Home › Other › Pi-hole MCP Server

Pi-hole MCP Server

Manage Pi-hole v6: DNS blocking, domains, clients, query analysis, DHCP, and multi-instance sync.

★ 12 stars Last pushed 2026-11-02 License: MIT

View repository → Website →

Connect

Review any command before running it. Package names and URLs come from the server's own registry entry.

Package (oci)

docker run -i --rm ghcr.io/hexamatic/pihole-mcp:0.10.0

Or add to your MCP client config:

{
  "mcpServers": {
    "pihole-mcp": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/hexamatic/pihole-mcp:0.10.0"
      ],
      "env": {
        "PIHOLE_URL": "<YOUR_VALUE>",
        "PIHOLE_PASSWORD": "<YOUR_VALUE>",
        "TZ": "<YOUR_VALUE>",
        "PIHOLE_READ_ONLY": "<YOUR_VALUE>",
        "PIHOLE_TLS_SKIP_VERIFY": "<YOUR_VALUE>",
        "PIHOLE_REQUEST_TIMEOUT": "<YOUR_VALUE>",
        "PIHOLE_MAX_RETRIES": "<YOUR_VALUE>",
        "PIHOLE_RETRY_MAX_DELAY": "<YOUR_VALUE>"
      }
    }
  }
}

PIHOLE_URL required — Base URL of your Pi-hole web interface. For multiple Pi-holes use PIHOLE_1_URL, PIHOLE_2_URL, ... instead.
PIHOLE_PASSWORD required secret — Pi-hole admin password, or an application password (recommended — bypasses TOTP 2FA)
TZ — IANA timezone for rendered timestamps, e.g. Australia/Adelaide. Defaults to UTC in the container.
PIHOLE_READ_ONLY — Expose only inspection tools. Every tool that can change Pi-hole is hidden and rejected if called.
PIHOLE_TLS_SKIP_VERIFY — Set to true only for a Pi-hole serving a self-signed HTTPS certificate. A trusted certificate is the better fix.
PIHOLE_REQUEST_TIMEOUT — HTTP request timeout as a Go duration, e.g. 30s or 1m
PIHOLE_MAX_RETRIES — Retries after a transient Pi-hole API failure; 0 disables retrying
PIHOLE_RETRY_MAX_DELAY — Upper bound on a single exponential-backoff wait, as a Go duration