bunny-mcp

MCP server for Bunny.net — pull zones, DNS, storage, video streaming, edge scripting, Shield/WAF and Magic Containers, from an AI assistant.

A hardened fork of anvme/bunnycdn-mcp (MIT). Two things differ, and both exist because pointing the upstream at a real Bunny account publishes credentials.

Part of the Aura Design Engine

These are the skills behind Aura — one AI web-agency lifecycle you can run standalone or orchestrate across a whole client fleet from a single dashboard.

→ Orchestrate all of it across your client fleet with Aura — governed agent ops with approvals and a full audit trail on top of these skills.

Related MCP server: Cloudflare Control

What the fork changes

1. Responses are projected through an allow-list

Bunny returns credentials inline with ordinary metadata:

Handing those to a model puts them in its context, its logs and its transcript. So no tool ever sees them: every response passes through lib/project.js at the HTTP layer, keyed by request path, and only the fields named there survive.

It is an allow-list, not a deny-list. Stripping known secret names fails the moment Bunny adds a field — the new one ships in the clear and nothing tells you. Naming what may pass fails the other way: a new field is invisible until someone decides it is safe.

It fails closed. A path with no declared shape returns no data and an error naming the path, rather than the raw payload.

It applies inside a value, not only to it. A URL keeps scheme, host, port and path; userinfo, query and fragment go. The first version of that scrubber removed user:password@ and kept the rest — a deny-list wearing a scrubber's coat, which closed the one place a credential was known to sit and let ?token=… walk through. And a free-form bag is a bag whether it arrives as an object or a string: CustomHTML is dropped for the same reason metaTags is.

It does not vet structure by naming its parent. A bare field name may only carry a scalar, or an array of them; an object survives only where a nested shape is declared for it. Every leak found while reviewing this fork lived one level below a name someone had already vetted — Hostnames looked safe and held the TLS private key; EdgeRules was given a shape and ExtraActions inside it still carried the very parameter that shape existed to drop.

2. Write tools are withheld unless you ask for them

BUNNY_READONLY defaults to on. In that mode the write-capable tools are never registered — absent from tools/list, not merely annotated as risky. An agent cannot call a tool it cannot see, and the MCP destructiveHint is advice to a client, not a control.

The gate fails closed: a tool is registered in read-only mode only if it declares readOnlyHint: true. A new tool whose author forgot its annotations counts as a writer and is withheld.

BUNNY_READONLY=0   # register the write tools too — 0/false/no/off, nothing else

Errors are projected too

A non-2xx response never reaches the response interceptor — axios routes it to the rejection handler — so error bodies get their own boundary. Bunny quotes submitted values back in validation messages, and what these tools submit includes edge-script secrets, so the rule keys on the request: a request that carried no body cannot have its own payload echoed at it and keeps its message; a request that carried one has the message withheld, with the status and ErrorKey still saying what went wrong.

Diagnostics keep the sentence and lose the target

An origin error log and a transcoding failure both quote the request that failed, and that request is the one an operator signs. Those fields are kept — a diagnostic that will not say what failed is not worth returning — but the target inside them is withheld whole, not edited:

failed fetching https://svc:pw@origin/x?token=secret after 10s
                              ↓
failed fetching (withheld: URL) after 10s

A whitespace-delimited token is withheld when it carries an @, or a ?/# with anything attached to it — either side. That is what separates a query or fragment from ordinary punctuation: why? because has a space after the mark, while callback?token=secret and a bare #access_token=x do not. Nothing is parsed, so there is no interior for a new URL shape to hide in — nine review findings were spent teaching an earlier reducer the shapes prose can take, and each one found the shape the last had not met.

A fragment goes even when it looks like a section number. #3 reads as a reference and #123456 reads as a PIN, but they are the same string with different digits, so no rule can tell them apart; both are withheld rather than guessed at.

A token with none of those marks is returned exactly as written, so https://origin.example/ok, origin.example/file and 3.5 are untouched: a plain target carries nothing, and which host failed is most of a diagnostic's value.

The structured target fields — a log's Url and Path — are reduced rather than withheld, because a field that IS a URL can be cut precisely.

What this does not catch, said plainly: a secret embedded in a path segment, as in /download/sk_live_x/file. Nothing short of understanding the operator's own URL scheme would.

Edge-script source is withheld by default

/compute/script/<id>/code returns the script's source, and source carries hard-coded keys about as readily as any other operator-authored text — CustomHTML is dropped for exactly that reason. So the body is withheld and the response says how to release it:

BUNNY_ALLOW_SOURCE=1   # return edge-script source — 1/true/yes/on, nothing else

More generally, a non-JSON body on the management API no longer gets a free pass. It passes only where a route declares it may; anything else raises, naming the path. The blanket "non-JSON means it's a file download" exemption was the hole this closed.

Credential scoping

Use a permission-scoped key from Account → API → Manage Keys, never the account master key. The redaction above keeps secrets out of the transcript; it does nothing about what the key itself is allowed to do.

Features

Data sources: Tools marked Storage API require BUNNY_STORAGE_KEY. Tools marked Stream API require BUNNY_STREAM_KEY. All other tools use BUNNY_API_KEY.

Prerequisites

• Node.js >= 18

• A bunny.net account with an API key

• Optional: Stream library API key (for video tools)

• Optional: Storage zone password (for file tools)

Setup

No installation needed — just configure your MCP client:

Add to .vscode/mcp.json:

{
  "servers": {
    "bunny": {
      "command": "npx",
      "args": ["-y", "github:Digitizers/bunny-mcp"],
      "env": {
        "BUNNY_API_KEY": "your-api-key"
      }
    }
  }
}

Add to .cursor/mcp.json:

{
  "mcpServers": {
    "bunny": {
      "command": "npx",
      "args": ["-y", "github:Digitizers/bunny-mcp"],
      "env": {
        "BUNNY_API_KEY": "your-api-key"
      }
    }
  }
}

Add to ~/.codeium/windsurf/mcp_config.json:

{
  "mcpServers": {
    "bunny": {
      "command": "npx",
      "args": ["-y", "github:Digitizers/bunny-mcp"],
      "env": {
        "BUNNY_API_KEY": "your-api-key"
      }
    }
  }
}

Add to claude_desktop_config.json:

{
  "mcpServers": {
    "bunny": {
      "command": "npx",
      "args": ["-y", "github:Digitizers/bunny-mcp"],
      "env": {
        "BUNNY_API_KEY": "your-api-key"
      }
    }
  }
}

claude mcp add --transport stdio bunny -- npx -y github:Digitizers/bunny-mcp

Or add to .mcp.json (shared with team):

{
  "mcpServers": {
    "bunny": {
      "command": "npx",
      "args": ["-y", "github:Digitizers/bunny-mcp"],
      "env": {
        "BUNNY_API_KEY": "your-api-key"
      }
    }
  }
}

Add to settings.json:

{
  "context_servers": {
    "bunny": {
      "command": "npx",
      "args": ["-y", "github:Digitizers/bunny-mcp"],
      "env": {
        "BUNNY_API_KEY": "your-api-key"
      }
    }
  }
}

Open Settings → Tools → AI Assistant → MCP, click +, and paste:

{
  "mcpServers": {
    "bunny": {
      "command": "npx",
      "args": ["-y", "github:Digitizers/bunny-mcp"],
      "env": {
        "BUNNY_API_KEY": "your-api-key"
      }
    }
  }
}

gemini mcp add bunny -- npx -y github:Digitizers/bunny-mcp

Or add to ~/.gemini/settings.json:

{
  "mcpServers": {
    "bunny": {
      "command": "npx",
      "args": ["-y", "github:Digitizers/bunny-mcp"],
      "env": {
        "BUNNY_API_KEY": "your-api-key"
      }
    }
  }
}

Any MCP client that supports stdio transport can use this server. The command is:

npx -y github:Digitizers/bunny-mcp

See the full list of MCP clients.

Optional environment variables

Add these to the env block in your MCP client configuration above.

Local development

git clone https://github.com/Digitizers/bunny-mcp.git
cd bunny-mcp
npm install
npm test
node index.js

How It Works

This MCP server connects to the bunny.net API using your API key. The catalog above holds 70 tools, split by which API keys are provided:

• Core tools (56 tools) — always available with BUNNY_API_KEY

• Stream tools (11 tools) — registered when BUNNY_STREAM_KEY is set

• Storage file tools (3 tools) — registered when BUNNY_STORAGE_KEY is set

Those are the totals with the write gate open. By default BUNNY_READONLY is on and 41 of the 70 register — the 29 write-capable ones are withheld, per section 2. The Mode column in the catalog says which is which.

All read operations are cached in-memory with a short TTL for performance. Every tool includes MCP annotations (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) so clients can make informed decisions about tool approval.

License

MIT