LabscoMCP early access ↗
hexamaticMCP SERVER

Pi-hole

Full control of Pi-hole v6 from an assistant — blocking, domains, clients, query log, DHCP and gravity updates — as one Go binary, with multi-instance diff and sync built in.

by hexamatic ↗DNS, Domains & CDNCommunity

LABSCO SUMMARY

Sync is dry-run first, and it says what it will not touch.

The two-Pi-hole story is the standout: diff is read-only, and sync writes in one direction only, returns a plan with a single-use confirm token before changing anything, takes a teleporter backup first, and deliberately never syncs DHCP, interface bindings, passwords, TLS certificates or 2FA. Elsewhere the same connection that reads your stats can restart DNS and rewrite your blocklists, so it is worth using an application password you can revoke.

What it is

An MCP server for the Pi-hole v6 REST API, shipped as a single Go binary. It covers the whole admin surface rather than a read-only slice: statistics and query log on one side, domain lists, groups, clients, configuration and service actions on the other. Point it at more than one Pi-hole and two extra tools appear for keeping them aligned.

What you get

  • pihole_padd — a one-call snapshot: queries, blocking state, top domain and client, cache, versions and host health
  • Blocking control — pihole_dns_get_blocking and pihole_dns_set_blocking, the latter with an optional timer
  • Statistics — pihole_stats_summary, pihole_stats_top_domains, pihole_stats_top_clients, pihole_stats_upstreams, pihole_stats_query_types, pihole_stats_recent_blocked, plus the long-term database equivalents
  • Query log — pihole_queries_search with 12 filters and cursor pagination, pihole_queries_suggestions for the available filter values, and pihole_search_domains for a cross-list lookup
  • List management — pihole_domains_list, pihole_domains_add, pihole_domains_update, pihole_domains_delete, pihole_domains_batch_delete, and the same shape for pihole_groups_list/add/update/delete/batch_delete, pihole_clients_list/suggestions/add/update/delete and pihole_lists_list/add/update/delete/batch_delete
  • System and actions — pihole_info_system, pihole_info_version, pihole_info_messages, pihole_action_gravity_update, pihole_action_restart_dns, pihole_network_devices, pihole_dhcp_leases, pihole_teleporter_export and pihole_teleporter_import
  • Configuration by dotted path — pihole_config_get, pihole_config_set, pihole_config_get_value, pihole_config_add_value, pihole_config_remove_value
  • 76 tools for a single Pi-hole; a second instance registers pihole_instance_diff and pihole_instance_sync for 78
  • 9 prompts including diagnose_slow_dns, investigate_domain, review_top_blocked, audit_network and security_audit, and 5 resources such as pihole://status and pihole://summary

Requirements

A Pi-hole v6 instance and its admin password — an application password is the better choice for automation, since it bypasses TOTP 2FA and can be revoked on its own. Set PIHOLE_URL and PIHOLE_PASSWORD in the client's env block. Install the binary with brew install hexamatic/tap/pihole-mcp, scoop install pihole-mcp, go install github.com/hexamatic/pihole-mcp/cmd/pihole-mcp@latest, or the ghcr.io/hexamatic/pihole-mcp image. For several Pi-holes, use numbered variables — PIHOLE_1_URL, PIHOLE_1_PASSWORD, PIHOLE_1_NAME and so on — which are mutually exclusive with the single-instance pair. Set TZ if you want timestamps in local time rather than UTC. MIT.

Setup effort

One command plus credentials — brew install hexamatic/tap/pihole-mcp, then supply credentials

See installation options