io.github.lazyants/hetzner
NPM · @LAZYANTS/HETZNER-MCP-SERVER · SCANNED SEP 21
MCP server for the Hetzner Cloud API — servers, networks, volumes, firewalls, and more.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 34 of 108 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency87
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to lazyants/hetzner-mcp-server). View diagnostics → Pass
- License check failed: the license (FSL-1.1-MIT) isn't a recognized OSI-approved license. See how to fix → Fail
- Actively maintained (last published 31 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability82
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (good).Pass
- Tool/resource definitions use about 13318 tokens (~71/item across 186 items; 185 tools + 1 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management83
- Stability observed for 25 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 25 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 186 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the io.github.lazyants/hetzner MCP server?
io.github.lazyants/hetzner runs locally as an npm package, launched with npx -y @lazyants/hetzner-mcp-server. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @lazyants/hetzner-mcp-server
claude mcp add lazyants-hetzner -- npx -y @lazyants/hetzner-mcp-server
{
"mcpServers": {
"lazyants-hetzner": {
"command": "npx",
"args": [
"-y",
"@lazyants/hetzner-mcp-server"
]
}
}
} {
"servers": {
"lazyants-hetzner": {
"command": "npx",
"args": [
"-y",
"@lazyants/hetzner-mcp-server"
]
}
}
} codex mcp add lazyants-hetzner -- npx -y @lazyants/hetzner-mcp-server
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"lazyants-hetzner": {
"type": "local",
"command": [
"npx",
"-y",
"@lazyants/hetzner-mcp-server"
],
"enabled": true
}
}
} openclaw mcp add lazyants-hetzner --command npx --arg -y --arg @lazyants/hetzner-mcp-server
mcp_servers:
lazyants-hetzner:
command: "npx"
args: ["-y", "@lazyants/hetzner-mcp-server"] {
"McpServers": {
"lazyants-hetzner": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"@lazyants/hetzner-mcp-server"
]
}
}
} assistant mcp add lazyants-hetzner -t stdio -c npx -a -y @lazyants/hetzner-mcp-server
{
"mcpServers": {
"lazyants-hetzner": {
"command": "npx",
"args": [
"-y",
"@lazyants/hetzner-mcp-server"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 −3
- Stability: pass → 0.80 functional
- 19 Sept 26 +1
- Stability: 0.97 → pass security
- 17 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 16 Sept 26 −2
- Stability: pass → 0.90 functional
- 15 Sept 26 +1
- Stability: 0.97 → pass security
- 13 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 11 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 10 Sept 26 −3
- Stability: pass → 0.83 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 21 Sept 2026 · Analysed npm/@lazyants/hetzner-mcp-server@2.5.0
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | lazyants/hetzner-mcp-server |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/lazyants/hetzner-mcp-server/.github/workflows/publish-registry.yml@refs/tags/v2.5.0 |
| Rekor log index | 2537216009 |
| Predicate type | https://slsa.dev/provenance/v1 |
| Subject digest | sha512:5e64e702fa5a85fdcb23af6c887f6a36182bf86ebb62437785aee8ffcbdfb3e4ceda81e7c573aa929b29ce79caa9b06d05e56d2ed65b17ffa7cab5303 |
Background: How many MCP packages publish verified provenance →
Dependencies 108 packages
| Packages resolved | 108 |
|---|---|
| Stale | 34 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
hetzner_remove_zone_rrset_records Remove Records from DNS Zone RRSet ~94
Remove specific records from an RRSet (matched by value) without deleting the RRSet itself.
| Name | Type | Req | Description |
|---|---|---|---|
| id_or_name | – | yes | Zone ID or name |
| name | string | yes | RRSet name |
| records | array | yes | Records to remove (matched by value) |
| type | string | yes | DNS record type (A, AAAA, CNAME, MX, NS, TXT, etc.) |
No output schema declared.
No examples provided.
hetzner_request_console Request Server Console ~45
Request a noVNC WebSocket URL and credentials to access the server console. The URL is valid for a limited time.
| Name | Type | Req | Description |
|---|---|---|---|
| id | integer | yes | Server ID |
No output schema declared.
No examples provided.
hetzner_reset Reset Server ~34
Perform a hard reset on the server, equivalent to pressing the reset button.
| Name | Type | Req | Description |
|---|---|---|---|
| id | integer | yes | Server ID |
No output schema declared.
No examples provided.
hetzner_reset_server_password Reset Server Root Password ~45
Reset the root password of a server. The server is rebooted and a new root password is returned in the result.
| Name | Type | Req | Description |
|---|---|---|---|
| id | integer | yes | Server ID |
No output schema declared.
No examples provided.
hetzner_reset_storage_box_password Reset Storage Box Password ~52
Reset the password of a Storage Box main account to the supplied value.
| Name | Type | Req | Description |
|---|---|---|---|
| id | integer | yes | Storage Box ID |
| password | string | yes | New password for the Storage Box main account |
No output schema declared.
No examples provided.
hetzner_reset_storage_box_subaccount_password Reset Storage Box Subaccount Password ~64
Reset the password of a Storage Box subaccount to the supplied value.
| Name | Type | Req | Description |
|---|---|---|---|
| id | integer | yes | Storage Box ID |
| password | string | yes | New password for the subaccount |
| subaccount_id | integer | yes | Subaccount ID |
No output schema declared.
No examples provided.
hetzner_resize_server Resize Server ~75
Change the server type. The server will be stopped and migrated if needed.
| Name | Type | Req | Description |
|---|---|---|---|
| id | integer | yes | Server ID |
| server_type | string | yes | Target server type name (e.g. "cx22") |
| upgrade_disk | boolean | yes | Whether to upgrade the disk size (cannot be downgraded later) |
No output schema declared.
No examples provided.
hetzner_resize_volume Resize Volume ~59
Increase the size of a volume. Volumes can only be made larger, not smaller.
| Name | Type | Req | Description |
|---|---|---|---|
| id | integer | yes | Volume ID |
| size | integer | yes | New size of the volume in GB (must be larger than current size) |
No output schema declared.
No examples provided.
hetzner_retry_certificate Retry Certificate Issuance ~32
Retry issuance or renewal of a managed certificate that has failed.
| Name | Type | Req | Description |
|---|---|---|---|
| id | integer | yes | Resource ID |
No output schema declared.
No examples provided.
hetzner_rollback_storage_box_snapshot Rollback Storage Box Snapshot ~58
Roll a Storage Box back to a snapshot. This overwrites current data with the snapshot contents.
| Name | Type | Req | Description |
|---|---|---|---|
| id | integer | yes | Storage Box ID |
| snapshot | string | yes | Name of the snapshot to roll back to |
No output schema declared.
No examples provided.
hetzner_set_firewall_rules Set Firewall Rules ~52
Replace all rules of a firewall with a new set of rules.
| Name | Type | Req | Description |
|---|---|---|---|
| id | integer | yes | Resource ID |
| rules | array | yes | New set of firewall rules (replaces all existing) |
No output schema declared.
No examples provided.
hetzner_set_zone_rrset_records Set DNS Zone RRSet Records ~97
Replace the full list of records in an RRSet. Existing records not in the payload are removed.
| Name | Type | Req | Description |
|---|---|---|---|
| id_or_name | – | yes | Zone ID or name |
| name | string | yes | RRSet name |
| records | array | yes | Full replacement list of records for this RRSet |
| type | string | yes | DNS record type (A, AAAA, CNAME, MX, NS, TXT, etc.) |
No output schema declared.
No examples provided.
hetzner_shutdown Shutdown Server ~31
Send an ACPI shutdown signal for a graceful OS shutdown.
| Name | Type | Req | Description |
|---|---|---|---|
| id | integer | yes | Server ID |
No output schema declared.
No examples provided.
hetzner_unassign_floating_ip Unassign Floating IP ~38
Unassign a floating IP from the server it is currently assigned to.
| Name | Type | Req | Description |
|---|---|---|---|
| id | integer | yes | Floating IP ID |
No output schema declared.
No examples provided.
hetzner_unassign_primary_ip Unassign Primary IP ~37
Unassign a primary IP from the server it is currently assigned to.
| Name | Type | Req | Description |
|---|---|---|---|
| id | integer | yes | Primary IP ID |
No output schema declared.
No examples provided.
hetzner_update_certificate Update Certificate ~51
Update a certificate name or labels.
| Name | Type | Req | Description |
|---|---|---|---|
| id | integer | yes | Resource ID |
| labels | object | – | Labels as key-value pairs |
| name | string | – | New name for the certificate |
No output schema declared.
No examples provided.
hetzner_update_firewall Update Firewall ~52
Update a firewall name or labels.
| Name | Type | Req | Description |
|---|---|---|---|
| id | integer | yes | Resource ID |
| labels | object | – | Labels as key-value pairs |
| name | string | – | New name for the firewall |
No output schema declared.
No examples provided.
hetzner_update_floating_ip Update Floating IP ~65
Update a floating IP's name, description, or labels.
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | – | New description |
| id | integer | yes | Floating IP ID |
| labels | object | – | Labels as key-value pairs |
| name | string | – | New name |
No output schema declared.
No examples provided.
hetzner_update_image Update Image ~68
Update an image's description, type, or labels.
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | – | New image description |
| id | integer | yes | Image ID |
| labels | object | – | Labels as key-value pairs |
| type | string | – | Image type (only snapshot allowed for conversion) |
No output schema declared.
No examples provided.
hetzner_update_lb_service Update Load Balancer Service ~109
Update an existing service on a load balancer.
| Name | Type | Req | Description |
|---|---|---|---|
| destination_port | integer | yes | Port traffic is forwarded to |
| health_check | object | – | Health check configuration |
| http | object | – | HTTP-specific service settings |
| id | integer | yes | Resource ID |
| listen_port | integer | yes | Port the load balancer listens on |
| protocol | string | yes | Service protocol: tcp, http, or https |
| proxyprotocol | boolean | – | Enable PROXY protocol |
No output schema declared.
No examples provided.
hetzner_update_load_balancer Update Load Balancer ~57
Update a load balancer name or labels.
| Name | Type | Req | Description |
|---|---|---|---|
| id | integer | yes | Resource ID |
| labels | object | – | Labels as key-value pairs |
| name | string | – | New name for the load balancer |
No output schema declared.
No examples provided.
hetzner_update_network Update Network ~80
Update properties of a network such as name, labels, or vSwitch route exposure.
| Name | Type | Req | Description |
|---|---|---|---|
| expose_routes_to_vswitch | boolean | – | Whether to expose routes to the vSwitch |
| id | integer | yes | Resource ID |
| labels | object | – | Labels as key-value pairs |
| name | string | – | New name for the network |
No output schema declared.
No examples provided.
hetzner_update_placement_group Update Placement Group ~54
Update a placement group's name or labels.
| Name | Type | Req | Description |
|---|---|---|---|
| id | integer | yes | Placement group ID |
| labels | object | – | Labels as key-value pairs |
| name | string | – | New placement group name |
No output schema declared.
No examples provided.
hetzner_update_primary_ip Update Primary IP ~75
Update a primary IP's name, auto_delete setting, or labels.
| Name | Type | Req | Description |
|---|---|---|---|
| auto_delete | boolean | – | Delete the primary IP when the assignee is deleted |
| id | integer | yes | Primary IP ID |
| labels | object | – | Labels as key-value pairs |
| name | string | – | New name |
No output schema declared.
No examples provided.
hetzner_update_server Update Server ~50
Update a server's name or labels.
| Name | Type | Req | Description |
|---|---|---|---|
| id | integer | yes | Server ID |
| labels | object | – | Labels as key-value pairs |
| name | string | – | New server name |
No output schema declared.
No examples provided.
hetzner_update_ssh_key Update SSH Key ~55
Update an SSH key's name or labels.
| Name | Type | Req | Description |
|---|---|---|---|
| id | integer | yes | SSH key ID |
| labels | object | – | Labels as key-value pairs |
| name | string | – | New SSH key name |
No output schema declared.
No examples provided.
hetzner_update_storage_box Update Storage Box ~58
Update the name and/or labels of a Storage Box.
| Name | Type | Req | Description |
|---|---|---|---|
| id | integer | yes | Storage Box ID |
| labels | object | – | Labels as key-value pairs |
| name | string | – | New name for the Storage Box |
No output schema declared.
No examples provided.
hetzner_update_storage_box_access_settings Update Storage Box Access Settings ~137
Update which access protocols (SSH, Samba, WebDAV, ZFS, external reachability) are enabled on a Storage Box.
| Name | Type | Req | Description |
|---|---|---|---|
| id | integer | yes | Storage Box ID |
| reachable_externally | boolean | – | Whether the Storage Box is reachable from outside the Hetzner network |
| samba_enabled | boolean | – | Whether Samba/CIFS access is enabled |
| ssh_enabled | boolean | – | Whether SSH/SFTP/SCP access is enabled |
| webdav_enabled | boolean | – | Whether WebDAV access is enabled |
| zfs_enabled | boolean | – | Whether the ZFS snapshot directory is exposed |
No output schema declared.
No examples provided.
hetzner_update_storage_box_snapshot Update Storage Box Snapshot ~69
Update the description and/or labels of a Storage Box snapshot.
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | – | New description for the snapshot |
| id | integer | yes | Storage Box ID |
| labels | object | – | Labels as key-value pairs |
| snapshot_id | integer | yes | Snapshot ID |
No output schema declared.
No examples provided.
hetzner_update_storage_box_subaccount Update Storage Box Subaccount ~91
Update the name, description, and/or labels of a Storage Box subaccount.
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | – | New description for the subaccount |
| id | integer | yes | Storage Box ID |
| labels | object | – | Labels as key-value pairs |
| name | string | – | New display name for the subaccount |
| subaccount_id | integer | yes | Subaccount ID |
No output schema declared.
No examples provided.
hetzner_update_storage_box_subaccount_access_settings Update Storage Box Subaccount Access Settings ~161
Update the access settings (read-only, SSH, Samba, WebDAV, external reachability) of a Storage Box subaccount.
| Name | Type | Req | Description |
|---|---|---|---|
| id | integer | yes | Storage Box ID |
| reachable_externally | boolean | – | Whether the subaccount is reachable from outside the Hetzner network |
| readonly | boolean | – | Whether the subaccount has read-only access |
| samba_enabled | boolean | – | Whether Samba/CIFS access is enabled for the subaccount |
| ssh_enabled | boolean | – | Whether SSH/SFTP/SCP access is enabled for the subaccount |
| subaccount_id | integer | yes | Subaccount ID |
| webdav_enabled | boolean | – | Whether WebDAV access is enabled for the subaccount |
No output schema declared.
No examples provided.
hetzner_update_volume Update Volume ~50
Update a volume's name or labels.
| Name | Type | Req | Description |
|---|---|---|---|
| id | integer | yes | Volume ID |
| labels | object | – | Labels as key-value pairs |
| name | string | – | New volume name |
No output schema declared.
No examples provided.
hetzner_update_zone Update DNS Zone ~53
Update a DNS zone's labels. Other zone properties are managed via dedicated change_* action tools.
| Name | Type | Req | Description |
|---|---|---|---|
| id_or_name | – | yes | Zone ID or name |
| labels | object | – | Labels as key-value pairs |
No output schema declared.
No examples provided.
hetzner_update_zone_rrset Update DNS Zone RRSet ~89
Update an RRSet's labels. Records and TTL are managed via dedicated action tools.
| Name | Type | Req | Description |
|---|---|---|---|
| id_or_name | – | yes | Zone ID or name |
| labels | object | – | Labels as key-value pairs |
| name | string | yes | RRSet name |
| type | string | yes | DNS record type (A, AAAA, CNAME, MX, NS, TXT, etc.) |
No output schema declared.
No examples provided.
hetzner_update_zone_rrset_records Update DNS Zone RRSet Record Comments ~100
Update the comment on existing records in an RRSet (matched by value). The comment field is always sent — use an empty string to clear.
| Name | Type | Req | Description |
|---|---|---|---|
| id_or_name | – | yes | Zone ID or name |
| name | string | yes | RRSet name |
| records | array | yes | Records to update |
| type | string | yes | DNS record type (A, AAAA, CNAME, MX, NS, TXT, etc.) |
No output schema declared.
No examples provided.
What is the io.github.lazyants/hetzner MCP server?
io.github.lazyants/hetzner is an MCP server listed in the public MCP registry as io.github.lazyants/hetzner. MCP server for the Hetzner Cloud API, servers, networks, volumes, firewalls, and more. This page covers its npm package (@lazyants/hetzner-mcp-server).
Is the io.github.lazyants/hetzner MCP server safe to use?
io.github.lazyants/hetzner scores 91 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 21 September 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.lazyants/hetzner MCP server expose?
io.github.lazyants/hetzner exposes 185 tools: hetzner_list_servers, hetzner_get_server, hetzner_create_server, hetzner_update_server, hetzner_delete_server, and 180 more. Their descriptions and schemas cost roughly 13,289 tokens of context every time the server is loaded.
Is the io.github.lazyants/hetzner MCP server still maintained?
io.github.lazyants/hetzner is still listed as active in the MCP registry. We last reached this channel on 21 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.lazyants/hetzner MCP server under?
io.github.lazyants/hetzner declares the FSL-1.1-MIT licence, which is not on the OSI-approved list. Read the terms before using it at work, and note this covers the source only, not the cost of any service it calls.