Summary statistics (total/blocked queries, percentage, unique domains, clients).

Pass from_ts and until_ts (Unix timestamps) to query the long-term database for any range.

Top blocked domains by query count. from_ts/until_ts switch to the long-term database.

Top allowed domains by query count. from_ts/until_ts switch to the long-term database.

Top clients by query count (blocked=true ranks by blocked queries). from_ts/until_ts use the long-term database.

Breakdown of DNS query types (A, AAAA, PTR, SRV, etc). from_ts/until_ts use the long-term database.

Upstream DNS server stats (which forwarders served how many queries). from_ts/until_ts use the long-term database.

Recently blocked domains.

Time-series activity: allowed/blocked/other counts per bucket. from_ts/until_ts use the long-term database.

Per-client query time series for the top count clients (0 = all).

from_ts/until_ts query the long-term database instead (count is then ignored).

Fetch DNS queries with optional filters (wildcards * supported on text filters).

Filters:

• length: number of queries (default 100); start: offset for paging

• from_ts / until_ts: Unix timestamps

• domain, client_ip, client_name, upstream: exact or wildcard match

• query_type: e.g. A, AAAA, HTTPS, PTR (unmapped types appear as TYPEnnn or OTHER)

• status: e.g. GRAVITY, FORWARDED, CACHE, REGEX, DENYLIST

• reply: e.g. IP, NXDOMAIN, NODATA, CNAME

• dnssec: e.g. SECURE, INSECURE, BOGUS

• cursor: cursor value from a previous response

• disk: true searches the long-term database instead of in-memory queries Valid filter values come from get_query_suggestions.

Get available filter values for the query log (domains, clients, upstreams, types, statuses).

Check if Pi-hole DNS blocking is enabled. Returns status and any active timer.

Enable DNS blocking immediately.

Disable DNS blocking. If duration_seconds is given, re-enables after that timer; otherwise indefinite.

List all exact-match allowed domains.

List all exact-match blocked domains.

Add a domain to the allow list (whitelist).

Add a domain to the deny list (blacklist).

Remove a domain from the allow list.

Remove a domain from the deny list.

List domain-list entries, optionally narrowed to allow/deny and exact/regex.

kind requires domain_type.

Add an exact domain or a regex to the allow or deny list. groups are group IDs (default group 0).

Update a domain-list entry: move it between lists, change comment, groups, or enabled state.

Remove an exact domain or regex from the allow or deny list.

List local DNS entries (hosts and CNAME records).

Add a local A record (host -> IP). Replaces any existing entry for the same host.

Remove any local A record matching the given host.

Add a local CNAME record (host -> target). Replaces any existing CNAME for the same host.

Remove any local CNAME record for the given host.

Refresh Pi-hole gravity (download adlists). Takes a minute or more.

Returns the last output_lines lines of the gravity run. Reports cleanly if a run is already in progress.

Flush the DNS cache. Pi-hole v6 has no separate cache-flush endpoint, so this restarts the DNS resolver.

Restart the DNS resolver (brief DNS outage, clears cache). Preview unless confirm=true.

Clear the Pi-hole query log.

Flush the ARP cache of the Pi-hole host. Preview unless confirm=true.

Clear Pi-hole's network device table (device history is lost). Preview unless confirm=true.

Get the last lines entries of a Pi-hole log ('dnsmasq', 'ftl', 'webserver').

Pass next_id from a previous response to get only newer entries.

Download a Teleporter backup zip of all Pi-hole settings and lists into output_dir.

The archive contains the password hash, so store it securely. Existing files are never overwritten.

Explain why a domain is blocked or allowed: shows matching domain-list entries, regexes, and adlists (gravity), with the groups each applies to.

partial=true also matches substrings. max_results caps results per category.

List subscribed adlists (block lists and allow lists) with status and domain counts.

Subscribe to an adlist URL. Run update_gravity afterwards to download it.

Change an adlist's comment, groups, or enabled state. Run update_gravity to apply.

Unsubscribe from an adlist. Preview unless confirm=true. Run update_gravity afterwards.

List groups. Groups tie clients to domain lists and adlists for per-device policy.

Create a group.

Rename a group or change its comment or enabled state.

Delete a group. Preview unless confirm=true.

List configured clients (IP, MAC, hostname, CIDR, or interface) and their groups.

Clients seen on the network that are not yet configured, as candidates for add_client.

Configure a client by IP, MAC, hostname, CIDR subnet, or :interface, and assign group IDs.

Change a configured client's comment or group IDs.

Remove a configured client (it falls back to the default group).

Installed and latest available versions of Pi-hole core, web, FTL, and Docker tag.

Host uptime, memory, swap, CPU load, and process count.

Host hardware model, kernel, and OS details.

Temperature sensor readings and the configured hot limit.

FTL process status: PID, uptime, privacy level, client and gravity counts, query frequency.

Long-term query database size, query count, and SQLite version.

DNS cache and DHCP metrics (cache size, insertions, evictions, reply types).

Pi-hole diagnostic warnings (rate limiting, load, DNSMASQ errors, list issues).

Dismiss one diagnostic message by ID.

Compact dashboard in one call (PADD data): blocking, stats, top items, system, versions.

Pi-hole's network table: MAC address, vendor, IPs, hostnames, first/last seen, query count.

Remove one device from the network table by its ID. Preview unless confirm=true.

Default gateway address and interface (detailed=true includes routes and interfaces).

Routing table of the Pi-hole host.

Network interfaces of the Pi-hole host with addresses and traffic counters.

Active DHCP leases (only populated when Pi-hole's DHCP server is enabled).

Remove a DHCP lease by IP. Preview unless confirm=true.

Read Pi-hole settings. element narrows to a section or key, e.g. 'dns', 'dns.upstreams', 'dhcp'.

detailed=true adds descriptions, allowed values, and defaults. Password hashes and the TOTP secret are redacted.

Set a Pi-hole setting, e.g. element='dns.upstreams', value=['9.9.9.9'].

Preview (current value) unless confirm=true. Some settings restart FTL; restart=false defers that. Authentication settings (webserver.api.*) are refused.

Append one value to an array setting, e.g. element='dns.upstreams', value='1.1.1.1'. Preview unless confirm=true.

Remove one value from an array setting. Preview unless confirm=true.

Return chris2ao-pihole-mcp server version, configured Pi-hole URL, and tool count.