hetzner-dns-mcp

hetzner-dns-mcpYour DNS, through the assistant

An MCP server for the Hetzner Cloud DNS API — 22 tools for zones, record sets, zone files, TTLs and protection, and a person asked before anything that decides who answers for a name.

Get started
Tool reference
View on GitHub

  • Zones and record sets

    List, create, update and delete zones and RRSets, import and export BIND zone files, change TTLs and protection, and follow the asynchronous zone actions that Hetzner queues behind them.

  • Destructive calls ask a person

    Deleting a zone or replacing a record set raises a real dialog through MCP elicitation — one the model cannot answer on its behalf. Where the client cannot show one it falls back to a random, single-use token that exists only in a previous tool result, so nothing hidden inside a DNS record can produce it, and says which of the two it was rather than implying somebody approved.

  • Nothing upstream is trusted

    Record values, comments and zone files come back wrapped as untrusted data, secret-looking keys are redacted, oversized values are truncated and HTML error pages are dropped instead of pasted into the context.

  • Only the tools you want

    HETZNER_READ_ONLY=true registers the seven read tools and nothing else. HETZNER_ALLOW_TOOLS cuts finer — essential for a curated eight, your own comma-separated list, or a whole family with list_* — and HETZNER_DENY_TOOLS subtracts. Whatever is filtered out does not exist on the protocol rather than failing when called, and a name that matches no tool stops the server at startup instead of quietly going missing.

The confirmation flow, in 15 seconds ​

Listing the tools, a refused set_records call, and the same call succeeding with the confirmation token it returned — the fallback path, as a client that cannot show a dialog sees it

How it fits together ​

Architecture of hetzner-dns-mcpAn MCP client speaks JSON-RPC over stdio to hetzner-dns-mcp, which validates arguments, puts destructive calls to a person first, and calls the Hetzner Cloud API over HTTPS. Responses pass back through a sanitizer.MCP clientClaude Code, Desktop,Codex, Inspectorhetzner-dns-mcpzod schemas · path guardsasks a personredact · truncate · markHetzner Cloudapi.hetzner.cloud/v1/zonesstdioresultsHTTPSJSON
Arguments are validated before they reach a URL; results are sanitized before they reach the model.

In one command ​

bash
claude mcp add hetzner-dns -s user \
  -e HETZNER_API_TOKEN=your-token \
  -- npx -y hetzner-dns-mcp

Then ask for what you want — "what does the www record for example.com point at?", "add an AAAA record for the new host", "export the zone file before we touch anything". See Getting started for the token, and Connecting clients for Claude Desktop, Codex, the Inspector and Docker.

Running it elsewhere ​

A client that cannot spawn a local process — ChatGPT connectors, Claude on the web, Cursor, LibreChat — cannot start hetzner-dns-mcp the way Claude Code does. mcp-hub is the bridge: one container serves many stdio MCP servers over Streamable HTTP, with an OAuth 2.1 login behind a single password and long-lived tokens for the clients that cannot do OAuth. Its /hub endpoint puts every server behind six meta-tools, so one connector reaches all of them without N×tool schemas in the model's context, and it speaks both protocol revisions — a question this server asks travels through it to the person at the far end instead of ending at the gateway.

Its configuration is Claude Code's mcpServers format, so the entry you already have is the entry it takes: Through mcp-hub.

Released under the MIT License.

Copyright © 2026 Willi Thiel