Hetzner DNS MCP server

Read from the package source without running it. The installed server may list more.

• add_records

  Add records to an RRSet. Existing records are kept. Creates the RRSet if it does not exist yet — so denying create_rrset does not remove the ability to create one.

• change_primary_nameservers

  Replace the primary nameservers of a secondary zone (the servers Hetzner transfers the zone from). The ENTIRE zone content will be taken from the new primaries on the next transfer. Only applicable to zones in secondary mode. The first call returns a short-lived confirmation token bound to exactly this nameserver list.

• change_rrset_protection

  Enable or disable the change protection of an RRSet. Enabling is immediate; DISABLING removes the last safeguard against delete_rrset and set_records and therefore needs a confirm_token.

• change_rrset_ttl

  Change the Time To Live (TTL) of an RRSet. Pass null to fall back to the zone's default TTL.

• change_zone_protection

  Enable or disable the delete protection of a DNS zone. Enabling is immediate; DISABLING removes the last safeguard against delete_zone and therefore needs a confirm_token, exactly like a deletion.

• change_zone_ttl

  Change the default Time To Live (TTL) of a DNS zone. Applies to RRSets without an explicit TTL.

• create_rrsetwrite action

  Create a new RRSet (DNS record set) in a zone, e.g. an A record for "www". Fails if an RRSet with the same name and type already exists — use set_records or add_records in that case.

• create_zonewrite action

  Create a new DNS zone. Use mode "primary" for zones managed at Hetzner, or "secondary" with primary_nameservers to transfer the zone from external primaries. A primary zone can optionally be initialized from a zone file. Creating a zone with primary_nameservers or a zonefile asks a person first — those two carry the whole content of the zone, exactly like change_primary_nameservers and import_zone

• delete_rrsetwrite action

  Permanently delete an RRSet (DNS record set) with all its records. This is irreversible. The first call returns a short-lived confirmation token; ask the user, then call again with confirm_token.

• delete_zonewrite action

  Permanently delete a DNS zone including all its records. This is irreversible. The first call returns a short-lived confirmation token; ask the user, then call again with confirm_token.

• export_zonefile

  Export the full contents of a DNS zone as a zone file (BIND format).

• get_rrset

  Get a single RRSet (DNS record set) of a zone by name and type.

• get_zone

  Get the full details of a single DNS zone.

• get_zone_action

  Get a single zone action by ID to check its status and result.

• import_zonefile

  Import a zone file (BIND format) into an existing primary zone. This REPLACES the current records of the zone. The first call returns a short-lived confirmation token bound to exactly this zone file; ask the user, then call again with confirm_token. Consider export_zonefile first as a backup.

• list_rrsets

  List the RRSets (DNS record sets) of a zone, including their records, TTLs and protection status.

• list_zone_actions

  List actions (asynchronous operations like zone file imports) of all zones, or of a single zone if one is given.

• list_zones

  List the DNS zones of the Hetzner Cloud project, including status, mode, default TTL, assigned nameservers and record counts.

• remove_recordswrite action

  Remove specific records (matched by value) from an RRSet. Removing the last record deletes the RRSet — so denying delete_rrset does not remove the ability to delete one. The first call returns a short-lived confirmation token bound to exactly this record list.

• set_records

  Replace ALL records of an RRSet with the given records. Existing records not listed are removed. Use add_records to append instead. The first call returns a short-lived confirmation token bound to exactly this record list.

• update_rrsetwrite action

  Update the labels of an RRSet. The given set replaces all existing labels. (Records and TTL are changed via set_records/add_records/remove_records and change_rrset_ttl.)

• update_zonewrite action

  Update the labels of a DNS zone. The given set replaces all existing labels. (Other zone properties are changed via the dedicated change_zone_* tools.)

• Code scan31 source files scanned25/25
• –Live reliabilityno gateway calls yet and no remote to proben/a
• –Tool poisoningtools not inspected (local package is not executed); not countedn/a
• Auth qualitystatic API keys via environment variables6/15
• Maintenancelast push 0 days ago15/15
• Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10

Safety score

83/100

higher than 65% of 48,255 servers

Tools

22

the typical server has 7

Tools that change things

32%

typical: 0%. Fewer write tools means less an agent can break

Downloads a week

56

more than 46% of 12,191 servers with a package

Hetzner DNS: common questions

Is Hetzner DNS MCP server safe?

Mostly: it is graded B (83/100). Read the Hetzner DNS safety report

How do I install Hetzner DNS?

It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.

Does Hetzner DNS need an API key?

Yes. The registry entry asks for HETZNER_API_TOKEN.

Is Hetzner DNS maintained?

The last commit was 20 days ago (2026-10-15). The latest release is v0.6.0.

How does Hetzner DNS compare with other MCP servers?

safety score 83/100 (higher than 65% of 48,255 servers); tools 22 (the typical server has 7); tools that change things 32% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.