hetzner-dns-mcp

Appearance

hetzner-dns-mcpYour DNS, through the assistant

An MCP server for the Hetzner Cloud DNS API — 22 tools for zones, record sets, zone files, TTLs and protection, with a confirmation token in front of everything irreversible.

Get started
Tool reference
View on GitHub

  • Zones and record sets

    List, create, update and delete zones and RRSets, import and export BIND zone files, change TTLs and protection, and follow the asynchronous zone actions that Hetzner queues behind them.

  • Destructive calls need a token

    Deleting a zone or replacing a record set is refused on the first call and answered with a random, single-use token — one that exists only in a previous tool result, so nothing hidden inside a DNS record can produce it.

  • Nothing upstream is trusted

    Record values, comments and zone files come back wrapped as untrusted data, secret-looking keys are redacted, oversized values are truncated and HTML error pages are dropped instead of pasted into the context.

  • Read-only when you want it

    HETZNER_READ_ONLY=true registers the seven read tools and nothing else — the write tools do not exist on the protocol, rather than failing when called.

The two-step flow, in 15 seconds ​

Listing the tools, a refused set_records call, and the same call succeeding with the confirmation token it returned

How it fits together ​

Architecture of hetzner-dns-mcpAn MCP client speaks JSON-RPC over stdio to hetzner-dns-mcp, which validates arguments, gates destructive calls behind a confirmation token, and calls the Hetzner Cloud API over HTTPS. Responses pass back through a sanitizer.MCP clientClaude Code, Desktop,Codex, Inspectorhetzner-dns-mcpzod schemas · path guardsconfirmation tokensredact · truncate · markHetzner Cloudapi.hetzner.cloud/v1/zonesstdioresultsHTTPSJSON
Arguments are validated before they reach a URL; results are sanitized before they reach the model.

In one command ​

bash
claude mcp add hetzner-dns -s user \
  -e HETZNER_API_TOKEN=your-token \
  -- npx -y hetzner-dns-mcp

Then ask for what you want — "what does the www record for example.com point at?", "add an AAAA record for the new host", "export the zone file before we touch anything". See Getting started for the token, and Connecting clients for Claude Desktop, Codex, the Inspector and Docker.

Released under the MIT License.

Copyright © 2026 Willi Thiel