Summary

Sync is dry-run first, and it says what it will not touch.

The two-Pi-hole story is the standout: diff is read-only, and sync writes in one direction only, returns a plan with a single-use confirm token before changing anything, takes a teleporter backup first, and deliberately never syncs DHCP, interface bindings, passwords, TLS certificates or 2FA. Elsewhere the same connection that reads your stats can restart DNS and rewrite your blocklists, so it is worth using an application password you can revoke.

What it is

An MCP server for the Pi-hole v6 REST API, shipped as a single Go binary. It covers the whole admin surface rather than a read-only slice: statistics and query log on one side, domain lists, groups, clients, configuration and service actions on the other. Point it at more than one Pi-hole and two extra tools appear for keeping them aligned.

What you get

`pihole_padd` — a one-call snapshot: queries, blocking state, top domain and client, cache, versions and host health
Blocking control — `pihole_dns_get_blocking` and `pihole_dns_set_blocking`, the latter with an optional timer
Statistics — `pihole_stats_summary`, `pihole_stats_top_domains`, `pihole_stats_top_clients`, `pihole_stats_upstreams`, `pihole_stats_query_types`, `pihole_stats_recent_blocked`, plus the long-term database equivalents
Query log — `pihole_queries_search` with 12 filters and cursor pagination, `pihole_queries_suggestions` for the available filter values, and `pihole_search_domains` for a cross-list lookup
List management — `pihole_domains_list`, `pihole_domains_add`, `pihole_domains_update`, `pihole_domains_delete`, `pihole_domains_batch_delete`, and the same shape for `pihole_groups_list/add/update/delete/batch_delete`, `pihole_clients_list/suggestions/add/update/delete` and `pihole_lists_list/add/update/delete/batch_delete`
System and actions — `pihole_info_system`, `pihole_info_version`, `pihole_info_messages`, `pihole_action_gravity_update`, `pihole_action_restart_dns`, `pihole_network_devices`, `pihole_dhcp_leases`, `pihole_teleporter_export` and `pihole_teleporter_import`
Configuration by dotted path — `pihole_config_get`, `pihole_config_set`, `pihole_config_get_value`, `pihole_config_add_value`, `pihole_config_remove_value`
76 tools for a single Pi-hole; a second instance registers `pihole_instance_diff` and `pihole_instance_sync` for 78
9 prompts including `diagnose_slow_dns`, `investigate_domain`, `review_top_blocked`, `audit_network` and `security_audit`, and 5 resources such as `pihole://status` and `pihole://summary`

Requirements

A Pi-hole v6 instance and its admin password — an application password is the better choice for automation, since it bypasses TOTP 2FA and can be revoked on its own. Set `PIHOLE_URL` and `PIHOLE_PASSWORD` in the client's env block. Install the binary with `brew install hexamatic/tap/pihole-mcp`, `scoop install pihole-mcp`, `go install github.com/hexamatic/pihole-mcp/cmd/pihole-mcp@latest`, or the `ghcr.io/hexamatic/pihole-mcp` image. For several Pi-holes, use numbered variables — `PIHOLE_1_URL`, `PIHOLE_1_PASSWORD`, `PIHOLE_1_NAME` and so on — which are mutually exclusive with the single-instance pair. Set `TZ` if you want timestamps in local time rather than UTC. MIT.

Setup effort

One command plus a key — brew install hexamatic/tap/pihole-mcp, then supply credentials