Skip to main content
Glama

create_hetzner_cluster

Destructive

Create and provision a new Kubernetes cluster on Hetzner Cloud. Requires a Hetzner API credential, at least one SSH key credential, and a datacenter location. Optionally configure GitOps by providing a git credential name and repository: GitHub by default, or Bitbucket Cloud with gitops_provider 'bitbucket_cloud'. Optionally provide node_groups to create heterogeneous worker pools instead of a single homogeneous worker pool defined by worker_count and worker_server_type. The cluster will begin provisioning immediately after creation. Use list_provider_credentials to find credential IDs, list_instance_types for server sizes and list prices (it does not show per-location stock: omit the server types to let the platform pick ones the location can provision), and list_gitops_credentials/list_gitops_repositories for GitOps setup.

Input Schema

NameRequiredDescriptionDefault
nameYesCluster name. Must be unique within the organisation.
locationYesHetzner datacenter location (e.g., 'fsn1', 'nbg1', 'hel1', 'ash').
descriptionNoOptional cluster description.
node_groupsNoOptional heterogeneous worker pools. When provided, worker_count and worker_server_type are ignored. Each entry creates `count` workers of the given `instance_type` with the given labels and taints.
distributionNoKubernetes distribution. Default: 'kubeadm' (vanilla upstream Kubernetes with Cilium). 'k3s' is the lightweight alternative.
worker_countNoNumber of worker nodes when node_groups is not provided. Must be at least 1 unless node_groups is supplied. Default: 1.
credential_idYesUUID of the Hetzner API credential. Get from list_provider_credentials with provider='hetzner'.
gitops_branchNoGit branch for GitOps. Default: 'master'.
gitops_providerNoProvider of the GitOps repository: 'github' (the default when omitted) or 'bitbucket_cloud'. Pass the credential's provider from list_gitops_credentials.
gitops_repo_slugNoBitbucket Cloud repository slug of the GitOps repository (from list_gitops_repositories). Only with gitops_provider 'bitbucket_cloud', together with gitops_workspace.
gitops_workspaceNoBitbucket Cloud workspace of the GitOps repository (from list_gitops_repositories). Only with gitops_provider 'bitbucket_cloud', together with gitops_repo_slug.
gitops_repositoryNoGitOps repository: 'owner/repo' on GitHub (e.g., 'org/repo'), 'workspace/repo_slug' on Bitbucket Cloud. Requires gitops_credential_name.
include_networkingNoInclude networking stack (Traefik + cert-manager) configured for hcloud. Default: true, matching the portal create default.
kubernetes_versionNoVersion for the chosen distribution. With the default distribution (kubeadm) pass a plain upstream tag such as v1.36.4, from list_kubernetes_versions with engine 'kubeadm'. With distribution 'k3s' pass a k3s build such as v1.35.7+k3s1, from engine 'k3s' (a bare patch resolves to its newest +k3sN build). A +k3sN build without distribution 'k3s' is refused. Omit it to install the catalogue's stable version for the distribution.
worker_server_typeNoHetzner server type for worker nodes when node_groups is not provided. Omit it and the platform picks the cheapest x86 type the location can provision right now with at least 2 vCPU and 4 GB. The create result names the type it picked.
bastion_server_typeNoHetzner server type for the bastion host. Omit it and the platform picks the cheapest x86 type the location can provision right now with at least 2 vCPU and 4 GB: Hetzner stock varies per location, so there is no fixed default. The create result names the type it picked. An explicit type that the location cannot provision is refused with the available alternatives.
control_plane_countNoNumber of control plane nodes (1 or 3 for HA). Default: 1.
ssh_key_credential_idNoUUID of the primary SSH key credential. Either this or ssh_key_credential_ids must be provided. Get from list_provider_credentials with provider='ssh-key'.
gitops_credential_nameNoName of the git credential for GitOps (from list_gitops_credentials), GitHub or Bitbucket Cloud. Requires gitops_repository, or for Bitbucket Cloud gitops_workspace and gitops_repo_slug.
ssh_key_credential_idsNoOptional list of additional SSH key credential UUIDs to authorise on the cluster servers. Use this to grant multiple users access. Each value must be a UUID returned by list_provider_credentials with provider='ssh-key'.
control_plane_server_typeNoHetzner server type for control plane nodes. Omit it and the platform picks the cheapest x86 type the location can provision right now with at least 4 vCPU and 8 GB. The create result names the type it picked.

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=false, idempotentHint=false and destructiveHint=true, so the write/non-idempotent profile is covered structurally. The description adds genuinely new behavioral context beyond that: "The cluster will begin provisioning immediately after creation," i.e. no dry-run or confirmation step and side effects start at once. It stops short of covering cost implications or how the resource is later torn down, so it is not quite a 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Five dense sentences with no filler, ordered from what the tool does to prerequisites to optional behavior to immediate side effects to prerequisite-lookup tools. For a 21-parameter tool this is an appropriately sized, front-loaded introduction.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description carries the return-value burden and does not describe the create result (though the schema notes the result names auto-picked server types). It otherwise covers prerequisites, optional modes, and immediate provisioning for a large, complex creation tool. The main remaining gap is the absence of any lifecycle/cost framing (e.g. cleanup via delete_cluster, billing impact).

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3 and the schema already documents defaults, enums and UUID sources. The description still adds cross-parameter meaning the schema only implies per-field: node_groups replacing worker_count/worker_server_type, GitOps defaulting to GitHub unless gitops_provider is 'bitbucket_cloud', and the guidance to omit server types so the platform selects location-provisionable ones. That is a modest but real increment over the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb+resource+provider ("Create and provision a new Kubernetes cluster on Hetzner Cloud"), which cleanly separates it from the many sibling cluster-creation tools (create_aws_cluster, create_digitalocean_cluster, create_proxmox_cluster, create_managed_cluster). It also enumerates the distinguishing capabilities (GitOps, heterogeneous node groups) that an agent needs to match the request to this tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It states the prerequisites explicitly (Hetzner API credential, at least one SSH key credential, a datacenter location) and then routes the agent to the exact prerequisite-lookup siblings: list_provider_credentials, list_instance_types, list_gitops_credentials and list_gitops_repositories, each with the reason to call it. It even flags a caveat about list_instance_types not showing per-location stock, which is real when-to-use guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources