I’ve been running UniFi networks for clients and in my own home lab for years now. And while UniFi OS is great, there are some things I’ve always wanted that it just doesn’t do out of the box.
So I built them into the UI Toolkit.
UI Toolkit is a free, open-source web application that sits alongside your UniFi controller and gives you monitoring and tracking capabilities that Ubiquiti doesn’t provide natively. It’s self-hosted, runs on Docker or bare metal, and works with pretty much any UniFi setup—UDM, UCG, Cloud Key, self-hosted controller, you name it.
Let’s talk about what’s inside.
Wi-Fi Stalker
This one started as a personal itch I needed to scratch. I wanted to know when specific devices connected to my network, which access point they were on, and when they roamed.
Wi-Fi Stalker lets you track specific devices by MAC address. Not every device on your network—just the ones you care about. You add a device, give it a friendly name, and the tool monitors it in the background.
What you get:
- Real-time online/offline status for each tracked device
- Which AP (or switch port) the device is currently connected to
- Roaming detection—see when a device moves from one AP to another
- Full connection history with timestamps and durations
- Block and unblock devices right from the interface
- Webhook alerts for connect, disconnect, roam, block, and unblock events
The practical use case? Track employee devices during work hours. Know when your teenager’s phone connects to the network. Debug a client device that keeps dropping off. I’ve found it surprisingly useful for troubleshooting roaming issues—you can see exactly when a device jumped APs and how long it stayed connected.
Threat Watch
If you’re running a UDM, UCG, or any UniFi gateway with IDS/IPS capability, this one’s for you.
Threat Watch pulls IDS/IPS events from your gateway and presents them in a clean dashboard. You get severity indicators, category breakdowns (malware, exploits, scans, etc.), and a list of your top attackers.
What you get:
- Real-time event feed with severity levels (high, medium, low)
- Filter by blocked vs. detected events
- Top attackers analysis—see which IPs are hitting you the most
- Category breakdown so you know what types of threats you’re seeing
- Webhook alerts for new threats
If you’re running a UniFi Express, or any other gateway that doesn’t have IDS/IPS capability this tool won’t work for you. The Express doesn’t have IDS/IPS capability. Threat Watch will detect that and let you know. Same goes if you have a capable gateway but haven’t enabled IDS/IPS in your settings—it’ll tell you to turn it on.
***NOTE: I really need folks to test out the Threat Watch tool. Every time I test it in a demo environment, I get zero statistics – nothing. I’m not sure if my tool needs to be fixed, or if the UniFi API doesn’t work well, or if IDS/IPS itself is broken – I would love to crowdsource some of that testing to know for sure.
Network Pulse
This is your at-a-glance network monitoring dashboard. It gives you the kind of overview that’s helpful when you just want to know what’s going on without digging through the UniFi controller.
What you get:
- Gateway status—model, firmware version, uptime, WAN status
- Device counts—total clients, wired, wireless, number of APs and switches
- Current bandwidth throughput (TX and RX)
- Charts showing clients by band (2.4 GHz, 5 GHz, 6 GHz, wired)
- Charts showing clients by SSID
- Top bandwidth consumers—see who’s using the most data
- Clickable AP cards that show you exactly which clients are connected to each access point
The AP detail pages are particularly useful. Click on any access point and you get a breakdown of every client on that AP—their name, IP, SSID, band, signal strength, and bandwidth usage. Great for figuring out if one AP is overloaded or if a client is getting poor signal.
Everything updates in real-time via WebSocket, so you’re not constantly refreshing.
The Technical Stuff
UI Toolkit runs as a single Docker container (or you can run it directly with Python if you prefer). It connects to your UniFi controller using either username/password or an API key (preferred), and it stores data in a local SQLite database.
Requirements:
- Docker (recommended) or Python 3.9-3.12
- Access to your UniFi controller
- A UniFi gateway for Threat Watch (UDM, UCG, UXG, or USG series)
There’s an interactive setup wizard that walks you through configuration, and the whole thing can be up and running in about five minutes.
It supports both local deployment (no authentication, for trusted LAN environments) and production deployment with HTTPS and login protection via Caddy.
It’s Free and Open Source
I’m releasing this as a free, open-source project. The code is available on GitHub, and you can run it on your own hardware.
If you’re a UniFi user who’s ever wanted more visibility into your network—device tracking, threat monitoring, or just a cleaner dashboard—give it a try.
GitHub: https://github.com/Crosstalk-Solutions/unifi-toolkit
Questions? Hit me up in the comments or join the Crosstalk Discord community. We have a #unifi-toolkit channel for discussing this project.
This project is not affiliated with, endorsed by, or sponsored by Ubiquiti Inc. UniFi is a trademark of Ubiquiti Inc.
Comments 2
Love your work and absolute thorough attention to detail!
Thank you buddy for the app, downloading it today. Glad to see you always working!