mcp-hetzner-dns

A Model Context Protocol (MCP) server for managing DNS zones and records via the Hetzner Cloud API.

Lets MCP clients like Claude Code, Claude Desktop or Codex manage your Hetzner DNS: list, create, update and delete zones and RRSets (record sets), import/export zone files, manage protection and TTLs, and track asynchronous zone actions.

Note: This server targets the current DNS API that is part of the Hetzner Cloud API (api.hetzner.cloud). The legacy DNS API (dns.hetzner.com) was shut down in May 2026 and is not supported.

Requirements

• Node.js ≥ 20

• A Hetzner Cloud API token for the project that holds your DNS zones — create one in the Hetzner Cloud Console under your project → Security → API tokens. Use a read & write token for full functionality (a read-only token limits you to the read tools).

Related MCP server: hetzner-mcp-server

Configuration

Configuration is provided via environment variables:

Installation

Claude Code

claude mcp add hetzner-dns -s user \
  -e HETZNER_API_TOKEN=your-token \
  -- npx -y mcp-hetzner-dns

Claude Desktop

Add to your claude_desktop_config.json:

{
  "mcpServers": {
    "hetzner-dns": {
      "command": "npx",
      "args": ["-y", "mcp-hetzner-dns"],
      "env": {
        "HETZNER_API_TOKEN": "your-token"
      }
    }
  }
}

Codex

Add to your ~/.codex/config.toml:

[mcp_servers.hetzner-dns]
command = "npx"
args = ["-y", "mcp-hetzner-dns"]
env = { HETZNER_API_TOKEN = "your-token" }

From source

git clone https://github.com/ni-c/mcp-hetzner-dns.git
cd mcp-hetzner-dns
npm install
npm run build
# then use `node /path/to/mcp-hetzner-dns/dist/index.js` as the command

Tools

Zones

RRSets (record sets)

Actions

Safety

• delete_zone, delete_rrset and import_zonefile refuse to run without an explicit confirm=true parameter and report what would be affected, so an MCP client can ask the user for confirmation first.

• Tools carry MCP annotations (readOnlyHint, destructiveHint, idempotentHint) so hosts can apply appropriate permission policies.

• set_records and remove_records are marked destructive because they drop existing records without a confirmation guard — review their input carefully.

• Hetzner-side resource protection is honored: protected zones/RRSets return an error with a hint to the corresponding change_*_protection tool.

Development

npm install
npm run build     # compile TypeScript to dist/
npm test          # run the vitest test suite
npm run lint      # eslint + prettier check

License

MIT