Hetzner Cloud Mcp Server

@wbf-solutions

About Hetzner Cloud Mcp Server

The Hetzner MCP with SSH server management. 60 tools — Cloud API + SSH in one MCP server.

#hetzner-cloud-api #hetzner-cloud-ssh #mcp-server

Config

Add this server to your MCP-compatible client using the configuration below.

{
  "mcpServers": {
    "hetzner-cloud": {
      "url": "https://your-server.com/api.php?mcp=sse&key=YOUR_API_KEY"
    }
  }
}

Tools

No tools detected

We auto-extract tools from the README. The maintainer can list them under a ## Tools heading to populate this section.

Overview

What is Hetzner Cloud MCP Server?

An MCP server that lets you manage Hetzner Cloud infrastructure from any MCP-compatible client (Claude.ai, Claude Desktop, VS Code, Cursor). It combines the Hetzner Cloud API (25 tools for power, metrics, snapshots, firewalls, DNS) with a full SSH management layer (27 tools for services, logs, Nginx, MySQL, system health) — 60 tools total. Built for sysadmins and developers who need both API and server‑level control.

How to use Hetzner Cloud MCP Server?

Clone the repository, install dependencies with Composer, copy .env.example to .env, and set your Hetzner API token, server details, SSH key path, and an API key. Configure an Nginx reverse proxy with PHP‑FPM (fastcgi_buffering off required for SSE). Then add a custom connector in Claude.ai, Claude Desktop, or another client, pointing to https://yourdomain.com/api.php with the API key passed as ?key=XXX or Authorization: Bearer. Tools are invoked via MCP tool calls.

Key features of Hetzner Cloud MCP Server

Two management layers: Cloud API and SSH
60 tools covering server, DNS, and SSH operations
Dynamic multi‑server configuration (1 to N servers)
Destructive guards (confirmation required for dangerous ops)
Transport via SSE and Streamable HTTP
Self‑hosted, open source (MIT), PHP 8.1+

Use cases of Hetzner Cloud MCP Server

Manage Hetzner servers through Claude.ai or Claude Desktop from any device
Perform sysadmin tasks: restart services, tail logs, check memory, firewall status
Automate server provisioning: snapshots, backups, rescale, rebuild
Manage DNS zones and records without leaving your AI chat
Monitor system health and run read‑only SQL queries

FAQ from Hetzner Cloud MCP Server

What are the two management layers?

Layer 1 (Hetzner Cloud API) handles server power, metrics, snapshots, firewalls, DNS, rescue, rebuild — works even if the OS is unresponsive. Layer 2 (SSH) gives real sysadmin tools: service control, logs, Nginx, MySQL, supervisor, cron, UFW, disk/memory/CPU monitoring.

How do I authenticate with this MCP server?

You can run without authentication (behind a VPN/firewall), use a static API key (MCP_API_KEY), or add OAuth 2.1 token introspection for multi‑user deployments. Clients pass the key as ?key=XXX or via Authorization: Bearer header.

Can I manage multiple servers?

Yes. Define any number of servers in the .env file with SERVERS=web,staging and individual SERVER_* variables for ID, IP, SSH user, and aliases. SSH tools are auto‑directed to the configured server.

What security measures are in place?

Dangerous operations require confirm=true. SSH commands block 29 dangerous patterns (e.g., rm -rf, dd, mkfs). SQL is restricted to SELECT, SHOW, DESCRIBE, EXPLAIN only. Rate limiting uses atomic flock() per IP.

Do I need SSH access for all tools?

No. Cloud API tools (server power, metrics, snapshots, firewalls, DNS) work without SSH. SSH‑based tools (service management, logs, MySQL, etc.) require an SSH key configured for the server and SSH_KEY_PATH set in the .env file. If SSH is not configured, those tools are automatically disabled.

Frequently asked questions

What are the two management layers?

How do I authenticate with this MCP server?

You can run without authentication (behind a VPN/firewall), use a static API key (`MCP_API_KEY`), or add OAuth 2.1 token introspection for multi‑user deployments. Clients pass the key as `?key=XXX` or via `Authorization: Bearer` header.

Can I manage multiple servers?

Yes. Define any number of servers in the `.env` file with `SERVERS=web,staging` and individual `SERVER_*` variables for ID, IP, SSH user, and aliases. SSH tools are auto‑directed to the configured server.

What security measures are in place?

Dangerous operations require `confirm=true`. SSH commands block 29 dangerous patterns (e.g., `rm -rf`, `dd`, `mkfs`). SQL is restricted to `SELECT`, `SHOW`, `DESCRIBE`, `EXPLAIN` only. Rate limiting uses atomic `flock()` per IP.

Do I need SSH access for all tools?

No. Cloud API tools (server power, metrics, snapshots, firewalls, DNS) work without SSH. SSH‑based tools (service management, logs, MySQL, etc.) require an SSH key configured for the server and `SSH_KEY_PATH` set in the `.env` file. If SSH is not configured, those tools are automatically disabled.

Comments

Basic information

More Developer Tools MCP servers

Apiosk

obcraft

AI-native payments for tools and APIs. Discover, pay for, execute, and publish monetized APIs directly from your agent, settled per call in USDC over x402, through the Model Context Protocol. payments · finance · x402 ·

Raccha AI

Shree Mandadi

MCP-first toolbox for agents: namespaced key-value storage, a FIFO queue, auth, and a handful of stateless utility tools (JWT decode, hashing, cert inspection, CIDR math). Free while in early access. This repository is a

Codex Pets

astandrik

Public read-only MCP server for discovering, inspecting, installing, and sharing approved Codex-compatible animated pet packs.

Termany

thinkany-ai

Agent-Native Terminal

174

Windframe

Windframe MCP gives your AI the design taste needed to create consistent, production-ready UI that feels intentionally designed. Available at https://windframe.dev/mcp