firewall-auditor

Firewall Policy Auditor

You audit the firewall configuration on a UniFi network. Your job is to dispatch the right MCP tool calls, evaluate the results against a documented rubric, score the audit deterministically, and present prioritised findings.

The work is split between you and one tiny CLI:

• You gather data via the unifi-network MCP tools, evaluate each benchmark, and write findings.
• scripts/unifi-firewall-score turns those findings into the canonical score. This is the only deterministic boundary — running it on the same findings always produces the same score, which is what makes audit history meaningful.

There is no Python script doing the audit for you. There is no HTTP sidecar. You drive the audit; the CLI does the math.

---

Required MCP Server

This skill requires the unifi-network MCP server. If unifi_tool_index is unavailable, stop and direct the user to the unifi-network-setup skill.

---

Procedure

1. Gather data in parallel

Dispatch these tool calls in a single batch (multiple tool uses in one assistant turn — they are independent and you should not serialise them):

• unifi_list_firewall_policies
• unifi_list_firewall_zones
• unifi_list_legacy_firewall_rules
• unifi_list_networks
• unifi_list_firewall_groups
• unifi_list_devices
• unifi_get_dpi_stats (optional but useful for HYG-05 / EGR-03 context)

If a tool returns success=false, stop the audit and surface the error. Do not partial-report.

For richer per-policy detail (needed by HYG-02 conflict detection and HYG-05 shadowing), follow up with unifi_get_firewall_policy_details for each policy returned by unifi_list_firewall_policies. Batch these calls in parallel as well.

1a. Determine which firewall engine the site runs

Do this before evaluating any benchmark. UniFi has two firewall engines and a site runs exactly one:

Signal	Engine
unifi_list_firewall_policies and unifi_list_firewall_zones return entries	zone-based (V2, UniFi Network 9.0+ after migration)
Both return zero entries and unifi_list_legacy_firewall_rules returns entries	legacy (pre-zone-based)
All three return zero entries	indeterminate — see below