IONOS CLOUD MCP Server

Create one Managed Kubernetes cluster (the control plane). Two-phase: call first WITHOUT confirmation_token to get a preview and a one-time token, then call again WITH the token (and the same name and location) to create it. Creates exactly one cluster per call. It runs no workloads until it has a node pool — add one with create_k8s_nodepool once it reports ACTIVE. location, nat_gateway_ip, node_subnet and public are immutable. Asynchronous (202): poll get_k8s_cluster or get_k8s_nodepool for metadata.state — ACTIVE/AVAILABLE is done, DEPLOYING/UPDATING/BUSY still working, FAILED_* failed. Leav…

Create one node pool of worker nodes. Two-phase: call first WITHOUT confirmation_token to get a preview and a one-time token, then call again WITH the token and EVERY other argument unchanged to create it. The token is bound to the whole previewed configuration, so changing any field between the two calls is refused. Creates exactly one node pool per call. The cluster must already be ACTIVE, and datacenter_id must be in its location. The per-node hardware and datacenter_id are immutable — recreate the pool to change them. Asynchronous (202): poll get_k8s_cluster or get_k8s_nodepool for metadat…

Create one LAN in a data center. Two-phase: call first WITHOUT confirmation_token to get a preview and a one-time token, then call again WITH the token and the same datacenter_id to create it. name is optional, but if you gave one the second call must repeat it. A public LAN is how servers reach the internet; a private LAN carries internal traffic only. The API assigns the LAN a small numeric ID, which is the value you pass as lan when creating a NIC. Creates exactly one LAN per call.

Create one classic load balancer. Two-phase: call first WITHOUT confirmation_token to get a preview and a one-time token, then call again WITH the token (and the same datacenter_id and name) to create it. The classic load balancer balances traffic across NICs attached directly to it, which is a different model from the network and application load balancers — those forward to IP targets or target groups defined in forwarding rules. For new work prefer create_network_loadbalancer (TCP/UDP) or create_application_loadbalancer (HTTP), which offer health checks and finer routing. Creates exactly on…

Create one NAT gateway, which gives servers on private LANs outbound internet access by translating their private addresses to public ones. Two-phase: call first WITHOUT confirmation_token to get a preview and a one-time token, then call again WITH the token (and the same datacenter_id and name) to create it. public_ips must come from a reserved IP block in the same location (see create_ip_block). The gateway translates nothing until you add a rule with create_nat_gateway_rule, and reaches nothing until it serves at least one LAN. Creates exactly one gateway per call.

Add one translation rule to a NAT gateway, which is what actually gives a private range outbound internet access. Two-phase: call first WITHOUT confirmation_token to get a preview and a one-time token, then call again WITH the token (and the same parent IDs and name) to create it. source_subnet is the private range whose outbound traffic is translated; public_ip must be one of the gateway's own public addresses. Only SNAT is supported. Creates exactly one rule per call.

Create one network load balancer. Two-phase: call first WITHOUT confirmation_token to get a preview and a one-time token, then call again WITH the token (and the same datacenter_id and name) to create it. It forwards traffic at the transport layer (TCP/UDP) to a list of IP targets defined in its forwarding rules. listener_lan is the LAN clients connect on (usually public) and target_lan the LAN holding the backends (usually private); they must differ, and a public listener_lan needs at least one reserved public IP in ips. The new load balancer carries no traffic until you add a forwarding rule…

Create one network interface (NIC) on a server and connect it to a LAN. Two-phase: call first WITHOUT confirmation_token to get a preview and a one-time token, then call again WITH the token (and the same datacenter_id, server_id and lan) to create it. lan is the LAN's small numeric ID from list_lans, not a UUID. If no LAN with that ID exists the API creates one implicitly, so a wrong number silently puts the server on a new isolated LAN instead of the intended one — check list_lans first. Creates exactly one NIC per call.

Add one forwarding rule to a network load balancer, which is what makes it actually carry traffic. Two-phase: call first WITHOUT confirmation_token to get a preview and a one-time token, then call again WITH the token (and the same parent IDs and name) to create it. The rule listens on one of the load balancer's own addresses and forwards TCP or UDP connections to the targets you list; at least one target is required. Targets are usually the private IPs of backend servers on the load balancer's target LAN. Creates exactly one rule per call.

Create one private cross connect, which links private LANs together — including across different data centers — without traffic leaving the IONOS network. Two-phase: call first WITHOUT confirmation_token to get a preview and a one-time token, then call again WITH the token (and the same name) to create it. The new cross connect connects nothing on its own: attach LANs to it afterwards with update_lan's pcc field. Every LAN on one cross connect must use non-overlapping IP ranges within the same subnet, so plan the addressing before attaching the second LAN. Creates exactly one cross connect per…

Create one security group in a data center. Two-phase: call first WITHOUT confirmation_token to get a preview and a one-time token, then call again WITH the token (and the same datacenter_id and name) to create it. A security group is a reusable set of firewall rules that can be assigned to several servers and NICs at once. The new group starts with NO rules, so it permits nothing until you add some with create_security_group_rule, and assigning an empty group to a server has no effect. Assign it with assign_server_security_groups or assign_nic_security_groups. Creates exactly one group per ca…

Add one firewall rule to a security group, so every server and NIC assigned to that group inherits it. Two-phase: call first WITHOUT confirmation_token to get a preview (including how many servers and NICs will inherit the rule) and a one-time token, then call again WITH the token to create it. This is the tool to use for a rule that should apply to several resources, rather than repeating create_firewall_rule per NIC. Omitting port_range_start and port_range_end allows EVERY port for that protocol. Creates exactly one rule per call.

Create one server (virtual machine) in a data center. Creates exactly one server per call. Two-phase: call first WITHOUT confirmation_token to get a preview and a one-time token, then call again WITH the token (and the same datacenter_id, name and boot_volume) to create it. Size it either with cores and ram (ENTERPRISE, the default, or VCPU) or with template_uuid plus type (CUBE or GPU) — not both. boot_volume optionally creates the server's disk in the same request; for an ENTERPRISE or VCPU server you can just as well omit it and add a disk later with create_volume plus attach_server_volume,…

Create one target group: a named pool of backends that application load balancer HTTP rules forward to. Two-phase: call first WITHOUT confirmation_token to get a preview and a one-time token, then call again WITH the token (and the same name) to create it. A target group belongs to the account rather than a data center, so one group can serve rules on several load balancers. A group with no targets accepts no traffic. Reference it from an application load balancer with create_alb_forwarding_rule's http_rules, using a FORWARD rule whose target_group is this group's ID. Creates exactly one group…

Create one storage volume in a data center. Two-phase: call first WITHOUT confirmation_token to get a preview and a one-time token, then call again WITH the token (and the same datacenter_id and name) to create it. Give image or image_alias to get a bootable volume with an operating system; without either you get an empty disk and must also give licence_type. For a bootable Linux volume set ssh_keys or image_password, or you will not be able to log in. The new volume is NOT attached to any server — use attach_server_volume afterwards. Creates exactly one volume per call.

Take a snapshot of a volume, capturing its contents at this moment. Requires IONOS_MCP_TOOL_SCOPE to include write. Two-phase: call first WITHOUT confirmation_token to get a preview and a one-time token, then call again WITH the token (and the same datacenter_id, volume_id and name) to create it. A snapshot is the ONLY way to recover a volume's data after delete_volume or restore_volume_snapshot, so take one before any destructive change you might need to undo. Snapshots are billed for the storage they occupy. This is the only way to create a snapshot — there is no standalone create_snapshot.

Delete a forwarding rule from an application load balancer. Two-phase: call first WITHOUT confirmation_token to get a preview of the listener and its HTTP rules plus a one-time token, then call again WITH the token to delete. Clients connecting to that listener address and port stop being served. If it is the load balancer's only rule, the load balancer stops serving traffic entirely. This is irreversible.

Delete an application load balancer and all of its forwarding rules. Two-phase: call first WITHOUT confirmation_token to get a blast-radius preview and a one-time token, then call again WITH the token to delete. Clients connecting to its listener addresses stop reaching the backends, so this takes the service behind it offline. The backend servers themselves are not deleted. This is irreversible.

Delete one auto-certificate, stopping automatic renewal for its DNS name. Two-phase: call first WITHOUT confirmation_token to get a blast-radius preview and a one-time token, then call again WITH the token to delete. This is irreversible. The certificates it has already issued keep working until they expire, and nothing renews them afterwards — so a load balancer using one starts serving an expired certificate on that date. Verify with list_cert_certificates once the delete is through. Asynchronous (202): the API has accepted the request; the resource is gone once its get_ tool answers 404.

Delete one SSL/TLS certificate and its private key. Two-phase: call first WITHOUT confirmation_token to get a preview and a one-time token, then call again WITH the token to delete. This is irreversible, and this server cannot upload a replacement — re-creating it means issuing a new certificate with create_cert_auto_certificate, or uploading outside this server. Any Application Load Balancer HTTPS listener still referencing this certificate stops serving TLS. Certificate Manager cannot list those references, so check the ALB forwarding rules first with list_alb_forwarding_rules. Asynchronous …

Delete one ACME certificate provider. Two-phase: call first WITHOUT confirmation_token to get a blast-radius preview and a one-time token, then call again WITH the token to delete. This is irreversible, and the external account binding secret cannot be recovered. Auto-certificates issue through a provider, so any that name this one lose the ability to renew. The preview counts them; move them to another provider first by recreating them. Asynchronous (202): the API has accepted the request; the resource is gone once its get_ tool answers 404.

Delete a virtual data center and EVERYTHING inside it (servers, volumes, LANs, load balancers, and more). Two-phase: call first WITHOUT confirmation_token to get a blast-radius preview and a one-time token, then call again WITH the token to delete. This is irreversible.

Delete one record from a primary DNS zone. Two-phase: call first WITHOUT confirmation_token to get a preview and a one-time token, then call again WITH the token to delete. This is irreversible. Resolvers may keep serving the old answer until its TTL expires. Asynchronous (202): poll get_dns_zone, get_dns_secondary_zone or get_dns_record for metadata.state — AVAILABLE is done, PROVISIONING/DESTROYING still working, FAILED failed. Leave a few seconds between polls.

Delete a reverse DNS record, so its IP stops resolving back to a hostname. Two-phase: call first WITHOUT confirmation_token to get a preview and a one-time token, then call again WITH the token to delete. This is irreversible. Mail servers commonly reject senders with no reverse DNS, so check what depends on the record first. Asynchronous (202): the API has accepted the request. A reverse record carries no provisioning state, so there is nothing to poll — confirm with list_dns_reverse_records.

Delete a secondary DNS zone. Two-phase: call first WITHOUT confirmation_token to get a preview and a one-time token, then call again WITH the token to delete. This is irreversible. The zone's records live on your primary nameservers, so only the IONOS-side mirror is removed. Asynchronous (202): poll get_dns_zone, get_dns_secondary_zone or get_dns_record for metadata.state — AVAILABLE is done, PROVISIONING/DESTROYING still working, FAILED failed. Leave a few seconds between polls.

Delete a primary DNS zone and every record it contains. Two-phase: call first WITHOUT confirmation_token to get a blast-radius preview and a one-time token, then call again WITH the token to delete. This is irreversible. Any domain still pointing at this zone's nameservers stops resolving. Asynchronous (202): poll get_dns_zone, get_dns_secondary_zone or get_dns_record for metadata.state — AVAILABLE is done, PROVISIONING/DESTROYING still working, FAILED failed. Leave a few seconds between polls.

Disable DNSSEC on a primary DNS zone, removing its signing keys and DNSKEY records. Two-phase: call first WITHOUT confirmation_token to get a preview and a one-time token, then call again WITH the token to disable it. This is irreversible: re-enabling generates new keys. REMOVE THE DS RECORD AT YOUR REGISTRAR FIRST. If the parent zone still publishes a DS record for keys that no longer exist, validating resolvers answer SERVFAIL and the whole zone stops resolving. Asynchronous (202): poll get_dns_zone, get_dns_secondary_zone or get_dns_record for metadata.state — AVAILABLE is done, PROVISIONIN…

Delete a firewall rule from a NIC. Two-phase: call first WITHOUT confirmation_token to get a preview of exactly what the rule allows plus a one-time token, then call again WITH the token to delete. The traffic this rule was permitting is blocked afterwards. If it is the NIC's last rule and its firewall is active, ALL incoming traffic to that NIC is blocked. This is irreversible.

Delete a private image. Two-phase: call first WITHOUT confirmation_token to get a preview of the image plus a one-time token, then call again WITH the token to delete. Only an image you uploaded can be deleted — public IONOS images cannot. Anything that references the image by ID stops being able to create volumes from it, including Terraform configurations, scripts and VM autoscaling templates, so check for references before deleting. This is irreversible.

Release a block of public IPv4 addresses. Two-phase: call first WITHOUT confirmation_token to get a preview listing every resource still using the addresses, plus a one-time token, then call again WITH the token to release it. Releasing a block whose addresses are still assigned breaks connectivity for those resources, and the addresses go back to the pool — you cannot reclaim the same ones. This is irreversible.

Delete a Managed Kubernetes cluster. Two-phase: call first WITHOUT confirmation_token to get a blast-radius preview and a one-time token, then call again WITH the token to delete. This is irreversible. The preview summarises how many node pools and worker nodes it would take with it. Asynchronous (202): poll get_k8s_cluster or get_k8s_nodepool for metadata.state — ACTIVE/AVAILABLE is done, DEPLOYING/UPDATING/BUSY still working, FAILED_* failed. Leave 30s between polls; a BUSY resource queues further changes rather than rejecting them.

Delete one worker node. Two-phase: call first WITHOUT confirmation_token for a preview and a one-time token, then again WITH the token. This is irreversible — pods are evicted and local storage is lost. The node goes first, leaving the pool short, and an active autoscaler may keep it that way (observed 2 nodes to 1). Use recreate_k8s_node to replace a node, or update_k8s_nodepool to resize. The API also refuses this when it would take the pool below its autoscaler minimum. Asynchronous (202): follow list_k8s_nodepool_nodes, whose state values are PROVISIONING, PROVISIONED, READY, TERMINATING, …

Delete a node pool and all of its worker nodes. Two-phase: call first WITHOUT confirmation_token to get a preview and a one-time token, then call again WITH the token to delete. This is irreversible — pods are evicted and node storage is lost. If it is the cluster's last node pool, the cluster keeps running with nowhere to schedule workloads. Asynchronous (202): poll get_k8s_cluster or get_k8s_nodepool for metadata.state — ACTIVE/AVAILABLE is done, DEPLOYING/UPDATING/BUSY still working, FAILED_* failed. Leave 30s between polls; a BUSY resource queues further changes rather than rejecting them.

Delete a LAN. Two-phase: call first WITHOUT confirmation_token to get a preview and a one-time token, then call again WITH the token to delete. The LAN must be EMPTY first: the API refuses to delete a LAN that still has NICs on it. Move each NIC to another LAN with update_nic, or remove it with delete_nic (or delete its server), then retry. This is irreversible.

Delete a classic load balancer. Two-phase: call first WITHOUT confirmation_token to get a blast-radius preview (the NICs it balances across) and a one-time token, then call again WITH the token to delete. The NICs themselves are not deleted, but traffic stops being balanced to them, so whatever was reaching the service through this load balancer stops. This is irreversible.

Delete a NAT gateway and all of its rules. Two-phase: call first WITHOUT confirmation_token to get a blast-radius preview and a one-time token, then call again WITH the token to delete. Servers on the LANs it served lose their outbound internet access, which usually breaks package updates, outbound API calls and anything else leaving those LANs. This is irreversible.

Delete a translation rule from a NAT gateway. Two-phase: call first WITHOUT confirmation_token to get a preview of what the rule translates plus a one-time token, then call again WITH the token to delete. Servers in the rule's source range lose the outbound translation it provided, which usually means losing internet access. This is irreversible.

Delete a network load balancer and all of its forwarding rules. Two-phase: call first WITHOUT confirmation_token to get a blast-radius preview and a one-time token, then call again WITH the token to delete. Clients connecting to its listener addresses stop reaching the backends, so this takes the service behind it offline. The backend servers themselves are not deleted. This is irreversible.

Delete a network interface (NIC) from a server, along with its firewall rules and flow logs. Two-phase: call first WITHOUT confirmation_token to get a blast-radius preview and a one-time token, then call again WITH the token to delete. The server loses its connectivity on that LAN, and any public IP the NIC held is released back to its IP block. This is irreversible.

Delete a forwarding rule from a network load balancer. Two-phase: call first WITHOUT confirmation_token to get a preview of the listener and its backends plus a one-time token, then call again WITH the token to delete. Clients connecting to that listener address and port stop being served. If it is the load balancer's only rule, the load balancer stops carrying traffic entirely. This is irreversible.

Delete a private cross connect. Two-phase: call first WITHOUT confirmation_token to get a blast-radius preview listing the LANs peered through it, plus a one-time token, then call again WITH the token to delete. The LANs themselves are not deleted, but they lose the private connection between them, which breaks any traffic that relied on it. This is irreversible.

Delete a security group and all the rules in it. Two-phase: call first WITHOUT confirmation_token to get a blast-radius preview (its rules, and the servers and NICs it is assigned to) and a one-time token, then call again WITH the token to delete. Every server and NIC the group was assigned to loses the protection its rules provided, which can either expose or cut off traffic depending on what the rules allowed. This is irreversible.

Delete a firewall rule from a security group. Two-phase: call first WITHOUT confirmation_token to get a preview of what the rule allows and how many servers and NICs lose it, plus a one-time token, then call again WITH the token to delete. Every member of the group stops allowing this traffic at once, so this can cut off a service on several servers simultaneously. This is irreversible.

Delete a server. Two-phase: call first WITHOUT confirmation_token to get a preview of what is attached and what happens to it, plus a one-time token, then call again WITH the token to delete. By default the attached volumes are NOT deleted — they survive as unattached volumes and keep incurring cost. Set delete_volumes to true to destroy them with the server (their data is then unrecoverable). Leave delete_volumes off for a template-sized server (CUBE or GPU): their storage is destroyed with the server anyway, and setting the flag can be rejected. Confirmed for CUBE, whose DAS storage cannot e…

Delete a snapshot. Two-phase: call first WITHOUT confirmation_token to get a preview of the snapshot plus a one-time token, then call again WITH the token to delete. A snapshot is frequently the only copy of a volume's earlier contents, so deleting it can remove the only way to recover that state — restore_volume_snapshot will no longer have anything to restore from. This is irreversible.

Delete a target group. Two-phase: call first WITHOUT confirmation_token to get a preview of the group and its backends plus a one-time token, then call again WITH the token to delete. Any application load balancer HTTP rule that forwards to this group stops working, and because a group is account-level those rules may be on load balancers in several data centers. This is irreversible.

Delete a storage volume and all data on it. Two-phase: call first WITHOUT confirmation_token to get a preview (including whether the volume is still attached to a server) and a one-time token, then call again WITH the token to delete. The data is unrecoverable unless a snapshot exists — take one with create_volume_snapshot first if you might need it. This is irreversible.

Detach a volume from a server. Requires IONOS_MCP_TOOL_SCOPE to include destructive. Two-phase: call first WITHOUT confirmation_token to get a preview and a one-time token, then call again WITH the token to detach. The volume is NOT deleted — it survives as an unattached volume and keeps incurring cost until removed with delete_volume. Detaching the server's boot volume also CLEARS its boot setting, so the server cannot boot until you point it at another attached volume with update_server boot_volume_id. To swap a server's disk, attach the replacement with attach_server_volume, set it with upd…

Get details of a specific application load balancer (ALB)

Returns the FOCUS v1.3 column specification and IONOS tool → FOCUS field mappings. Call before mapping IONOS invoice/usage/traffic data to FOCUS format, or when user asks for FOCUS-compliant cost output.

Get the detailed line-item breakdown for a specific invoice by ID. Use list_billing_invoices first to find available invoice IDs. For FOCUS v1.3 compliant output, read resource ionos://billing/focus-v1.3.

Get the billing profile for your IONOS CLOUD account. Call this first before any other billing tool — the contract number in the response is required by all other billing tools.

Get aggregated resource usage for a specific datacenter (VDC UUID) in the current billing period. Use list_billing_usage first to find datacenter IDs. Defaults exclude zero-quantity meters (set include_zero=true to keep them). For FOCUS v1.3 compliant output, read resource ionos://billing/focus-v1.3.

Get per-resource utilization for a specific date (YYYY-MM-DD). Use this for day-level analysis within a month. Same compaction flags as list_billing_utilization. For contracts with many datacenters, scope with regions, datacenter_id, or meter_types — or set top_n=10 for a flat global top-N list — before group_by=datacenter to keep the response under 25 KB. For FOCUS v1.3 compliant output, read resource ionos://billing/focus-v1.3.

Get details of a specific auto-certificate by ID

Get details of a specific SSL/TLS certificate by ID. Returns certificate metadata and public key material but not the private key.

Get details of a specific certificate provider by ID. Returns provider configuration but not the external account binding secret.

Get contract and resource limit information for your IONOS CLOUD account

Get details of a specific virtual data center

Get DNS quota usage and limits for your IONOS CLOUD account

Get details of a specific DNS record in a zone

Get details of a specific reverse DNS record

Get details of a specific secondary DNS zone

Get the zone transfer (AXFR) status of a specific secondary DNS zone

Get details of a specific DNS zone

Get the zone file (BIND format) for a specific DNS zone

Get details of a specific firewall rule

Get details of a specific reserved IP block

Get details of a specific Kubernetes cluster: state, version, maintenance window, API server allow list and whether it is public or private. Read this before an upgrade — availableUpgradeVersions lists the versions update_k8s_cluster accepts, and viableNodePoolVersions the ones its node pools may run.

Get the current default Kubernetes version used by new clusters and node pools in IONOS CLOUD. This is the version create_k8s_cluster picks when k8s_version is omitted.

Get details of a specific worker node in a Kubernetes node pool: its name, state, Kubernetes version and IP addresses.

Get details of a specific Kubernetes node pool: node count, node hardware, autoscaling bounds, attached LANs, labels and annotations. Read this before calling update_k8s_nodepool with lans, labels, annotations or public_ips, since each of those replaces the whole list. availableUpgradeVersions lists the versions the pool can move to.

Get details of a specific LAN

Get details of a specific load balancer

Get details of a specific NAT gateway

Get details of a specific network load balancer (NLB)

Get details of a specific network interface (NIC)

Get details of a specific Object Storage access key by its ID. Returns key metadata but not the secret key.

Get the CORS configuration for an Object Storage bucket.

Get the server-side encryption configuration for an Object Storage bucket.

Get the lifecycle configuration for an Object Storage bucket.

Get the region/location of an Object Storage bucket.

Get the Object Lock configuration for an Object Storage bucket.

Get the bucket policy for an Object Storage bucket.

Get the policy status for an Object Storage bucket, indicating whether the bucket is public.

Get the public access block configuration for an Object Storage bucket.

Get the replication configuration for an Object Storage bucket.

Get the tags for an Object Storage bucket.

Get the versioning configuration for an Object Storage bucket.

Get the Object Lock legal hold status for an object in an Object Storage bucket.

Get the Object Lock retention configuration for an object in an Object Storage bucket.

Get the tags for an object in an Object Storage bucket.

Get details of a specific Object Storage region by name (e.g. eu-central-3).

Get details of a specific private cross-connect

Get details of a specific API request

Get the status of a specific API request

Get details of a specific security group

Get details of a specific security group rule

Get details of a specific server

Get details of a specific GPU attached to a server

Get the remote console URL for a specific server

Get details of a specific snapshot

Get details of a specific target group

Get details of a specific server template

Get details of a specific volume

Check whether an Object Storage bucket exists and is accessible with the current credentials.

Check whether an object exists in an Object Storage bucket and retrieve its user-defined metadata (x-amz-meta-* headers). Returns an error if the object does not exist or is not accessible.

Replace ALL records in a primary DNS zone with the contents of a zone file in BIND format (RFC 1035). Every record currently in the zone is deleted, so this needs IONOS_MCP_TOOL_SCOPE to include destructive even though the method is a PUT. Two-phase: call first WITHOUT confirmation_token to see how many existing records would be replaced and get a one-time token, then call again WITH the token to import. SOA and NS records in the file are accepted but ignored, so a file exported from another provider can be imported as-is. Returns the resulting record list. Synchronous: the returned record is …

Invoke an IONOS Cloud tool by name with the given arguments and return its result. The name must be an exact tool name from ionos_search_tools; arguments must match the schema from ionos_describe_tools. Most tools are read-only (list_/get_/head_). Mutating tools are only callable when IONOS_MCP_TOOL_SCOPE enables them, and the name tells you which kind a tool is: create_/update_ and start_/resume_/attach_/assign_ need "write"; delete_ and stop_/reboot_/suspend_/upgrade_/restore_/detach_ need "destructive". Note that a destructive tool is not always a delete_ — stopping, rebooting, upgrading or…

Return the full JSON input schema and description for one or more IONOS Cloud tools (names come from ionos_search_tools). Call this before ionos_call_tool to learn a tool's required and optional arguments.

Load IONOS Compute Engine tools into this session. Call this before managing virtual infrastructure: servers, datacenters, volumes, NICs, LANs, firewall rules, IP blocks, load balancers, NAT gateways, security groups, snapshots, and more.

Load IONOS Object Storage tools into this session. Call this before managing S3-compatible object storage: buckets, bucket configuration (CORS, encryption, lifecycle, policy, replication, versioning), objects, access keys, and regions.

Description is built at runtime.

List contracts accessible for IONOS CLOUD activity log queries. Primarily useful for reseller and partner users with multiple contracts. Single-contract users can skip this — their contract number is embedded in the JWT token returned by get_billing_profile or visible in the IONOS DCD console.

Query the IONOS CLOUD activity log: full audit trail of API requests made against a contract (who did what, when, on which resource). Requires ACCESS_ACTIVITY_LOG privilege on the token. Defaults: last 7 days, limit 25, RequestStatusUpdate events excluded. Use user filter to narrow to a specific account. Use event_types to restrict to e.g. ['Error','RequestAccepted']. Maximum date range is 90 days — paginate or narrow the window for longer spans. Use list_activitylog_contracts first to look up the contract number if needed.

List all forwarding rules of an application load balancer

List all application load balancers (ALB) in a data center

Get provisioning itemized data (EVN) for your contract for the current billing month. Shows per-resource usage intervals grouped by datacenter. For FOCUS v1.3 compliant output, read resource ionos://billing/focus-v1.3.

Get provisioning itemized data (EVN) for a specific billing period (YYYY-MM). One month per call. If the user requests a range longer than one month, calculate the number of monthly calls required, inform the user, and ask for permission before proceeding. For FOCUS v1.3 compliant output, read resource ionos://billing/focus-v1.3.

List all invoices for your IONOS CLOUD contract. Returns invoice IDs, dates, and amounts. For FOCUS v1.3 compliant output, read resource ionos://billing/focus-v1.3.

List invoices for a specific billing period (YYYY-MM). One month per call. If the user requests a range longer than one month, calculate the number of monthly calls required, inform the user, and ask for permission before proceeding. For FOCUS v1.3 compliant output, read resource ionos://billing/focus-v1.3.

Search the IONOS CLOUD product/pricing catalog by keyword. The filter is applied client-side as a case-insensitive partial match on each product's description — it is not an API-level parameter. Returns non-deprecated products whose description contains the filter string. IMPORTANT: Only call this tool when the user has explicitly specified a product or category they want to see pricing for. If the user asks a broad question like 'what are the prices' or 'show me all products', do NOT guess keywords or call this tool multiple times — instead ask the user which specific product or category they…

Get network traffic data for your contract for the current billing month. Returns per-datacenter and per-NIC inbound/outbound traffic in bytes. For FOCUS v1.3 compliant output, read resource ionos://billing/focus-v1.3.

Get network traffic data for a specific billing period (YYYY-MM). One month per call. If the user requests a range longer than one month, calculate the number of monthly calls required, inform the user, and ask for permission before proceeding. For FOCUS v1.3 compliant output, read resource ionos://billing/focus-v1.3.

Get aggregated resource usage for your contract for the current billing period. Shows metered quantities (CPU hours, GB-hours, etc.) grouped by datacenter. Defaults exclude zero-quantity meters (set include_zero=true to keep them). Filter by datacenter_id to narrow scope. For FOCUS v1.3 compliant output, read resource ionos://billing/focus-v1.3.

Get per-resource utilization for the current billing period, grouped by datacenter. Defaults exclude zero-quantity meters (set include_zero=true to find idle resources). Use group_by='meter' or 'datacenter' to aggregate further, or top_n=N for a flat global ranking of the largest meters. Filter by datacenter_id, meter_types, or regions to narrow scope. For contracts with many datacenters, scope with regions, datacenter_id, or meter_types — or set top_n=10 for a flat global top-N list — before group_by=datacenter to keep the response under 25 KB. For FOCUS v1.3 compliant output, read resource i…

Get per-resource utilization for a specific billing period (YYYY-MM). One month per call. If the user requests a range longer than one month, calculate the number of monthly calls required, inform the user, and ask for permission before proceeding. Same compaction flags as list_billing_utilization (include_zero, group_by, datacenter_id, meter_types, regions, top_n). For contracts with many datacenters, scope with regions, datacenter_id, or meter_types — or set top_n=10 for a flat global top-N list — before group_by=datacenter to keep the response under 25 KB. For FOCUS v1.3 compliant output, r…

List all auto-certificates in your IONOS Cloud Certificate Manager account

List all SSL/TLS certificates in your IONOS Cloud Certificate Manager account. Returns certificate metadata and public key material but not the private key.

List all certificate providers in your IONOS Cloud Certificate Manager account. Returns provider configuration but not the external account binding secret.

List all virtual data centers. Returns names and basic properties by default (depth=1).

List all DNS records across all zones

List all reverse DNS records in your IONOS CLOUD account

List all DNS records in a specific secondary zone

List all secondary DNS zones in your IONOS CLOUD account

List DNSSEC keys for a specific DNS zone

List all DNS records in a specific zone

List all DNS zones in your IONOS CLOUD account

List all firewall rules on a network interface

List all available images (OS templates) in IONOS CLOUD

List all reserved IP blocks in your IONOS CLOUD account

List all Kubernetes clusters in your IONOS CLOUD account. Returns names and basic properties by default (depth=1).

List all worker nodes in a Kubernetes node pool, including each node's state and public/private IP addresses.

List all node pools in a Kubernetes cluster. A cluster with no node pools runs no workloads.

List all available Kubernetes versions in IONOS CLOUD. These are the versions a new cluster or node pool may be created with; to upgrade an existing one, use its availableUpgradeVersions instead (get_k8s_cluster / get_k8s_nodepool).

List all NICs attached to a specific LAN

List all LANs in a data center

List all NICs balanced by a specific load balancer

List all load balancers in a data center

List all available locations (regions) in IONOS CLOUD

List all rules of a specific NAT gateway

List all NAT gateways in a data center

List all network load balancers (NLB) in a data center

List all network interfaces (NICs) attached to a server

List all forwarding rules of a network load balancer

List all Object Storage access keys for the contract. Returns key IDs and metadata but not the secret keys.

List all Object Storage buckets owned by the contract.

List all versions of objects in an Object Storage bucket. Requires versioning to be enabled on the bucket. Supports an optional prefix filter.

List objects in an Object Storage bucket. Supports an optional prefix to filter by key path (e.g. 'images/' to list only objects under that prefix), an optional continuation_token to continue from a previous page, and an optional max_keys to control page size. Returns up to 1000 objects per call by default; use the next_continuation_token from the response as continuation_token in a subsequent call to page through larger result sets.

List all available Object Storage regions.

List all private cross-connects in your IONOS CLOUD account

List all API requests in your IONOS CLOUD account

List all rules in a specific security group

List all security groups in a data center

List all CD-ROMs attached to a specific server

List all GPUs attached to a specific server

List all volumes attached to a specific server

List all servers in a data center

List all snapshots in your IONOS CLOUD account

List all target groups in your IONOS CLOUD account

List all available server templates in IONOS CLOUD

List all volumes in a data center

Recreate one worker node. Two-phase: call first WITHOUT confirmation_token for a preview and a one-time token, then again WITH the token. The replacement is provisioned and joined to the cluster before the old node drains, so capacity never dips, at the cost of one extra billable node meanwhile. Prefer this over delete_k8s_node to replace a node. Asynchronous (202): follow list_k8s_nodepool_nodes, whose state values are PROVISIONING, PROVISIONED, READY, TERMINATING, REBUILDING and BUSY. Leave 30s between polls.

Restore a snapshot onto a volume, OVERWRITING everything currently on that volume. Requires IONOS_MCP_TOOL_SCOPE to include destructive. Two-phase: call first WITHOUT confirmation_token to see which volume will be overwritten, plus a one-time token, then call again WITH the token to restore. The volume's current contents are unrecoverable afterwards unless you snapshot them first with create_volume_snapshot. Stop the server before restoring its boot volume, or the running guest and the restored disk will disagree.

Trigger a zone transfer (AXFR) for a secondary DNS zone, pulling its records from the primary nameservers. Requires IONOS_MCP_TOOL_SCOPE to include write. Single call — a transfer only refreshes the IONOS-side copy, so there is no confirmation step. Whitelist IONOS's notify sources on your primary nameservers, or the transfer will not work: IPv4 212.227.123.25 and IPv6 2001:8d8:fe:53::5cd:25. Asynchronous (202): follow get_dns_secondary_zone_axfr, which reports the transfer status of each primary IP separately along with an errorMessage when one fails.

Update an application load balancer forwarding rule. Applies a partial update (only the fields you provide). Omit name, protocol, listener_ip or listener_port to keep the current value — each is read and sent back unchanged, because the API always receives all four. Supplying http_rules or server_certificates REPLACES that list, so include every entry the rule should keep.

Update an application load balancer's name, listener LAN, target LAN, addresses or logging. Applies a partial update (only the fields you provide); anything you omit keeps its current value. Changing listener_lan moves where clients connect; changing target_lan repoints it at a different backend network, and the two must stay different. Its forwarding rules are managed separately.

Rename an auto-certificate. Only the name can be changed. The provider, common name, subject alternative names and key algorithm are immutable: to change what is issued, delete this auto-certificate and create a new one. Synchronous (200): the returned body is the updated resource.

Rename a certificate. Only the name can be changed. The certificate body, chain and private key are immutable, and this server has no tool for uploading certificate material. To rotate, issue a replacement with create_cert_auto_certificate and repoint the load balancer at it, then delete the old one. Synchronous (200): the returned body is the updated resource.

Rename a certificate provider. Only the name can be changed. The email, the ACME directory URL and the external account binding are immutable: to change any of them, create a new provider, recreate each auto-certificate against it, and delete this one. Synchronous (200): the returned body is the updated resource.

Update a virtual data center's name, description, or protection flag. The location is immutable and cannot be changed. Applies a partial update (only the fields you provide).

Update a DNS record's content, TTL, priority, or whether it is published. The record's name and type are immutable here and are read and sent back unchanged — changing either is a delete plus a create. This endpoint replaces the record's properties, so every field you omit is read and sent back explicitly rather than left out, which would let the API re-apply its own defaults. Asynchronous (202): poll get_dns_zone, get_dns_secondary_zone or get_dns_record for metadata.state — AVAILABLE is done, PROVISIONING/DESTROYING still working, FAILED failed. Leave a few seconds between polls.

Update the hostname or description of a reverse DNS record. The IP is immutable here and is read and sent back unchanged — pointing a different IP at a hostname is a create, not an update. Synchronous: the returned record is the final state, so no polling is needed.

Update a secondary DNS zone's primary nameserver IPs or its description. The zone name is immutable and is read and sent back unchanged. primary_ips REPLACES the current list when supplied, so include every IP that should remain. Whitelist IONOS's notify sources on your primary nameservers, or the transfer will not work: IPv4 212.227.123.25 and IPv6 2001:8d8:fe:53::5cd:25. Asynchronous (202): poll get_dns_zone, get_dns_secondary_zone or get_dns_record for metadata.state — AVAILABLE is done, PROVISIONING/DESTROYING still working, FAILED failed. Leave a few seconds between polls.

Update a primary DNS zone's description, or enable/disable it. The zone name is immutable and is read and sent back unchanged. Disabling a zone stops it answering lookups for every record it contains, without deleting anything. Asynchronous (202): poll get_dns_zone, get_dns_secondary_zone or get_dns_record for metadata.state — AVAILABLE is done, PROVISIONING/DESTROYING still working, FAILED failed. Leave a few seconds between polls.

Update a firewall rule on a NIC. Applies a partial update (only the fields you provide). To WIDEN a rule back to 'any' — for example so it matches every source address — list the field in clear; that is the only way, since omitting a field leaves it unchanged and no value means anywhere. Clearing source_ip on an INGRESS rule opens it to the whole internet, so say so first. Narrowing a rule can cut off a service that depends on it. Ports apply only to TCP and UDP; icmp_type and icmp_code only to ICMP and ICMPv6.

Update a private image's name, description, licence type, cloud-init compatibility or capability flags. Applies a partial update (only the fields you provide). Only an image you uploaded can be changed — public IONOS images are read-only and the API rejects attempts to modify them. Omit licence_type to keep the current value; it is read and sent back unchanged because the API always receives it. The hot-plug and BIOS flags describe what a volume CREATED from this image will support. There is no create_image: the API exposes no way to create one.

Rename a reserved IP block. Only the name can be changed: location and size are fixed once reserved — to change either, reserve a new block and release this one. Renaming does not touch the addresses or the resources using them.

Update a cluster's name, Kubernetes version, maintenance window, API server allow list or audit-log buckets. location, nat_gateway_ip, node_subnet and public are immutable. This endpoint replaces the cluster's properties, so fields you omit are read and sent back unchanged. api_subnet_allow_list and s3_buckets replace the current list when supplied. BE CAREFUL with k8s_version: it upgrades the control plane and cannot be undone. Confirm the version with the user before sending it, and check the cluster's availableUpgradeVersions first — nothing else is accepted. Asynchronous (202): poll get_k8…

Update a node pool: scale it, upgrade it, or change its maintenance window, autoscaling, LANs, labels, annotations, taints or public IPs. The pool name and the per-node hardware are immutable. This endpoint replaces the pool's properties, so fields you omit are read and sent back unchanged. lans, labels, annotations, taints and public_ips replace the current value when supplied — read get_k8s_nodepool first. To turn an autoscaler off, send auto_scaling as an empty object or with both bounds null; the pool then stays at node_count. BE CAREFUL with three of these: k8s_version replaces EVERY node…

Update a LAN's name, public/private setting, cross connect or IPv6 block. Applies a partial update (only the fields you provide). Turning a public LAN private removes internet access for every server connected to it, and changing ipv6_cidr_block reassigns the IPv6 blocks and addresses of every connected NIC. ipv4_cidr_block is read-only and cannot be changed.

Update a classic load balancer's name, listening address or DHCP setting. Applies a partial update (only the fields you provide). Unlike the network and application load balancers, every property here is optional in the API, so nothing has to be carried forward — the fields you omit are left exactly as they are.

Update a NAT gateway's name, public addresses or served LANs. Applies a partial update (only the fields you provide). Omit name or public_ips to keep the current value — both are read and sent back unchanged, because the API always receives them and an empty public_ips would leave the gateway with nothing to translate to. Supplying public_ips or lans REPLACES that list, so include every entry the gateway should keep.

Update a NAT gateway translation rule. Applies a partial update (only the fields you provide). Omit name, source_subnet or public_ip to keep the current value — each is read and sent back unchanged, because the API always receives all three. Changing source_subnet changes which servers get translated, and changing public_ip changes the address they appear to come from.

Update a network load balancer's name, listener LAN, target LAN, addresses or logging. Applies a partial update (only the fields you provide); anything you omit keeps its current value. Changing listener_lan moves where clients connect; changing target_lan repoints it at a different backend network, and the two must stay different. Its forwarding rules are managed separately.

Update a NIC's name, LAN, IP addresses or firewall settings. Applies a partial update (only the fields you provide). Omit lan to leave the NIC on its current LAN — the current value is read and sent back unchanged, so omitting it never moves the NIC. Setting ips REPLACES the whole address list, so include every address the NIC should keep.

Update a network load balancer forwarding rule. Applies a partial update (only the fields you provide). Omit any of name, algorithm, protocol, listener_ip, listener_port or targets to keep the current value — each is read and sent back unchanged, because the API always receives all of them. Supplying targets REPLACES the backend list, so include every backend the rule should keep: any you leave out stops receiving traffic.

Update a private cross connect's name or description. Applies a partial update (only the fields you provide). This does not change which LANs are peered through it — attach or detach a LAN with update_lan's pcc field instead.

Update a security group's name or description. Applies a partial update (only the fields you provide). Omit name to keep the current one — it is read and sent back unchanged, because the API always receives this field and an empty value would clear the group's name. This changes only the group's own properties; its rules are managed with create_security_group_rule, update_security_group_rule and delete_security_group_rule.

Update a firewall rule in a security group. Applies a partial update (only the fields you provide). The change takes effect at once for EVERY server and NIC assigned to the group, so widening a rule here exposes all of them and narrowing it can cut off a service on any of them. To widen a field back to 'any', list it in clear — omitting it leaves it unchanged. Ports apply only to TCP and UDP; icmp_type and icmp_code only to ICMP and ICMPv6.

Update a server's name, size (cores, ram), CPU family, hostname, Multi Queue setting, or which volume it boots from. Applies a partial update (only the fields you provide). boot_volume_id is how you point a server at a different disk: attaching a volume with attach_server_volume does NOT make it bootable, and detaching the previous boot volume clears the setting, leaving a server that cannot boot until you set it again. The volume must already be attached. Resizing may require the server to be rebooted before the guest OS sees the change, and toggling nic_multi_queue restarts it. On CUBE and G…

Update a snapshot's name, description, licence type, protection flag or capability flags. Applies a partial update (only the fields you provide). The hot-plug and BIOS flags describe what a volume RESTORED from this snapshot will support, so changing them affects future restores rather than the snapshot's stored data. There is no create_snapshot: take a snapshot from a volume with create_volume_snapshot. A snapshot's size and location are fixed by the volume it came from.

Update a target group's name, algorithm, protocol or backends. Applies a partial update (only the fields you provide). Omit name, algorithm or protocol to keep the current value — each is read and sent back unchanged, because the API always receives all three. Supplying targets REPLACES the backend list, so include every backend the group should keep: any you leave out stops receiving traffic from every load balancer rule that forwards here.

Update a volume's name, size, bus type, serial exposure or boot order. Applies a partial update (only the fields you provide). boot_order controls whether the volume is the server's boot disk (PRIMARY, NONE or AUTO), but PRIMARY requires every other volume on the server to be NONE — to just point a server at a different disk, use update_server with boot_volume_id instead. size can only be INCREASED — the API rejects shrinking a volume — and after growing it the guest operating system still has to extend its own filesystem to use the new space. The cpu_hot_plug, ram_hot_plug, nic_hot_plug, nic_…