Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, email [email protected] and we’ll put it right.

io.github.lazyants/hetzner

NPM · @LAZYANTS/HETZNER-MCP-SERVER · SCANNED AUG 3

MCP server for the Hetzner Cloud API — servers, networks, volumes, firewalls, and more.

+25 this week 78 Trust /100
Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security87
  • No malware found by supply-chain analysis.Pass
  • Only part of the dependency tree could be resolved (107 of 108), so this covers what we could see, not the whole tree.Partial
  • No install/post-install scripts declared.Pass
  • Only part of the dependency tree could be resolved (107 of 108), so this covers what we could see, not the whole tree. View diagnostics → Partial
Provenance & Transparency84
  • Source repository is publicly reachable at the declared URL. View diagnostics → Pass
  • Cryptographically verified build provenance (signed, bound to lazyants/hetzner-mcp-server). View diagnostics → Pass
  • License check failed: the license (FSL-1.1-MIT) isn't a recognized OSI-approved license. See how to fix → Fail
  • Actively maintained (last published 41 days ago).Pass
  • Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability85
  • 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
  • AI-judged instruction clarity (excellent).Pass
  • Tool/resource definitions use about 13206 tokens (~71/item across 186 items; 185 tools + 1 resources), lean.Pass
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management23
  • Stability observed for 7 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · @lazyants/hetzner-mcp-server

# add to Claude Code
claude mcp add lazyants-hetzner -- npx -y @lazyants/hetzner-mcp-server
# add to Codex CLI
codex mcp add lazyants-hetzner -- npx -y @lazyants/hetzner-mcp-server
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "lazyants-hetzner": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@lazyants/hetzner-mcp-server"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add lazyants-hetzner --command npx --arg -y --arg @lazyants/hetzner-mcp-server
# ~/.hermes/config.yaml
mcp_servers:
  lazyants-hetzner:
    command: "npx"
    args: ["-y", "@lazyants/hetzner-mcp-server"]
// mcp.json
{
  "mcpServers": {
    "lazyants-hetzner": {
      "command": "npx",
      "args": [
        "-y",
        "@lazyants/hetzner-mcp-server"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 2 Aug 26 +47
    • Install scripts: unverified → pass security
    • Provenance: unverified → pass security
    • Known CVEs: unverified → partial security
    • Malware scan: unverified → pass security
    • The attested source repository moved: lazyants/hetzner-mcp-server security
    • License: unverified → fail functional
    • Schema quality: unverified → excellent functional
    • Stability: unverified → 0.20 functional
    • Dependency health: unverified → partial functional
    • Maintenance: unverified → pass functional
    • Licence: FSL-1.1-MIT functional
  • 1 Aug 26 +5
    • Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window). security
    • MCP protocol: unverified → pass functional
  • 31 Jul 26 −27
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 27 Jul 26 53

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 3 Aug 2026 · Analysed npm/@lazyants/[email protected]

Provenance verified

Ecosystem: npm · Outcome: verified

Reason: verified

Source repo:
lazyants/hetzner-mcp-server
Certificate issuer:
https://token.actions.githubusercontent.com
Certificate SAN:
https://github.com/lazyants/hetzner-mcp-server/.github/workflows/publish-registry.yml@refs/tags/v2.3.1
Rekor log index:
1908859923
Predicate type:
https://slsa.dev/provenance/v1
Subject digest:
sha512:1d2cb0932969cb34994f101895b8f5f40cc3f166dc06810f98da478eaceae86478e7c3154b341db070e8b31625067674c22995d204a1362d73e8dd2c4
Discovery method:
attestation_endpoint
Dependencies 107 packages

107 packages in the resolved dependency tree · 107 deprecated · 32 stale.

The dependency tree was only partially resolved, so these counts may be incomplete.

MCP tools — 185 exposed · ~13,177 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens
hetzner_add_lb_service ~115

Add a service (port listener with forwarding rules) to a load balancer.

NameTypeReqDescription
destination_portintegeryesPort traffic is forwarded to
health_checkobjectHealth check configuration
httpobjectHTTP-specific service settings
idintegeryesResource ID
listen_portintegeryesPort the load balancer listens on
protocolstringyesService protocol: tcp, http, or https
proxyprotocolbooleanEnable PROXY protocol

No output schema declared.

No examples provided.

hetzner_add_lb_target ~92

Add a target (server, label selector, or IP) to a load balancer.

NameTypeReqDescription
idintegeryesResource ID
ipobjectIP target
label_selectorobjectLabel selector target
serverobjectServer target
typestringyesTarget type
use_private_ipbooleanUse private IP for the target

No output schema declared.

No examples provided.

hetzner_add_route ~51

Add a route to an existing network.

NameTypeReqDescription
destinationstringyesDestination network of the route
gatewaystringyesGateway for the route
idintegeryesResource ID

No output schema declared.

No examples provided.

hetzner_add_server_to_placement_group ~62

Add a server to a placement group. The server must be powered off before it can be added.

NameTypeReqDescription
idintegeryesServer ID
placement_groupintegeryesID of the placement group to add the server to

No output schema declared.

No examples provided.

hetzner_add_subnet ~92

Add a subnet to an existing network.

NameTypeReqDescription
idintegeryesResource ID
ip_rangestringIP range of the subnet
network_zonestringyesName of the network zone, e.g. "eu-central"
typestringyesType of subnet
vswitch_idintegerID of the vSwitch (required for vswitch type)

No output schema declared.

No examples provided.

hetzner_add_zone_rrset_records ~110

Add new records to an existing RRSet without removing existing ones. Optionally update the RRSet TTL.

NameTypeReqDescription
id_or_nameyesZone ID or name
namestringyesRRSet name
recordsarrayyesRecords to add to the RRSet
ttlintegerOptional new TTL applied alongside the addition
typestringyesDNS record type (A, AAAA, CNAME, MX, NS, TXT, etc.)

No output schema declared.

No examples provided.

hetzner_apply_firewall ~47

Apply a firewall to one or more servers or label selectors.

NameTypeReqDescription
apply_toarrayyesResources to apply the firewall to
idintegeryesResource ID

No output schema declared.

No examples provided.

hetzner_assign_floating_ip ~50

Assign a floating IP to a server in the same location.

NameTypeReqDescription
idintegeryesFloating IP ID
serverintegeryesServer ID to assign the floating IP to

No output schema declared.

No examples provided.

hetzner_assign_primary_ip ~64

Assign a primary IP to a server.

NameTypeReqDescription
assignee_idintegeryesServer ID to assign the primary IP to
assignee_typestringyesAssignee type (must be "server")
idintegeryesPrimary IP ID

No output schema declared.

No examples provided.

hetzner_attach_iso ~59

Attach an ISO image to a server. The server must be rebooted to boot from the ISO.

NameTypeReqDescription
isostringyesISO name or ID to attach
server_idintegeryesServer ID to attach the ISO to

No output schema declared.

No examples provided.

hetzner_attach_lb_to_network ~90

Attach a load balancer to a network.

NameTypeReqDescription
idintegeryesResource ID
ipstringIP address to assign in the network
ip_rangestringSubnet IP range (CIDR) to attach to, e.g. "10.0.1.0/24"
networkintegeryesNetwork ID to attach to

No output schema declared.

No examples provided.

hetzner_attach_server_to_network ~134

Attach a server to a private network, optionally assigning a specific IP, alias IPs, or IP range.

NameTypeReqDescription
alias_ipsarrayAdditional alias IPs to assign the server on the network
idintegeryesServer ID
ipstringPrivate IP to assign the server in the network (within the network IP range)
ip_rangestringSubnet IP range (CIDR) to attach to, e.g. "10.0.1.0/24"
networkintegeryesID of the network to attach the server to

No output schema declared.

No examples provided.

hetzner_attach_volume ~67

Attach a volume to a server. The server and volume must be in the same location.

NameTypeReqDescription
automountbooleanAuto-mount the volume after attaching
idintegeryesVolume ID
serverintegeryesServer ID to attach the volume to

No output schema declared.

No examples provided.

hetzner_change_alias_ips ~91

Replace the alias IPs that a server has on a private network. The list overrides any existing alias IPs for that network.

NameTypeReqDescription
alias_ipsarrayyesFull list of alias IPs to set on the network (replaces existing). Pass [] to clear.
idintegeryesServer ID
networkintegeryesID of the network the server is attached to

No output schema declared.

No examples provided.

hetzner_change_dns_ptr ~94

Change the reverse DNS entry for one of a server's public IPv4 or IPv6 addresses. Set dns_ptr to null to reset to the default.

NameTypeReqDescription
dns_ptryesReverse DNS PTR record value, or null to reset to the default
idintegeryesServer ID
ipstringyesPublic IPv4 or IPv6 address of the server to set the reverse DNS entry for

No output schema declared.

No examples provided.

hetzner_change_floating_ip_protection ~57

Enable or disable delete protection on a floating IP to guard against accidental destruction.

NameTypeReqDescription
deletebooleanIf true, prevents the floating IP from being deleted
idintegeryesFloating IP ID

No output schema declared.

No examples provided.

hetzner_change_floating_ip_rdns ~75

Change the reverse DNS entry for a floating IP. Set dns_ptr to null to reset.

NameTypeReqDescription
dns_ptryesReverse DNS PTR record value, or null to reset
idintegeryesFloating IP ID
ipstringyesIP address to set the reverse DNS entry for

No output schema declared.

No examples provided.

hetzner_change_image_protection ~55

Enable or disable delete protection on a snapshot or backup image to guard against accidental destruction.

NameTypeReqDescription
deletebooleanIf true, prevents the image from being deleted
idintegeryesImage ID

No output schema declared.

No examples provided.

hetzner_change_ip_range ~85

Expand the IP range of an existing network. The new CIDR range must contain the current range; shrinking is not supported.

NameTypeReqDescription
idintegeryesNetwork ID
ip_rangestringyesNew IP range in CIDR notation (e.g. "10.0.0.0/8"). Must be a superset of the current range.

No output schema declared.

No examples provided.

hetzner_change_lb_algorithm ~40

Change the balancing algorithm of a load balancer.

NameTypeReqDescription
idintegeryesResource ID
typestringyesAlgorithm type

No output schema declared.

No examples provided.

hetzner_change_lb_dns_ptr ~97

Change the reverse DNS entry for one of a load balancer's public IP addresses. Set dns_ptr to null to reset to the default.

NameTypeReqDescription
dns_ptryesReverse DNS PTR record value, or null to reset to the default
idintegeryesLoad Balancer ID
ipstringyesPublic IPv4 or IPv6 address of the load balancer to set the reverse DNS entry for

No output schema declared.

No examples provided.

hetzner_change_lb_type ~51

Change the type (plan) of a load balancer.

NameTypeReqDescription
idintegeryesResource ID
load_balancer_typestringyesNew load balancer type name or ID

No output schema declared.

No examples provided.

hetzner_change_load_balancer_protection ~60

Enable or disable delete protection on a load balancer to guard against accidental destruction.

NameTypeReqDescription
deletebooleanIf true, prevents the load balancer from being deleted
idintegeryesLoad Balancer ID

No output schema declared.

No examples provided.

hetzner_change_network_protection ~52

Enable or disable delete protection on a network to guard against accidental destruction.

NameTypeReqDescription
deletebooleanIf true, prevents the network from being deleted
idintegeryesNetwork ID

No output schema declared.

No examples provided.

hetzner_change_primary_ip_protection ~56

Enable or disable delete protection on a primary IP to guard against accidental destruction.

NameTypeReqDescription
deletebooleanIf true, prevents the primary IP from being deleted
idintegeryesPrimary IP ID

No output schema declared.

No examples provided.

hetzner_change_primary_ip_rdns ~74

Change the reverse DNS entry for a primary IP. Set dns_ptr to null to reset.

NameTypeReqDescription
dns_ptryesReverse DNS PTR record value, or null to reset
idintegeryesPrimary IP ID
ipstringyesIP address to set the reverse DNS entry for

No output schema declared.

No examples provided.

hetzner_change_server_protection ~70

Enable or disable delete and rebuild protection on a server to guard against accidental destruction.

NameTypeReqDescription
deletebooleanIf true, prevents the server from being deleted
idintegeryesServer ID
rebuildbooleanIf true, prevents the server from being rebuilt

No output schema declared.

No examples provided.

hetzner_change_storage_box_protection ~56

Enable or disable delete protection on a Storage Box to guard against accidental destruction.

NameTypeReqDescription
deletebooleanIf true, prevents the Storage Box from being deleted
idintegeryesStorage Box ID

No output schema declared.

No examples provided.

hetzner_change_storage_box_subaccount_home_directory ~74

Change the home directory a Storage Box subaccount is scoped to.

NameTypeReqDescription
home_directorystringyesNew home directory for the subaccount, e.g. "/backups/db"
idintegeryesStorage Box ID
subaccount_idintegeryesSubaccount ID

No output schema declared.

No examples provided.

hetzner_change_storage_box_type ~72

Change the type (capacity tier) of a Storage Box. The new type must have at least the current usage capacity.

NameTypeReqDescription
idintegeryesStorage Box ID
storage_box_typestringyesID or name of the target Storage Box type, e.g. "bx30"

No output schema declared.

No examples provided.

hetzner_change_volume_protection ~52

Enable or disable delete protection on a volume to guard against accidental destruction.

NameTypeReqDescription
deletebooleanIf true, prevents the volume from being deleted
idintegeryesVolume ID

No output schema declared.

No examples provided.

hetzner_change_zone_primary_nameservers ~62

Replace the list of primary nameservers used by a secondary DNS zone for AXFR/IXFR transfers.

NameTypeReqDescription
id_or_nameyesZone ID or name
primary_nameserversarrayyesNew full list of primary nameservers

No output schema declared.

No examples provided.

hetzner_change_zone_protection ~55

Enable or disable delete protection on a DNS zone to guard against accidental destruction.

NameTypeReqDescription
deletebooleanIf true, prevents the zone from being deleted
id_or_nameyesZone ID or name

No output schema declared.

No examples provided.

hetzner_change_zone_rrset_protection ~98

Enable or disable change protection on an RRSet to guard against accidental modification or deletion.

NameTypeReqDescription
changebooleanIf true, prevents the RRSet from being modified or deleted
id_or_nameyesZone ID or name
namestringyesRRSet name
typestringyesDNS record type (A, AAAA, CNAME, MX, NS, TXT, etc.)

No output schema declared.

No examples provided.

hetzner_change_zone_rrset_ttl ~101

Change the TTL of an RRSet. Pass ttl=null to fall back to the zone default TTL.

NameTypeReqDescription
id_or_nameyesZone ID or name
namestringyesRRSet name
ttlyesNew TTL in seconds, or null to fall back to the zone default
typestringyesDNS record type (A, AAAA, CNAME, MX, NS, TXT, etc.)

No output schema declared.

No examples provided.

hetzner_change_zone_ttl ~55

Change the default TTL applied to records in a DNS zone that do not have an explicit TTL.

NameTypeReqDescription
id_or_nameyesZone ID or name
ttlintegeryesNew default TTL in seconds

No output schema declared.

No examples provided.

hetzner_create_certificate ~114

Create an uploaded certificate (provide PEM data) or a managed certificate (provide domain names).

NameTypeReqDescription
certificatestringPEM-encoded certificate (required for uploaded type)
domain_namesarrayDomain names (required for managed type)
labelsobjectLabels as key-value pairs
namestringyesName of the certificate
private_keystringPEM-encoded private key (required for uploaded type)
typestringCertificate type (default: uploaded)

No output schema declared.

No examples provided.

hetzner_create_firewall ~71

Create a new firewall with optional rules and resource assignments.

NameTypeReqDescription
apply_toarrayResources to apply the firewall to
labelsobjectLabels as key-value pairs
namestringyesName of the firewall
rulesarrayArray of firewall rules

No output schema declared.

No examples provided.

hetzner_create_floating_ip ~122

Create a new floating IP. Either home_location or server must be provided.

NameTypeReqDescription
descriptionstringDescription of the floating IP
home_locationstringHome location name (e.g. "fsn1"). Required if server is not set
labelsobjectLabels as key-value pairs
namestringName of the floating IP
serverintegerServer ID to assign the floating IP to. Required if home_location is not set
typestringyesIP type

No output schema declared.

No examples provided.

hetzner_create_image ~69

Create a snapshot image from an existing server.

NameTypeReqDescription
descriptionstringImage description
labelsobjectLabels as key-value pairs
server_idintegeryesServer ID to create the image from
typestringImage type (default: snapshot)

No output schema declared.

No examples provided.

hetzner_create_load_balancer ~173

Create a new load balancer with the specified type, location, and optional targets and services.

NameTypeReqDescription
algorithmobjectLoad balancing algorithm
labelsobjectLabels as key-value pairs
load_balancer_typestringyesLoad balancer type name or ID
locationstringLocation name (e.g. "fsn1"), mutually exclusive with network_zone
namestringyesName of the load balancer
networkintegerNetwork ID to attach to
network_zonestringNetwork zone (e.g. "eu-central"), mutually exclusive with location
public_interfacebooleanEnable the public interface
servicesarrayArray of services
targetsarrayArray of targets

No output schema declared.

No examples provided.

hetzner_create_network ~105

Create a new network with the specified IP range, and optionally subnets and routes.

NameTypeReqDescription
ip_rangestringyesIP range of the whole network, e.g. "10.0.0.0/8"
labelsobjectLabels as key-value pairs
namestringyesName of the network
routesarrayArray of routes to create
subnetsarrayArray of subnets to create

No output schema declared.

No examples provided.

hetzner_create_placement_group ~59

Create a new placement group to control server distribution across hosts.

NameTypeReqDescription
labelsobjectLabels as key-value pairs
namestringyesName of the placement group
typestringyesPlacement group type

No output schema declared.

No examples provided.

hetzner_create_primary_ip ~142

Create a new primary IP with the specified type and optional assignee type.

NameTypeReqDescription
assignee_typestringAssignee type. Optional since 2026-04-27; defaults to "server" until 2026-08-01, then to "unassigned".
auto_deletebooleanDelete the primary IP when the assignee is deleted
datacenterstringDatacenter name (e.g. "fsn1-dc14")
labelsobjectLabels as key-value pairs
namestringyesName of the primary IP
typestringyesIP type

No output schema declared.

No examples provided.

hetzner_create_server ~244

Create a new server with the specified type, image, and configuration options.

NameTypeReqDescription
automountbooleanAuto-mount volumes after attach
firewallsarrayFirewalls to apply to the server
imagestringyesImage name or ID to use (e.g. "ubuntu-22.04", "debian-12")
labelsobjectLabels as key-value pairs
locationstringLocation name (e.g. "fsn1", "nbg1", "hel1")
namestringyesName of the server
networksarrayNetwork IDs to attach the server to
placement_groupnumberPlacement group ID
public_netobjectPublic network configuration
server_typestringyesServer type name or ID (e.g. "cx22", "cpx11")
ssh_keysarraySSH key names or IDs to inject
start_after_createbooleanStart server after creation (default: true)
user_datastringCloud-init user data (base64 or plain text)

No output schema declared.

No examples provided.

hetzner_create_ssh_key ~74

Add a new SSH public key to the project for use when creating servers.

NameTypeReqDescription
labelsobjectLabels as key-value pairs
namestringyesName of the SSH key
public_keystringyesSSH public key content (e.g. "ssh-rsa AAAA...")

No output schema declared.

No examples provided.

hetzner_create_storage_box ~151

Create a new Storage Box in the given location and type. Billing applies for the provisioned resource.

NameTypeReqDescription
access_settingsobjectInitial access settings for the Storage Box
labelsobjectLabels as key-value pairs
locationstringyesID or name of the location, e.g. "fsn1"
namestringyesName of the Storage Box
passwordstringyesPassword for the Storage Box main account
ssh_keysarraySSH public keys in OpenSSH format to inject into the Storage Box
storage_box_typestringyesID or name of the Storage Box type, e.g. "bx20"

No output schema declared.

No examples provided.

hetzner_create_storage_box_snapshot ~64

Create a manual snapshot of a Storage Box, optionally with a description and labels.

NameTypeReqDescription
descriptionstringHuman-readable description for the snapshot
idintegeryesStorage Box ID
labelsobjectLabels as key-value pairs

No output schema declared.

No examples provided.

hetzner_create_storage_box_subaccount ~137

Create a subaccount on a Storage Box, scoped to a home directory with its own password and access settings.

NameTypeReqDescription
access_settingsobjectInitial access settings for the subaccount
descriptionstringHuman-readable description for the subaccount
home_directorystringyesHome directory the subaccount is scoped to, e.g. "/backups/web"
idintegeryesStorage Box ID
labelsobjectLabels as key-value pairs
namestringOptional display name for the subaccount
passwordstringyesPassword for the subaccount

No output schema declared.

No examples provided.

hetzner_create_volume ~139

Create a new volume. Either location or server must be provided to determine placement.

NameTypeReqDescription
automountbooleanAuto-mount the volume after attaching to a server
formatstringFilesystem format for the volume
labelsobjectLabels as key-value pairs
locationstringLocation name (e.g. "fsn1"). Required if server is not set
namestringyesName of the volume
serverintegerServer ID to attach the volume to. Required if location is not set
sizeintegeryesSize of the volume in GB

No output schema declared.

No examples provided.