How to Manage UniFi Networks with an OpenClaw Agent on Raspberry Pi

Running a UniFi network at home or in a small office means regular visits to the UniFi dashboard. You check which clients are connected, restart a misbehaving access point, block a device that shouldn't be on the network, or toggle a guest WiFi network on and off. Each of these tasks requires logging into the web interface, navigating to the right section, finding the right device or setting, and clicking through confirmation dialogs.

For a single network with a handful of devices, that's manageable. For anyone running a UniFi setup with multiple access points, managed switches, and dozens of clients, the overhead adds up. The dashboard is well-designed, but it's still a GUI built for humans clicking through menus.

OpenClaw changes that equation. It's an AI agent framework that runs on a Raspberry Pi and connects to cloud LLMs like Claude, GPT-4, or Gemini for reasoning. The Pi itself handles orchestration: scheduling tasks, making API calls, and routing responses. The intelligence comes from the cloud model.

The ez-unifi skill, available in the OpenClaw skills marketplace, gives your agent direct access to UniFi controller functions. Instead of opening a browser and navigating through menus, you tell the agent what you want in plain English. "Show me all offline devices." "Block the smart TV from the network." "Restart the garage access point." The agent translates that into API calls against your UniFi controller and reports back with structured results.

Here's how manual dashboard tasks compare to their OpenClaw equivalents:

The time savings compound. Every interaction that takes 30 seconds of clicking becomes a single sentence. For network administrators who check on their infrastructure daily, that's hours saved per month.

You need two things: a Raspberry Pi running OpenClaw, and a UniFi controller that the agent can talk to. The UniFi controller can run on the same Pi, on a separate device, or on Ubiquiti hardware like a Cloud Key or Dream Machine.

Raspberry Pi for OpenClaw

OpenClaw's official documentation lists the minimum as 1GB RAM, one CPU core, 500MB free disk, and a 64-bit OS. For comfortable daily use, a Pi 4 with 4GB RAM is the recommended sweet spot. A Pi 5 with 8GB gives the best performance, though OpenClaw doesn't run models locally, so the extra headroom mainly helps if you're also running other services.

Flash Raspberry Pi OS Lite (64-bit) to your storage. The Lite variant has no desktop environment, which saves resources for a headless agent server. Use a USB SSD instead of an SD card for reliability in always-on deployments.

UniFi controller options

The ez-unifi skill works with UDM Pro/SE, Dream Machine, Cloud Key Gen2+, and self-hosted controllers. If you're already running a UniFi Dream Machine or Cloud Key, you don't need a separate controller installation. The agent connects to whatever controller you already have.

If you want to self-host the controller on the same Pi that runs OpenClaw, it's doable. The UniFi Network Application typically uses 300 to 500MB of RAM during operation. On a Pi 4 with 4GB, that leaves plenty of headroom for OpenClaw and Node.js. On a 2GB Pi, things get tight. You'll want to configure Java and MongoDB memory limits to keep the controller from consuming everything:

• Set unifi.xms=256 and unifi.xmx=512 to cap Java heap usage
• Set db.mongo.wt.cache_size=100 to limit MongoDB's cache to 100MB

The controller needs Java 17+ and MongoDB. Installation guides are available from Ubiquiti and community resources, but controller installation is outside the scope of this guide. The focus here is on the OpenClaw agent that manages the controller.

Network connectivity

Both the Pi and the UniFi controller need to be on the same network, or at least able to reach each other over HTTPS. The ez-unifi skill communicates with the controller's API, which runs on the controller's IP address over port 443 (for UDM devices) or port 8443 (for self-hosted controllers).

Start by SSHing into your Raspberry Pi. Update packages and install prerequisites:

sudo apt update && sudo apt upgrade -y
sudo apt install -y git curl build-essential

Install Node.js 24 from the NodeSource repository. OpenClaw requires a recent Node.js release:

curl -fsSL https://deb.nodesource.com/setup_24.x | sudo bash -
sudo apt install -y nodejs

If your Pi has 2GB of RAM or less, configure swap space before installing OpenClaw. A 2GB swap file prevents out-of-memory crashes during npm package compilation:

sudo fallocate -l 2G /swapfile
sudo chmod 600 /swapfile
sudo mkswap /swapfile
sudo swapon /swapfile
echo '/swapfile none swap sw 0 0' | sudo tee -a /etc/fstab

Install OpenClaw using the official installer:

curl -fsSL https://openclaw.ai/install.sh | bash

The installer takes about 3 to 5 minutes. It sets up the OpenClaw daemon, configures the service, and runs an onboarding wizard that asks for your preferred cloud AI provider. Choose whichever provider you have API access to. Claude Sonnet or GPT-4 both work well for network management tasks.

Once OpenClaw is running, install the ez-unifi skill from the skills marketplace:

claw install araa47/ez-unifi

Configuring UniFi credentials

The ez-unifi skill needs five environment variables to connect to your controller. Before setting these, create a dedicated local admin account on your UniFi controller. Open the controller's web interface, go to Settings, then System, then Admins & Users. Click Add Admin and create a new local account (for example, username agent-api) with a strong password. Using a dedicated account lets you track agent activity separately in your controller's logs.

Set the environment variables in your OpenClaw configuration:

UNIFI_HOST=https://192.168.1.1
UNIFI_USERNAME=agent-api
UNIFI_PASSWORD=your_secure_password
UNIFI_SITE=default
UNIFI_IS_UDM=true

Set UNIFI_IS_UDM=true if you're using a Dream Machine, UDM Pro, or UDM SE. Set it to false for Cloud Key Gen1, Cloud Key Gen2+, or self-hosted controllers. The UNIFI_SITE value is default for most single-site deployments. If you manage multiple sites, specify the site name from your controller.

Verify the connection by asking the agent a simple question:

"List all network devices"

If the credentials and network path are correct, you'll see a structured list of your access points, switches, gateways, and any other UniFi hardware on your network.

Persist your network reports across agent sessions

Free 50GB workspace with auto-indexing, MCP endpoint, and audit trail for every file your UniFi agent generates. No credit card, no expiration.

Start 14-Day Trial

The ez-unifi skill covers the most common UniFi management tasks. It uses the aiounifi library to communicate with the controller's API, translating natural language requests into structured API calls. Here's what each capability area looks like in practice.

Device management

The agent can list all devices on your network with their status, model, firmware version, and uptime. You can restart individual devices by name or type ("restart the office switch"), upgrade firmware on devices with pending updates, and locate a specific device by triggering its LED. For managed switches, you can query individual port status and control PoE power on specific ports, which is useful for remotely power-cycling PoE-powered devices like cameras or access points.

Client monitoring and control

Ask the agent which clients are connected, and it returns a list with device names, IP addresses, signal strength, and current traffic rates. You can block or unblock specific clients by name or MAC address. This is practical for quick security responses: if you spot an unknown device, a single command removes it from the network.

WiFi network management

The skill can list all configured WiFi networks (SSIDs) and toggle them on or off. "Disable the guest network" or "Enable the IoT SSID" translates directly into API calls. This is useful for scheduled network management or quick responses to security concerns.

Traffic and health monitoring

The agent reports network health metrics including uptime, throughput, latency, and packet loss across your WAN, LAN, and WLAN subsystems. It can break down bandwidth usage by application using UniFi's Deep Packet Inspection (DPI) data, showing you which apps or services consume the most bandwidth. Active alerts and recent events from the controller's log are also accessible.

Guest voucher management

If you run a guest network with voucher-based access, the agent can create vouchers with configurable duration. "Create a 24-hour guest voucher" generates a code your visitors can use to get online without you sharing your main WiFi password.

Traffic rules

The skill includes traffic rule management, letting the agent create or modify rules that control how traffic flows through your network. This covers basic firewall-like functionality accessible through conversation instead of the controller's rule editor.

What it doesn't do

The ez-unifi skill focuses on operational tasks. It won't redesign your network topology, configure VLANs from scratch, or set up complex firewall rules with multiple conditions. Think of it as handling the daily operations you'd otherwise do through the dashboard, not the initial network architecture that you set up once and rarely change.

An agent that answers questions when you ask is useful. An agent that logs reports automatically and shares them with your team is more useful. By connecting your OpenClaw agent to a cloud workspace, you can store network health snapshots, device inventories, and incident logs where anyone on your team can access them.

Local storage on the Pi works for personal use, but it has limits. SD cards and even USB SSDs on a Pi aren't backed up by default. If the Pi dies, your logs go with it. And if multiple people need to see the network reports, sharing files off a Raspberry Pi isn't practical.

Cloud storage options

You could push reports to S3, Google Drive, or a self-hosted NAS. Each requires its own authentication setup, API integration, and file management logic. S3 is reliable but needs IAM configuration. Google Drive's API has OAuth complexity that's overkill for log files.

Fastio provides a workspace designed for agent-generated output. The Business Trial includes 50GB of storage, included credits, and 5 workspaces with no credit card required. The MCP server at mcp.fast.io exposes workspace, storage, AI, and workflow tools that an OpenClaw agent can call directly.

What this looks like in practice

Configure your OpenClaw agent with the Fastio MCP skill. Schedule a daily network health check that runs the ez-unifi device listing and health commands, formats the output as a report, and uploads it to a dedicated workspace. Each report gets timestamped and versioned automatically.

When something goes wrong, the agent can capture the incident details, the list of affected devices, the error events from the controller log, and upload everything to the workspace in one operation. Your team sees the report immediately through the Fastio web interface or API without needing SSH access to the Pi.

Fastio's Intelligence Mode auto-indexes uploaded files for semantic search. After a few weeks of daily reports, you can ask questions like "When was the last time the office AP went offline?" and get answers with citations pointing to the specific report. That's not something you get from a folder of JSON files on an SD card.

For teams managing multiple sites, each site's agent can write to the same workspace. The audit trail shows which agent uploaded which report, and workspace permissions control who can view or modify the data. When the network management project is complete or changes hands, ownership transfer moves the entire workspace to a new administrator while the original agent retains admin access.

Once the agent is running and connected to both your UniFi controller and a cloud workspace, here are some workflows that save real time.

Morning network check

Set the agent to run a health summary every morning before you start work. It checks device status, flags anything offline, reports the client count, and notes any active alerts. You get a one-paragraph summary instead of opening the dashboard and scanning through tabs.

Automated PoE cycling for stuck cameras

IP cameras powered by PoE occasionally freeze and need a power cycle. Instead of walking to the switch or navigating the dashboard, the agent can disable and re-enable PoE on the specific switch port. Combine this with a monitoring check: if the camera stops responding to pings, the agent cycles its PoE port and verifies it comes back online.

Guest event management

Hosting an event and need temporary WiFi access? Ask the agent to create a batch of guest vouchers with a specific duration. When the event ends, disable the guest SSID entirely. No dashboard navigation required.

Bandwidth investigation

"Which devices are using the most bandwidth right now?" The agent queries DPI data and returns a breakdown by client and application. Useful for tracking down the device that's saturating your upload during a video call.

Firmware management

Rather than checking each device individually for pending updates, ask the agent to list all devices with available firmware upgrades. If you want to proceed, tell it to upgrade specific devices or all of them. The agent handles the API calls and can report back on upgrade status.

Troubleshooting common issues

If the agent can't connect to the controller, verify these items first:

• The UNIFI_HOST URL is reachable from the Pi (try curl -k https://your-controller-ip)
• The credentials match a local admin account, not a Ubiquiti SSO account
• The UNIFI_IS_UDM flag matches your hardware (UDM devices use a different API path than Cloud Key or self-hosted controllers)
• Port 443 (UDM) or 8443 (self-hosted) is accessible from the Pi's network

If commands work but responses are slow, check the Pi's resource usage with htop. If the UniFi controller is also running on the same Pi, memory pressure could slow both services. Consider moving the controller to dedicated hardware or a Cloud Key, and keeping the Pi focused on running the OpenClaw agent.

If the agent returns errors for specific commands like PoE control or traffic rules, verify that your dedicated admin account has sufficient permissions. Some controller features require admin-level access rather than read-only or limited roles.