want to test the built server interactively:

npm run inspector
npm run inspector:build

Project Notes

• The safe baseline is stdio first.
• HTTP remains a legacy, explicitly unsafe lab path.
• The repo includes docs/openapi/ as the implementation reference for Omada endpoints.
• README tool tables below are kept in sync with the registered MCP tools.

Tools

Site & Client

Tool	Description
listSites	Lists all sites configured on the controller.
getSiteCapacity	Get site capacity settings including maximum device and client counts.
getSiteDetail	Get detailed information about a site, including name, region, timezone, and configuration.
getSiteDeviceAccount	Get device account settings for a site.
getSiteNtpStatus	Get NTP server status and configuration for a site.
getSiteRememberSetting	Get the remember device setting for a site.
getSiteSpecification	Get site specification including device limits and feature capabilities.
getSiteUrl	Get the URL associated with a site for OpenAPI access.
getSiteTemplateConfig	Get configuration settings for a site template. Requires siteTemplateId.
getSiteTemplateDetail	Get detailed information about a site template. Requires siteTemplateId.
getSiteTemplateList	List all site templates configured on the controller.
listClients	Lists active client devices for a site.
getClient	[DEPRECATED] Use listClients instead. When you have a client MAC, getClientDetail is also available. This tool filters the site client list in-process.
listMostActiveClients	Gets the most active clients sorted by traffic usage.
listClientsActivity	Gets client activity statistics over time.
listClientsPastConnections	Gets past connection history for clients.
setClientRateLimit	Sets custom bandwidth limits (download/upload) for a specific client.
setClientRateLimitProfile	Applies a predefined rate limit profile to a specific client.
disableClientRateLimit	Disables bandwidth rate limiting for a specific client.
blockClient	Blocks a client from network access with an auditable mutation summary.
unblockClient	Restores a blocked client to network access with an auditable mutation summary.
reconnectClient	Forces a client to reconnect with an auditable mutation summary.
rebootDevice	Reboots a managed device with an auditable mutation summary.
setDeviceLed	Changes a device LED state with an auditable mutation summary.

Device

Tool	Description
listDevices	Lists provisioned devices for a given site.
getDevice	[DEPRECATED] Use listDevices instead and filter results client-side. This tool filters the site device list in-process; there is no dedicated device-detail endpoint.
searchDevices	Searches for devices globally across all sites the user has access to.
listDevicesStats	Queries statistics for global adopted devices with pagination and filtering.
getSwitchStackDetail	Retrieves detailed configuration and status for a switch stack.
getSwitchDetail	Fetches detailed configuration and status for a specific switch.
getGatewayDetail	Fetches detailed configuration and status for a specific gateway.
getGatewayWanStatus	Gets WAN port status for a specific gateway.
getGatewayLanStatus	Gets LAN port status for a specific gateway.
getGatewayPorts	Gets port information for a specific gateway.
getApDetail	Fetches detailed configuration and status for a specific access point.
getApRadios	Gets radio information for a specific access point.
getStackPorts	Gets port information for a switch stack.
listPendingDevices	Lists devices pending adoption in a site.
getAllDeviceBySite	Gets all devices in a site including offline and disconnected devices.
getFirmwareInfo	Gets the latest available firmware info for a device. Use listDevices for MACs.
getGridAutoCheckUpgrade	Gets the auto-check firmware upgrade plan list (paginated).
listSwitchNetworks	Lists VLAN network assignments for a switch (paginated). Requires switchMac.
getSwitchGeneralConfig	Gets general configuration for a switch. Requires switchMac.
getCableTestLogs	Gets cable test history for a switch. Requires switchMac.
getCableTestFullResults	Gets full per-port cable diagnostics for a switch. Requires switchMac.
getOswStackLagList	Gets Link Aggregation Group (LAG) list for a switch stack. Requires stackId.
getStackNetworkList	Gets VLAN network list for a switch stack (paginated). Requires stackId.
getApUplinkConfig	Gets uplink configuration for an AP (wired/mesh mode). Requires apMac.
getRadiosConfig	Gets per-radio configuration for an AP (channel, power, width). Requires apMac.
getApVlanConfig	Get VLAN configuration for an access point, including management VLAN and per-SSID VLAN tagging settings.
getMeshStatistics	Gets mesh link statistics for an AP. Requires apMac.
getRFScanResult	Gets last RF scan results for an AP. Requires apMac.
getSpeedTestResults	Gets last speed test results for an AP. Requires apMac.
getApSnmpConfig	Gets SNMP configuration for an AP. Requires apMac.
getApLldpConfig	Gets LLDP configuration for an AP. Requires apMac.
getApGeneralConfig	Gets general configuration for an AP (name, LED, country). Requires apMac.
getUplinkWiredDetail	Get wired uplink detail for an access point: uplink switch, port number, link speed, and PoE status.
getDownlinkWiredDevices	Gets wired downlink devices on an AP's LAN ports. Requires apMac.
getFirmwareUpgradePlan	Get the firmware upgrade plan list for devices managed by the controller.
getUpgradeLogs	Get firmware upgrade logs showing the history of upgrade operations performed on devices.
getDeviceTagList	Get the list of device tags defined in a site.
getApQosConfig	Get QoS configuration for a specific access point. Requires apMac.
getApIpv6Config	Get IPv6 configuration for a specific access point. Requires apMac.
getSitesApsIpSetting	Get IP settings for an AP. Requires apMac.
getSitesApsChannelLimit	Get channel limit configuration for an AP. Requires apMac.
getSitesApsAvailableChannel	Get list of available channels for an AP. Requires apMac.
getSitesApsLoadBalance	Get load balance configuration for an AP. Requires apMac.
getSitesApsOfdma	Get OFDMA configuration for an AP. Requires apMac.
getSitesApsPowerSaving	Get power saving configuration for an AP. Requires apMac.
setApPowerSaving	Updates AP power saving configuration with support checks and dry-run preview. Requires apMac.
setApChannelLimit	Updates AP channel-limit configuration with support checks and dry-run preview. Requires apMac.
setApConfig	Updates documented AP configuration families with dry-run preview. Covers AP general, IP, IPv6, QoS, radio, service, load-balance, OFDMA, trunk, bridge, WLAN group, port, channel, AFC, and antenna settings. Setter-only families return planned payloads and an explicit warning when controller readback is unavailable. Requires apMac.
getSitesApsTrunkSetting	Get trunk port setting for an AP. Requires apMac.
getSitesApsBridge	Get bridge configuration for an AP. Requires apMac.
listSitesApsPorts	List ports for an AP. Requires apMac.
getSitesSwitchesEs	Get ES switch details. Requires switchMac.
getSitesSwitchesEsGeneralConfig	Get ES switch general configuration. Requires switchMac.
listSitesCableTestSwitchesPorts	List cable test port info for a switch. Requires switchMac.
listSitesCableTestSwitchesIncrementResults	Get incremental cable test results for a switch. Requires switchMac.
getUpgradeOverviewCritical	Get the number of critical models available for upgrade.
getUpgradeOverviewTryBeta	Get the current status of the try-beta firmware upgrade switch.
listUpgradeFirmwares	List available firmware packages for upgrade (paginated).
listUpgradeOverviewFirmwares	List firmware overview for upgradeable devices (paginated).
listSitesStacks	List switch stacks in a site (paginated).
getSitesDeviceWhiteList	Get the device adoption whitelist for a site (paginated).
getSitesGatewaysGeneralConfig	Get general configuration for a gateway. Requires gatewayMac.
getSitesGatewaysPin	Get PIN information for a gateway. Requires gatewayMac.
getSitesGatewaysSimCardUsed	Get SIM card usage info for a gateway. Requires gatewayMac.
getSitesHealthGatewaysWansDetails	Get gateway WAN health details. Requires gatewayMac.
setGatewayConfig	Updates documented gateway configuration families with dry-run preview. Covers general, services, advanced, radios, WLAN, and port settings. Setter-only families return planned payloads and an explicit warning when controller readback is unavailable. Requires gatewayMac.

Network

Tool	Description
getInternetInfo	Gets internet configuration information for a site.
getInternet	[DEPRECATED] Use getInternetInfo instead. Gets full WAN/Internet configuration for the site gateway.
getInternetBasicPortInfo	Gets WAN port summary/basic info for the site gateway.
getInternetLoadBalance	Gets WAN load balancing configuration (failover/load balance).
getWanPortsConfig	Gets per-port WAN configuration including connection type and IP settings.
getWanLanStatus	Gets WAN-LAN connectivity status for a site.
getGridVirtualWan	Gets virtual WAN list (paginated).
getIspBandScan	Gets ISP band scan results for a WAN port. Requires portUuid.
getDisableNatList	Gets the list of wired networks with NAT disabled (paginated).
getLtePortConfig	Gets LTE/cellular WAN port configuration.
getWanPortDetail	[DEPRECATED] Use getWanPortsConfig instead. Gets detailed WAN port configuration for all gateway WAN ports.
getWanIspProfile	Gets ISP scan profile result for a WAN port. Requires portUuid.
getWanQosConfig	Gets QoS configuration for gateway WAN ports.
getWanHealthDetail	[DEPRECATED] Alias for the WAN health tool; kept for backward compatibility. Requires gatewayMac.
getWanUsageStats	[DEPRECATED] Use getDashboardTrafficActivities instead. Gets WAN traffic usage statistics for the site.
getWanNatConfig	Gets one-to-one NAT rules (paginated).
getPortForwardingStatus	Gets port forwarding status and rules. Required: type (user or upnp). Optional pagination: page (default 1), pageSize (default 10).
getLanNetworkList	[DEPRECATED] Use getLanNetworkListV2 instead. This tool aggregates all pages; getLanNetworkListV2 is explicitly paginated.
getLanNetworkListV2	Get the LAN network list using the v2 API, with richer VLAN and DHCP data (paginated).
getInterfaceLanNetwork	Gets interface-level LAN network bindings. Optional type filter (0=WAN, 1=LAN).
getInterfaceLanNetworkV2	Get interface-level LAN network bindings (v2 API). Returns richer per-interface VLAN and network data.
getLanProfileList	Gets the list of LAN profiles configured in a site.
getApLoadBalance	[DEPRECATED] Use getSitesApsLoadBalance instead. Same endpoint, retained for backward compatibility. getSitesApsLoadBalance is the canonical tool name.
getApOfdmaConfig	[DEPRECATED] Use getSitesApsOfdma instead. Same endpoint, retained for backward compatibility. getSitesApsOfdma is the canonical tool name.
getMulticastRateLimit	Get multicast rate limit settings for a site.
getWlanGroupList	Gets the list of WLAN groups configured in a site.
getSsidList	Gets the list of SSIDs in a WLAN group.
getSsidDetail	Gets detailed information for a specific SSID. Required: wlanId and ssidId.
listAllSsids	Lists wireless SSIDs across all WLAN groups.
getFirewallSetting	Gets the site-global firewall settings returned by the official Omada firewall endpoint.
setFirewallSetting	Updates site firewall settings with dry-run preview using the official Omada Open API firewall endpoint.
setAclConfigTypeSetting	Updates the gateway ACL mode (through profiles or custom) with dry-run preview.
getVpnSettings	Gets VPN settings for a site.
listSiteToSiteVpns	Lists site-to-site VPN configurations.
listPortForwardingRules	[DEPRECATED] Use getPortForwardingList instead. Lists NAT port forwarding rules.
listOsgAcls	Lists gateway (OSG) ACL rules.
createGatewayAcl	Creates a gateway ACL rule with dry-run preview using the official Omada Gateway ACL schema.
updateGatewayAcl	Updates a gateway ACL rule with dry-run preview after confirming the ACL exists.
listEapAcls	Lists access point (EAP) ACL rules.
createEapAcl	Creates an EAP ACL rule with dry-run preview using the official Omada EAP ACL schema.
updateEapAcl	Updates an EAP ACL rule with dry-run preview after confirming the ACL exists.
deleteAcl	Deletes an ACL rule with dry-run preview after confirming the ACL exists.
listStaticRoutes	[DEPRECATED] Use getGridStaticRouting instead. This tool aggregates all pages; getGridStaticRouting returns a single paginated page.
getStaticRoutingInterfaceList	Gets available interfaces for static routing.
listPolicyRoutes	[DEPRECATED] Use getGridPolicyRouting instead. This tool aggregates all pages; getGridPolicyRouting is paginated.
getGridPolicyRouting	Gets policy routing rules (paginated).
getOspfProcess	Gets OSPF process configuration for the site gateway.
getOspfInterface	Gets OSPF interface configuration for the site gateway.
getVrrpConfig	Gets VRRP configuration for OSW devices.
getOspfNeighbors	Gets OSPF neighbor devices for the site gateway.
getGridOtoNats	Gets 1:1 NAT rules (paginated).
getAlg	Gets ALG (Application Layer Gateway) configuration.
getUpnpSetting	Gets UPnP setting for the site gateway.
getDdnsGrid	Gets DDNS entries (paginated).
getDhcpReservationGrid	Gets DHCP reservations (paginated).
createDhcpReservation	Creates a DHCP reservation after validating the target LAN and optional IP address.
updateDhcpReservation	Updates a DHCP reservation after validating the target LAN and optional IP address.
deleteDhcpReservation	Deletes a DHCP reservation by MAC address with a dry-run preview option.
getGridIpMacBinding	Gets IP-MAC binding entries (paginated).
getIpMacBindingGeneralSetting	Gets IP-MAC binding global toggle setting.
getBandwidthControl	Gets global bandwidth control configuration.
getGridBandwidthCtrlRule	Gets bandwidth control rules (paginated).
setBandwidthControlRule	Creates or updates a bandwidth control rule with dry-run preview after validating the target rule id plus referenced LAN and WAN identifiers.
deleteBandwidthControlRule	Deletes a bandwidth control rule with dry-run preview after confirming the rule exists.
getSessionLimit	Gets session limit global setting.
getGridSessionLimitRule	Gets per-rule session limit rules (paginated).
getSnmpSetting	Gets SNMP configuration (version, community string).
getLldpSetting	Gets LLDP global setting.
getRemoteLoggingSetting	Gets remote logging (syslog) configuration.
getDnsCacheDataList	Gets the DNS cache data list (paginated).
getIptvSetting	Gets IPTV service configuration for the site.
getNtpSetting	Gets NTP server configuration and synchronisation status.
getSyslogConfig	Deprecated; alias of getRemoteLoggingSetting for controller syslog configuration.
getAccessControl	Gets controller access control configuration.
setAccessControl	Updates portal access control settings with dry-run preview and schema validation for pre-auth and free-auth policy entries.
setAppControlRule	Creates or updates an application control rule with dry-run preview after validating the create/update payload shape, existing rule id, and referenced application ids.
deleteAppControlRule	Deletes an application control rule with dry-run preview after confirming the rule exists.
getDnsCacheSetting	Gets DNS cache setting.
getDnsProxy	Gets DNS proxy configuration.
getIgmp	Gets IGMP snooping and proxy setting.
getSwitchVlanInterface	Gets VLAN interface configuration for a specific switch. Requires switchMac.
getLanDnsRules	Gets LAN DNS rules for the site (paginated).
getLanProfileEsUsage	Gets EAP/switch device usage for a LAN profile. Requires profileId.
getLanClientCount	Gets client distribution breakdown across LAN segments.
listRadiusProfiles	Lists RADIUS authentication profiles.
listGroupProfiles	Lists group profiles (IP, MAC, or port groups).
getApplicationControlStatus	Gets application control status for a site.
getSshSetting	Gets SSH settings for a site.
listTimeRangeProfiles	Lists time range profiles.
getRateLimitProfiles	Gets the list of available rate limit profiles for bandwidth control.

Firewall & ACL

Tool	Description
getDot1xConfig	Get 802.1X switch port authentication setting. Alias for getSwitchDot1xSetting.
getRadiusProxyConfig	Get global RADIUS proxy configuration (controller-level, no siteId).
getApplicationAcl	[DEPRECATED] Get application control rules. Alias for getAppControlRules.

Firewall Traffic & QoS

Tool	Description
getGatewayQosClassRules	Get gateway QoS class rules (paginated).
getBandwidthCtrlDetail	Get bandwidth control details for a site.
getAppControlRules	Get application control rules (paginated).
getAppControlCategories	Get application control category list.
getUrlFilterRules	Get URL filter gateway rules. Alias for getGridGatewayRule.
getUrlFilterBlacklist	Get URL filter MAC deny list. Alias for getGridDenyMacFiltering.
getUrlFilterWhitelist	Get URL filter MAC allow list. Alias for getGridAllowMacFiltering.
getMacFilterDetail	Get MAC filter general setting. Alias for getMacFilteringGeneralSetting.
getQosPolicy	Get QoS policy configuration for a site.
getTrafficPriority	Get traffic priority rules for a site.
getTrafficStats	[DEPRECATED] Use getDashboardTrafficActivities instead. Get WAN usage statistics. Alias for getWanUsageStats.
getQosPolicyRule	[DEPRECATED] Alias for getQosPolicy.
getQosMarkingRule	[DEPRECATED] Alias for getQosPolicy.
getDscpConfig	[DEPRECATED] Alias for getQosPolicy.

Firewall IDS / IPS

Tool	Description
getGlobalSecuritySetting	[DEPRECATED] Use getThreatList instead. Get global security/threat management list. Alias for getThreatList.

Security & Threat Management

Tool	Description
getThreatList	Gets global threat management list. Required: archived (bool). Optional: startTime/endTime (seconds since epoch), severity (0=Critical, 1=Major, 2=Moderate/Concerning, 3=Minor, 4=Low), page, pageSize.
getTopThreats	Gets top threats from the global threat management view.

Composite Troubleshooting Tools

Single-call tools that internally aggregate multiple Omada API calls in parallel. Use these instead of chaining individual tools when you need a quick overview or are starting a troubleshooting session.

Tool	Description
getNetworkHealthSummary	Composite: combines dashboard overview (device/client counts), internet/WAN status, client distribution, and recent active threats into a single response. First call for any troubleshooting session.
getGatewayHealth	Composite: auto-discovers the gateway then fetches its detail (CPU, memory, firmware), WAN port statuses, LAN interface statuses, and port list in one call. Use for internet/WAN diagnostics.
diagnoseClient	Composite: given a client MAC, IP, or hostname — fetches current connection status, detailed client info (VLAN, signal, policy), and recent connection history in one call.
getSecurityOverview	Composite: combines active threat list (up to 20, newest first) and firewall settings into one response. Use for security posture checks or investigating alerts.

Dashboard / Monitor

Tool	Description
getDashboardWifiSummary	Gets WiFi summary from the site dashboard.
getDashboardSwitchSummary	Gets switch summary from the site dashboard.
getDashboardTrafficActivities	Gets traffic activity data from the site dashboard.
getDashboardPoEUsage	Gets PoE usage data from the site dashboard.
getDashboardTopCpuUsage	Gets top CPU usage data from the site dashboard.
getDashboardTopMemoryUsage	Gets top memory usage data from the site dashboard.
getDashboardMostActiveSwitches	Gets most active switches from the site dashboard.
getDashboardMostActiveEaps	Gets most active access points from the site dashboard.
getDashboardOverview	Get the site overview: device counts, client counts, connectivity graph, and overall health status.
getTrafficDistribution	Gets traffic distribution by protocol/app type over a time range. Requires start and end timestamps (seconds).
getRetryAndDroppedRate	Gets wireless retry rate and dropped packet rate over a time range. Requires start and end timestamps (seconds).
getIspLoad	Gets per-WAN ISP link load over a time range. Requires start and end timestamps (seconds).
getChannels	Gets channel distribution and utilization across all APs.
getInterference	Gets top RF interference sources detected by APs.
getGridDashboardTunnelStats	Gets VPN tunnel statistics. Required: type (0 = Server, 1 = Client).
getGridDashboardIpsecTunnelStats	Gets IPsec tunnel statistics.
getGridDashboardOpenVpnTunnelStats	Gets OpenVPN tunnel statistics by type. Requires type parameter.

Insight

Tool	Description
listSiteThreatManagement	Lists site-level threat management events.
getWids	Gets WIDS (Wireless Intrusion Detection) information for a site.
getRogueAps	Gets rogue access points detected in a site.
getVpnTunnelStats	Gets VPN tunnel statistics for a site.

VPN

Tool	Description
getIpsecTunnelList	List all site-to-site VPN (IPsec) tunnels. Alias for listSiteToSiteVpns.
getIpsecTunnelDetail	Get detailed config for a specific IPsec tunnel by ID. Alias for getSiteToSiteVpnInfo.
getAdvancedVpnSetting	Get advanced VPN configuration settings for a site. Alias for getVpnSettings.
getVpnUserList	Get VPN users for a site (paginated).
getVpnUserDetail	Get users for a specific client-to-site VPN server.
getVpnClientStatus	Get status of client-to-site VPN clients. Alias for listClientToSiteVpnClients.
getVpnRouteConfig	[DEPRECATED] Use getGridPolicyRouting instead. This tool aggregates all pages; getGridPolicyRouting is paginated.

Profiles

Tool	Description
getGoogleLdapProfile	Get Google LDAP profile configuration for a site.
getBuiltinRadiusUsers	Get built-in RADIUS server user list (paginated).
getRadiusUserDetail	[DEPRECATED] Alias for getBuiltinRadiusUsers.
getPpskNetworkProfile	List PPSK network profiles for a site by type.
getPpskUserGroup	Get PPSK user group details for a specific profile.
getPpskUserList	[DEPRECATED] Alias for getPpskUserGroup.
getServiceProfile	Get service type profiles (paginated). Alias for listServiceType.
getQosProfile	Get rate limit profiles. Alias for getRateLimitProfiles.
getScheduleProfile	Get time range profiles. Alias for listTimeRangeProfiles.
getGroupPolicyDetail	Get group policy profiles filtered by group type.
getIpGroupProfile	[DEPRECATED] Get IP group profiles. Alias for getGroupPolicyDetail with groupType="0".
getUrlGroupProfile	[DEPRECATED] Get URL/port group profiles. Alias for getGroupPolicyDetail with groupType="1".
getAppGroupProfile	[DEPRECATED] Get MAC group profiles. Alias for getGroupPolicyDetail with groupType="2".
getVlanProfile	Get LAN/VLAN profiles. Alias for getLanProfileList.
getUserRoleProfile	Get user role profiles from the controller (global, no siteId).
getPortalProfile	Get captive portal profiles for a site.

Logs

Tool	Description
listSiteEvents	Lists site event logs.
listSiteAlerts	Lists site alert logs.
listSiteAuditLogs	Lists site audit logs.
listGlobalEvents	Lists global event logs across all sites.
listGlobalAlerts	Lists global alert logs across all sites.

Controller

Tool	Description
getCertificate	Get SSL/TLS certificate configuration for the controller.
getClientHistoryDataEnable	Get the client history data collection enable setting.
getControllerPort	Get the controller port configuration for device adoption.
getDataRetention	Get data retention settings for the controller.
getExperienceImprovement	Get the experience improvement program setting (telemetry).
getGlobalDashboardOverview	Get global controller dashboard overview without client data.
getPortalPort	Get portal port configuration for the controller web interface.

Maintenance

Tool	Description
getBackupFileList	List available controller backup files.
getBackupResult	Get the result of the most recent controller backup operation.
getRestoreResult	Get the result of the most recent controller restore operation.
getSiteBackupFileList	List available backup files for a site.
getSiteBackupResult	Get the backup result for a site.
getRogueApExport	Export Rogue AP scan results for a site in CSV or Excel format.
backupController	Trigger a controller configuration backup to the self/cloud server.
backupControllerToFileServer	Trigger a controller configuration backup to an external file server (FTP/SFTP).
restoreController	Restore controller configuration from a backup file on the self/cloud server.
restoreControllerFromFileServer	Restore controller configuration from a backup file on an external file server.
backupSites	Trigger a multi-site configuration backup to the self/cloud server (up to 300 sites).
backupSitesToFileServer	Trigger a multi-site configuration backup to an external file server (up to 300 sites).
restoreSites	Restore multiple site configurations from backup files on the self/cloud server.
restoreSitesFromFileServer	Restore multiple site configurations from backup files on an external file server.

Account Users

Tool	Description
getAllCloudUsers	List all cloud users on the controller, excluding the root account.
getAllLocalUsers	List all local users on the controller, excluding the root account.
getAllRoles	[DEPRECATED] Use getUserRoleProfile instead. List all user roles configured on the controller.
getAllUsersApp	List all users (cloud and local) in grid view.
getAvailableRoles	List roles available for user assignment.
getRoleDetail	Get detailed information about a specific role. Requires roleId.

Account Cloud

Tool	Description
getCloudAccessStatus	Get cloud access status for the controller.
getCloudUserInfo	Get cloud user account information.
getMfaStatus	Get global MFA (multi-factor authentication) status.
getRemoteBindingStatus	Get remote binding status between controller and cloud.

Schedules

Tool	Description
getPoeScheduleList	List PoE schedules for a site.
getPortScheduleList	List port schedules for a site.
getPortSchedulePorts	List ports with port schedule assignments for a site.
getRebootScheduleList	List device reboot schedules for a site template. Requires siteTemplateId.
getUpgradeScheduleList	List firmware upgrade schedules for a site.

Supported Omada API Operations