hetzner_add_lb_service
Add a service (port listener with forwarding rules) to a load balancer.
LABSCO SUMMARY
The tool descriptions carry Hetzner's own dated deprecations and behaviour changes, which is unusual in a wrapper and useful in practice.
The datacenter tools are marked as removed by Hetzner after 2026-10-01 and point at the server-type and location tools instead, and the IP deletions note that the address must be unassigned first or the API refuses. The destructive verbs are just as explicit: rebuilding a server wipes all data on it, deleting a Storage Box takes its contents, disabling backups removes the existing snapshots, and enabling them raises the server price by 20 percent. Rate limiting is handled for you, with backoff on a 429 rather than a failed call.
What it is
A Hetzner Cloud client covering a project's compute, network, storage and DNS objects, with the protection toggles and per-object action logs Hetzner exposes alongside them. It ships as nine separate entry points as well as one complete server, so you can register only the domains you need and keep a client's tool list manageable.
What you get
- Server lifecycle: hetzner_create_server with image, server type, location, networks, firewalls, SSH keys and user data, then hetzner_power_on, hetzner_shutdown, hetzner_reboot, hetzner_reset, hetzner_rebuild_server and hetzner_resize_server.
- Recovery paths that do not need a console of your own: hetzner_enable_rescue, hetzner_request_console for a noVNC WebSocket URL valid for a limited time, and hetzner_reset_server_password, which reboots the server and returns the new root password.
- Networking: hetzner_create_network with its IP range, subnets and routes, hetzner_attach_server_to_network, hetzner_change_alias_ips, and hetzner_change_ip_range, which expands a range but will not shrink one.
- Firewalls and load balancers: hetzner_create_firewall, hetzner_set_firewall_rules and hetzner_apply_firewall; on the balancer side hetzner_add_lb_service with health checks, hetzner_add_lb_target, hetzner_change_lb_algorithm and hetzner_get_lb_metrics.
- Storage: hetzner_create_volume, hetzner_attach_volume and hetzner_resize_volume, which only grows a volume, plus the Storage Box family — access settings for SSH, Samba, WebDAV and ZFS, subaccounts scoped to a home directory, and hetzner_enable_storage_box_snapshot_plan for schedule and retention.
- Addressing: floating IPs and primary IPs each with create, assign, unassign, reverse-DNS and protection tools, and hetzner_change_dns_ptr for a server's own public IPv4 or IPv6.
- DNS zones in primary or secondary mode: hetzner_create_zone, hetzner_import_zonefile and hetzner_export_zonefile, the RRSet tools for records, and hetzner_change_zone_rrset_protection against accidental edits.
- Delete protection as its own verb on every object type — hetzner_change_server_protection, hetzner_change_volume_protection, hetzner_change_network_protection and their siblings — with action logs such as hetzner_list_server_actions to read what happened.
- Cost and capacity reads: hetzner_get_pricing across servers, volumes, traffic, floating IPs and load balancers, plus hetzner_list_server_types, hetzner_list_lb_types and hetzner_list_storage_box_types.
- A read-only API-reference resource is exposed on every entry point, so the agent can look up the underlying API without leaving the session.
Requirements
A Hetzner Cloud project API token in HETZNER_API_TOKEN, made in the console under Security. Use a read-only token when you only intend to look: create, update and delete here bill against your real account. The Storage Box tools call a different Hetzner host and will use HETZNER_STORAGE_API_TOKEN if you set one, falling back to the main token otherwise. If the full tool list is too much for your client, point it at one of the split entry points — servers, networking, load balancers, IPs, storage, Storage Boxes, config or DNS — instead of the complete server.
Setup effort
One command plus a key — npm install -g @lazyants/hetzner-mcp-server, then supply credentials
USE CASES
01
Standing up a server with its network and firewall already attached
Create it with the image, type, location, SSH keys, network and firewall in the same call, rather than provisioning and then wiring it up.
02
Getting back into a machine you can no longer reach
Turn on rescue mode and reboot, or take the console URL, or reset the root password and read the new one out of the result.
03
Putting a load balancer in front of a set of servers
Create it, add the service with its health check, add the targets, and watch the metrics rather than guessing at distribution.
04
Running DNS for a domain out of the same project
Create the zone, import an existing zonefile rather than retyping it, then manage the records as RRSets.
05
Making sure nothing important can be deleted by accident
Turn protection on per object — server, volume, network, zone — and read the action log when you need to know what already happened.
06
Adding storage with a snapshot schedule behind it
Create the volume or Storage Box, set the access methods you actually want, and put a snapshot plan with a retention behind it.
07
Working out what a change will cost before making it
Read the current prices for servers, volumes, traffic, IPs and balancers, and compare server types before resizing.
185 tools
Counted once with only startup setup. Other versions, modes or optional credentials may expose a different list.
hetzner_add_lb_target
Add a target (server, label selector, or IP) to a load balancer.
hetzner_add_route
Add a route to an existing network.
hetzner_add_server_to_placement_group
Add a server to a placement group. The server must be powered off before it can be added.
hetzner_add_subnet
Add a subnet to an existing network.
hetzner_add_zone_rrset_records
Add new records to an existing RRSet without removing existing ones. Optionally update the RRSet TTL.
hetzner_apply_firewall
Apply a firewall to one or more servers or label selectors.
hetzner_assign_floating_ip
Assign a floating IP to a server in the same location.
hetzner_assign_primary_ip
Assign a primary IP to a server.
hetzner_attach_iso
Attach an ISO image to a server. The server must be rebooted to boot from the ISO.
hetzner_attach_lb_to_network
Attach a load balancer to a network.
hetzner_attach_server_to_network
Attach a server to a private network, optionally assigning a specific IP, alias IPs, or IP range.
hetzner_attach_volume
Attach a volume to a server. The server and volume must be in the same location.
hetzner_change_alias_ips
Replace the alias IPs that a server has on a private network. The list overrides any existing alias IPs for that network.
hetzner_change_dns_ptr
Change the reverse DNS entry for one of a server's public IPv4 or IPv6 addresses. Set dns_ptr to null to reset to the default.
hetzner_change_floating_ip_protection
Enable or disable delete protection on a floating IP to guard against accidental destruction.
hetzner_change_floating_ip_rdns
Change the reverse DNS entry for a floating IP. Set dns_ptr to null to reset.
hetzner_change_image_protection
Enable or disable delete protection on a snapshot or backup image to guard against accidental destruction.
hetzner_change_ip_range
Expand the IP range of an existing network. The new CIDR range must contain the current range; shrinking is not supported.
hetzner_change_lb_algorithm
Change the balancing algorithm of a load balancer.
hetzner_change_lb_dns_ptr
Change the reverse DNS entry for one of a load balancer's public IP addresses. Set dns_ptr to null to reset to the default.
hetzner_change_lb_type
Change the type (plan) of a load balancer.
hetzner_change_load_balancer_protection
Enable or disable delete protection on a load balancer to guard against accidental destruction.
hetzner_change_network_protection
Enable or disable delete protection on a network to guard against accidental destruction.
hetzner_change_primary_ip_protection
Enable or disable delete protection on a primary IP to guard against accidental destruction.
hetzner_change_primary_ip_rdns
Change the reverse DNS entry for a primary IP. Set dns_ptr to null to reset.
hetzner_change_server_protection
Enable or disable delete and rebuild protection on a server to guard against accidental destruction.
hetzner_change_storage_box_protection
Enable or disable delete protection on a Storage Box to guard against accidental destruction.
hetzner_change_storage_box_subaccount_home_directory
Change the home directory a Storage Box subaccount is scoped to.
hetzner_change_storage_box_type
Change the type (capacity tier) of a Storage Box. The new type must have at least the current usage capacity.
hetzner_change_volume_protection
Enable or disable delete protection on a volume to guard against accidental destruction.
hetzner_change_zone_primary_nameservers
Replace the list of primary nameservers used by a secondary DNS zone for AXFR/IXFR transfers.
hetzner_change_zone_protection
Enable or disable delete protection on a DNS zone to guard against accidental destruction.
hetzner_change_zone_rrset_protection
Enable or disable change protection on an RRSet to guard against accidental modification or deletion.
hetzner_change_zone_rrset_ttl
Change the TTL of an RRSet. Pass ttl=null to fall back to the zone default TTL.
hetzner_change_zone_ttl
Change the default TTL applied to records in a DNS zone that do not have an explicit TTL.
hetzner_create_certificate
Create an uploaded certificate (provide PEM data) or a managed certificate (provide domain names).
hetzner_create_firewall
Create a new firewall with optional rules and resource assignments.
hetzner_create_floating_ip
Create a new floating IP. Either home_location or server must be provided.
hetzner_create_image
Create a snapshot image from an existing server.
hetzner_create_load_balancer
Create a new load balancer with the specified type, location, and optional targets and services.
hetzner_create_network
Create a new network with the specified IP range, and optionally subnets and routes.
hetzner_create_placement_group
Create a new placement group to control server distribution across hosts.
hetzner_create_primary_ip
Create a new primary IP with the specified type and optional assignee type.
hetzner_create_server
Create a new server with the specified type, image, and configuration options.
hetzner_create_ssh_key
Add a new SSH public key to the project for use when creating servers.
hetzner_create_storage_box
Create a new Storage Box in the given location and type. Billing applies for the provisioned resource.
hetzner_create_storage_box_snapshot
Create a manual snapshot of a Storage Box, optionally with a description and labels.
hetzner_create_storage_box_subaccount
Create a subaccount on a Storage Box, scoped to a home directory with its own password and access settings.
hetzner_create_volume
Create a new volume. Either location or server must be provided to determine placement.
hetzner_create_zone
Create a new DNS zone in primary or secondary mode. Optionally provide TTL, primary nameservers (for secondary), initial RRSets, or a zonefile.
hetzner_create_zone_rrset
Create a new RRSet (record set) inside a DNS zone.
hetzner_delete_certificate
Delete a certificate. It must not be in use by any load balancer.
hetzner_delete_firewall
Delete a firewall. It must be removed from all resources first.
hetzner_delete_floating_ip
Delete a floating IP permanently. Since 2026-05-01 the floating IP must be unassigned first; otherwise the API returns the must_be_unassigned error code.
hetzner_delete_image
Permanently delete a snapshot or backup image.
hetzner_delete_lb_service
Remove a service from a load balancer by its listen port.
hetzner_delete_load_balancer
Permanently delete a load balancer.
hetzner_delete_network
Delete a network. All subnets and routes within it will also be deleted.
hetzner_delete_placement_group
Delete a placement group. All servers must be removed from it first.
hetzner_delete_primary_ip
Delete a primary IP permanently. Since 2026-05-01 the primary IP must be unassigned first; otherwise the API returns the must_be_unassigned error code.
hetzner_delete_route
Remove a route from an existing network.
hetzner_delete_server
Permanently delete a server. This destroys the server and all associated data.
hetzner_delete_ssh_key
Delete an SSH key from the project permanently.
hetzner_delete_storage_box
Delete a Storage Box and all of its data permanently. The Storage Box must not be delete-protected.
hetzner_delete_storage_box_snapshot
Delete a Storage Box snapshot permanently.
hetzner_delete_storage_box_subaccount
Delete a Storage Box subaccount permanently. Its home directory contents are not removed.
hetzner_delete_subnet
Remove a subnet from an existing network by its IP range.
hetzner_delete_volume
Delete a volume permanently. The volume must be detached from any server.
hetzner_delete_zone
Delete a DNS zone and all of its RRSets permanently. The zone must not be delete-protected.
hetzner_delete_zone_rrset
Delete an RRSet from a DNS zone permanently. The RRSet must not be change-protected.
hetzner_detach_iso
Detach an ISO image from a server. The server must be rebooted for the change to take effect.
hetzner_detach_lb_from_network
Detach a load balancer from a network.
hetzner_detach_server_from_network
Detach a server from a private network, removing its private connectivity on that network.
hetzner_detach_volume
Detach a volume from the server it is attached to.
hetzner_disable_backup
Disable automatic backups for a server and remove all existing backup snapshots.
hetzner_disable_lb_public_interface
Disable the public network interface of a load balancer, removing its public connectivity.
hetzner_disable_rescue
Disable rescue mode on a server. The next reboot will boot normally.
hetzner_disable_storage_box_snapshot_plan
Disable the automatic snapshot plan for a Storage Box. Existing snapshots are kept.
hetzner_enable_backup
Enable automatic daily backups for a server. Backups increase the server price by 20 percent. The backup window is chosen automatically.
hetzner_enable_lb_public_interface
Enable the public network interface of a load balancer so it can be reached over public IPs.
hetzner_enable_rescue
Enable rescue mode on a server. The server must be rebooted to enter rescue mode.
hetzner_enable_storage_box_snapshot_plan
Enable or update the automatic snapshot plan for a Storage Box (schedule and retention).
hetzner_export_zonefile
Export the current contents of a DNS zone as an RFC 1035 zonefile string.
hetzner_get_certificate
Get details of a specific certificate by its ID.
hetzner_get_datacenter
Deprecated by Hetzner; /datacenters is removed after 2026-10-01 (HTTP 410). Use hetzner_list_server_types (locations[].available/recommended) and hetzner_list_locations instead.
hetzner_get_firewall
Get details of a specific firewall by its ID.
hetzner_get_floating_ip
Get details of a specific floating IP by ID.
hetzner_get_image
Get details of a specific image by ID.
hetzner_get_iso
Get details of a specific ISO image by ID.
hetzner_get_lb_metrics
Get metrics for a load balancer over a specified time range.
hetzner_get_load_balancer
Get details of a specific load balancer by its ID.
hetzner_get_location
Get details of a specific location by ID.
hetzner_get_network
Get details of a specific network by its ID.
hetzner_get_placement_group
Get details of a specific placement group by ID.
hetzner_get_pricing
Get current prices for all Hetzner Cloud resources (servers, volumes, traffic, floating IPs, load balancers, and more).
hetzner_get_primary_ip
Get details of a specific primary IP by ID.
hetzner_get_server
Get details of a specific server by ID.
hetzner_get_server_metrics
Retrieve time series metrics (CPU, disk, network) for a server over a time range.
hetzner_get_server_type
Get details of a specific server type, including specs and pricing.
hetzner_get_ssh_key
Get details of a specific SSH key by ID.
hetzner_get_storage_box
Get details of a specific Storage Box by ID.
hetzner_get_storage_box_snapshot
Get details of a specific Storage Box snapshot by ID.
hetzner_get_storage_box_subaccount
Get details of a specific Storage Box subaccount by ID.
hetzner_get_storage_box_type
Get details of a specific Storage Box type by ID, including capacity and pricing.
hetzner_get_volume
Get details of a specific volume by ID.
hetzner_get_zone
Get details of a specific DNS zone by its numeric ID or zone name (e.g. "example.com").
hetzner_get_zone_rrset
Get a specific RRSet by zone, name, and record type.
hetzner_import_zonefile
Replace the contents of a DNS zone with the given RFC 1035 zonefile. This overwrites all existing RRSets.
hetzner_list_certificate_actions
List all actions performed on a specific certificate, such as issuance and renewal retries.
hetzner_list_certificates
List all SSL/TLS certificates in the project, with optional filtering.
hetzner_list_datacenters
Deprecated by Hetzner; /datacenters is removed after 2026-10-01 (HTTP 410). Use hetzner_list_server_types (locations[].available/recommended) and hetzner_list_locations instead.
hetzner_list_firewall_actions
List all actions performed on a specific firewall, such as rule and resource attachment changes.
hetzner_list_firewalls
List all firewalls in the project, with optional filtering by name or labels.
hetzner_list_floating_ip_actions
List all actions performed on a specific floating IP, such as assign, unassign, and rDNS changes.
hetzner_list_floating_ips
List all floating IPs in the project, with optional filtering by name or label.
hetzner_list_image_actions
List all actions performed on a specific image, such as snapshot creation and protection changes.
hetzner_list_images
List all available images, including system, snapshot, and backup images.
hetzner_list_isos
List all available ISO images for mounting on servers.
hetzner_list_lb_types
List all available load balancer types with pricing and limits.
hetzner_list_load_balancer_actions
List all actions performed on a specific load balancer, such as service changes and target attachments.
hetzner_list_load_balancers
List all load balancers in the project, with optional filtering by name or labels.
hetzner_list_locations
List all available Hetzner Cloud locations (regions).
hetzner_list_network_actions
List all actions performed on a specific network, such as subnet and route changes.
hetzner_list_networks
List all networks in the project, with optional filtering by name or labels.
hetzner_list_placement_groups
List all placement groups in the project.
hetzner_list_primary_ip_actions
List all actions performed on a specific primary IP, such as assign, unassign, and rDNS changes.
hetzner_list_primary_ips
List all primary IPs in the project, with optional filtering by name, label, or IP address.
hetzner_list_server_actions
List all actions for a specific server, such as power changes and rebuilds.
hetzner_list_server_types
List all available server types with their specs and pricing.
hetzner_list_servers
List all servers in the project, with optional filtering by name, label, or status.
hetzner_list_ssh_keys
List all SSH keys in the project, with optional filtering by name, label, or fingerprint.
hetzner_list_storage_box_actions
List all actions performed on a specific Storage Box, such as type changes and password resets.
hetzner_list_storage_box_folders
List the folders inside a Storage Box, optionally under a given path.
hetzner_list_storage_box_snapshots
List the snapshots of a Storage Box, with optional filtering by name, labels, or automatic-vs-manual.
hetzner_list_storage_box_subaccounts
List the subaccounts of a Storage Box, with optional filtering by name, username, or labels.
hetzner_list_storage_box_types
List all available Storage Box types with their capacity, limits, and pricing.
hetzner_list_storage_boxes
List all Storage Boxes in the project, with optional filtering by name or labels.
hetzner_list_volume_actions
List all actions performed on a specific volume, such as attach, detach, and resize operations.
hetzner_list_volumes
List all volumes in the project, with optional filtering by name, label, or status.
hetzner_list_zone_actions
List all actions performed on a specific DNS zone, such as imports, TTL changes, and protection toggles.
hetzner_list_zone_rrsets
List all RRSets in a DNS zone, with optional filtering by name, type, or labels.
hetzner_list_zones
List all DNS zones in the project, with optional filtering by name, mode (primary/secondary), or labels.
hetzner_power_off
Force power off a server immediately. This is like pulling the power cord.
hetzner_power_on
Start a stopped server by powering it on.
hetzner_reboot
Send an ACPI reboot signal to the server for a soft reboot.
hetzner_rebuild_server
Rebuild a server from an image, wiping all data on the server.
hetzner_remove_firewall
Remove a firewall from one or more servers or label selectors.
hetzner_remove_lb_target
Remove a target from a load balancer.
hetzner_remove_server_from_placement_group
Remove a server from its placement group.
hetzner_remove_zone_rrset_records
Remove specific records from an RRSet (matched by value) without deleting the RRSet itself.
hetzner_request_console
Request a noVNC WebSocket URL and credentials to access the server console. The URL is valid for a limited time.
hetzner_reset
Perform a hard reset on the server, equivalent to pressing the reset button.
hetzner_reset_server_password
Reset the root password of a server. The server is rebooted and a new root password is returned in the result.
hetzner_reset_storage_box_password
Reset the password of a Storage Box main account to the supplied value.
hetzner_reset_storage_box_subaccount_password
Reset the password of a Storage Box subaccount to the supplied value.
hetzner_resize_server
Change the server type. The server will be stopped and migrated if needed.
hetzner_resize_volume
Increase the size of a volume. Volumes can only be made larger, not smaller.
hetzner_retry_certificate
Retry issuance or renewal of a managed certificate that has failed.
hetzner_rollback_storage_box_snapshot
Roll a Storage Box back to a snapshot. This overwrites current data with the snapshot contents.
hetzner_set_firewall_rules
Replace all rules of a firewall with a new set of rules.
hetzner_set_zone_rrset_records
Replace the full list of records in an RRSet. Existing records not in the payload are removed.
hetzner_shutdown
Send an ACPI shutdown signal for a graceful OS shutdown.
hetzner_unassign_floating_ip
Unassign a floating IP from the server it is currently assigned to.
hetzner_unassign_primary_ip
Unassign a primary IP from the server it is currently assigned to.
hetzner_update_certificate
Update a certificate name or labels.
hetzner_update_firewall
Update a firewall name or labels.
hetzner_update_floating_ip
Update a floating IP's name, description, or labels.
hetzner_update_image
Update an image's description, type, or labels.
hetzner_update_lb_service
Update an existing service on a load balancer.
hetzner_update_load_balancer
Update a load balancer name or labels.
hetzner_update_network
Update properties of a network such as name, labels, or vSwitch route exposure.
hetzner_update_placement_group
Update a placement group's name or labels.
hetzner_update_primary_ip
Update a primary IP's name, auto_delete setting, or labels.
hetzner_update_server
Update a server's name or labels.
hetzner_update_ssh_key
Update an SSH key's name or labels.
hetzner_update_storage_box
Update the name and/or labels of a Storage Box.
hetzner_update_storage_box_access_settings
Update which access protocols (SSH, Samba, WebDAV, ZFS, external reachability) are enabled on a Storage Box.
hetzner_update_storage_box_snapshot
Update the description and/or labels of a Storage Box snapshot.
hetzner_update_storage_box_subaccount
Update the name, description, and/or labels of a Storage Box subaccount.
hetzner_update_storage_box_subaccount_access_settings
Update the access settings (read-only, SSH, Samba, WebDAV, external reachability) of a Storage Box subaccount.
hetzner_update_volume
Update a volume's name or labels.
hetzner_update_zone
Update a DNS zone's labels. Other zone properties are managed via dedicated change_* action tools.
hetzner_update_zone_rrset
Update an RRSet's labels. Records and TTL are managed via dedicated action tools.
hetzner_update_zone_rrset_records
Update the comment on existing records in an RRSet (matched by value). The comment field is always sent — use an empty string to clear.
BEFORE YOU INSTALL
What to know first
Tools you get
185 tools when we connected. Split binaries load subsets, such as hetzner-mcp-servers with 34 or hetzner-mcp-dns with 22. hetzner_list_datacenters and hetzner_get_datacenter are deprecated by Hetzner and removed after 2026-10-01.
Requires
- npx on PATH
- HETZNER_API_TOKEN in your environment
CONTEXT COST
Heavy Standing cost
Rated by the size of the 185 tool definitions that ride along on every turn, not by how many there are
INSTALLATION
Connect your client
Server setup
TERMINAL
npm install -g @lazyants/hetzner-mcp-serverMCP Clients
Claude Code, Claude Desktop
JSON
{
"mcpServers": {
"hetzner": {
"command": "npx",
"args": [
"-y",
"@lazyants/hetzner-mcp-server"
],
"env": {
"HETZNER_API_TOKEN": "<YOUR_HETZNER_API_TOKEN>"
}
}
}
}Claude Code — split servers
CLAUDE CODE — SPLIT SERVERS · JSON
{
"mcpServers": {
"hetzner-servers": {
"command": "npx",
"args": [
"-y",
"-p",
"@lazyants/hetzner-mcp-server",
"hetzner-mcp-servers"
],
"env": {
"HETZNER_API_TOKEN": "<YOUR_HETZNER_API_TOKEN>"
}
},
"hetzner-networking": {
"command": "npx",
"args": [
"-y",
"-p",
"@lazyants/hetzner-mcp-server",
"hetzner-mcp-networking"
],
"env": {
"HETZNER_API_TOKEN": "<YOUR_HETZNER_API_TOKEN>"
}
}
}
}
