Hetzner Cloud (unofficial) MCP Server

Connect this server

This server runs on your own machine — install it with the package manager and the client starts it for you. Package name taken from the official registry entry.

claude mcp add the-real-hetzner-mcp -e 'HETZNER_API_TOKEN=<HETZNER_API_TOKEN>' -- npx -y @mguttmann/hetzner-cloud-mcp

{
  "mcpServers": {
    "the-real-hetzner-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@mguttmann/hetzner-cloud-mcp"
      ],
      "env": {
        "HETZNER_API_TOKEN": "<HETZNER_API_TOKEN>"
      }
    }
  }
}

[mcp_servers.the-real-hetzner-mcp]
command = "npx"
args = ["-y", "@mguttmann/hetzner-cloud-mcp"]
env = { HETZNER_API_TOKEN = "<HETZNER_API_TOKEN>" }

{
  "mcpServers": {
    "the-real-hetzner-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@mguttmann/hetzner-cloud-mcp"
      ],
      "env": {
        "HETZNER_API_TOKEN": "<HETZNER_API_TOKEN>"
      }
    }
  }
}

{
  "servers": {
    "the-real-hetzner-mcp": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "@mguttmann/hetzner-cloud-mcp"
      ],
      "env": {
        "HETZNER_API_TOKEN": "<HETZNER_API_TOKEN>"
      }
    }
  }
}

Put your own value in place of <HETZNER_API_TOKEN> (Hetzner Cloud API token from the Cloud Console (project > Security > API tokens). The server can do exactly what this token allows; use a Read token if the client only needs to read). The author’s registry entry marks it as required.

Optional settings from the registry entry, left out of the block above: HETZNER_READ_ONLY (true: every tool that is not read-only, and hcloud_raw_request with a method other than GET, returns an error without sending a request. Any value other than true, 1, yes, false, 0, no or empty stops the server at startup), HETZNER_CONFIRM_WRITES (true: every tool that is not read-only returns a preview unless the call carries confirm "YES". Friction against mistakes, not a security boundary), HETZNER_DENY_TOOLS (Comma-separated tool name globs (for example hcloud_delete_*,hcloud_raw_request) that always return an error. Deny hcloud_raw_request as well, otherwise denied endpoints stay reachable through it. A pattern that matches no tool stops the server at startup), LOG_LEVEL (Log level of the JSON logs on stderr).