bunny.net MCP by usefulapi

by usefulapi.io · remote · no sign-in to list tools · v1.16.4 · published by io.usefulapi

Inspect pull zones, storage, DNS and video libraries on bunny.net, and purge caches.

Deletes · 7Changes · 1

Compare Registry entry

22 tools: 7 can delete or cancel things, 1 change things and 14 only read.

Scanned Oct 22, 2026

Deletes or cancels7Claude Code: deny: see these tools
Can't be undone0Claude Code: ask
Changes things1Claude Code: ask: see these tools
Only reads14Claude Code: allow: see these tools

No check matched anything in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http bunny-net https://bunny-net.usefulapi.io/mcp

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

22 tools

Deletes or cancels 7Removes, cancels or revokes something.Claude Code: deny

bunny_add_blocked_ipWRITE.No findings
Why it is in this group
- The name "bunny_add_blocked_ip" says "add": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
WRITE. Block an IP address from a pull zone (undo with bunny_remove_blocked_ip). bunny.net: POST /pullzone/{id}/addBlockedIp.
Annotations the server declares
- title: Block an IP on a pull zone
- destructiveHint: true
bunny_add_dns_recordWRITE.No findings
Why it is in this group
- The name "bunny_add_dns_record" says "add": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
WRITE. Add a record to a DNS zone. Takes effect on live DNS. bunny.net: PUT /dnszone/{zoneId}/records.
Annotations the server declares
- title: Add a DNS record
- destructiveHint: true
bunny_purge_pull_zone_cacheWRITE.No findings
Why it is in this group
- The name "bunny_purge_pull_zone_cache" says "purge": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
WRITE. Purge the cached content of one pull zone — everything, or only files carrying a cache tag. Nothing is lost (the CDN refetches from the origin) but the origin takes the refill load. bunny.net: POST /pullzone/{id}/purgeCache.
Annotations the server declares
- title: Purge a pull zone's cache
- destructiveHint: true
bunny_purge_urlWRITE.No findings
Why it is in this group
- The name "bunny_purge_url" says "purge": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
WRITE. Purge one URL from the CDN cache. A URL ending in '/' purges everything under it unless exact_path is true; a '*' wildcard is also accepted. The CDN refetches from the origin. bunny.net: POST /purge.
Annotations the server declares
- title: Purge a URL from cache
- destructiveHint: true
bunny_remove_blocked_ipWRITE.No findings
Why it is in this group
- The name "bunny_remove_blocked_ip" says "remove": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
WRITE. Remove an IP address from a pull zone's block list. bunny.net: POST /pullzone/{id}/removeBlockedIp.
Annotations the server declares
- title: Unblock an IP on a pull zone
- destructiveHint: true
bunny_set_edge_rule_enabledWRITE.No findings
Why it is in this group
- The name "bunny_set_edge_rule_enabled" says "set": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
WRITE. Turn one edge rule on a pull zone on or off (reversible — the rule is kept). Get the rule's GUID from bunny_get_pull_zone (EdgeRules[].Guid). bunny.net: POST /pullzone/{pullZoneId}/edgerules/{edgeRuleId}/setEdgeRuleEnabled.
Annotations the server declares
- title: Enable or disable an edge rule
- destructiveHint: true
bunny_update_dns_recordWRITE.No findings
Why it is in this group
- The name "bunny_update_dns_record" says "update": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
WRITE. Update an existing DNS record. Takes effect on live DNS. Read the record first with bunny_list_dns_records and pass its type, name and value along with any other fields you want to keep or change. bunny.net: POST /dnszone/{zoneId}/records/{id}.
Annotations the server declares
- title: Update a DNS record
- destructiveHint: true

Changes things 1Creates or changes something that can be changed back.Claude Code: ask

bunny_export_dns_zoneExport one DNS zone as a BIND zone file (plain text) — handy for review, diffing or backup before a change.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Export one DNS zone as a BIND zone file (plain text) — handy for review, diffing or backup before a change. bunny.net: GET /dnszone/{id}/export.
Annotations the server declares
- title: Export a DNS zone
- readOnlyHint: true

Only reads 14Looks things up and changes nothing.Claude Code: allow

bunny_get_audit_logWho changed what on one day: the account audit log (timestamp, product, resource, action, actor and a diff).No findings
Why it is in this group
- The name "bunny_get_audit_log" says "get": a word for reading.
Description, as the server wrote it
Who changed what on one day: the account audit log (timestamp, product, resource, action, actor and a diff). Paginate with continuation_token. bunny.net: GET /user/audit/{date}.
Annotations the server declares
- title: Get the audit log
- readOnlyHint: true
bunny_get_billingThe account balance, this month's charges broken down by product (traffic per continent, storage, DNS, Stream, scripting, Shield, ...) and recent billing records.No findings
Why it is in this group
- The name "bunny_get_billing" says "get": a word for reading.
Description, as the server wrote it
The account balance, this month's charges broken down by product (traffic per continent, storage, DNS, Stream, scripting, Shield, ...) and recent billing records. Payment-method tokens are redacted. bunny.net: GET /billing.
Annotations the server declares
- title: Get billing details
- readOnlyHint: true
bunny_get_dns_zoneFetch one DNS zone with its settings and records.No findings
Why it is in this group
- The name "bunny_get_dns_zone" says "get": a word for reading.
Description, as the server wrote it
Fetch one DNS zone with its settings and records. bunny.net: GET /dnszone/{id}.
Annotations the server declares
- title: Get a DNS zone
- readOnlyHint: true
bunny_get_pull_zoneFetch one pull zone with all its settings: origin, hostnames, caching, security, edge rules (with their GUIDs, needed by bunny_set_edge_rule_enabled), blocked IPs, limits and usage…No findings
Why it is in this group
- The name "bunny_get_pull_zone" says "get": a word for reading.
Description, as the server wrote it
Fetch one pull zone with all its settings: origin, hostnames, caching, security, edge rules (with their GUIDs, needed by bunny_set_edge_rule_enabled), blocked IPs, limits and usage. Secrets (token-auth key, AWS signing secret, certificate private keys) are redacted. bunny.net: GET /pullzone/{id}.
Annotations the server declares
- title: Get a pull zone
- readOnlyHint: true
bunny_get_statisticsCDN traffic statistics for the account or one pull zone: total bandwidth, origin traffic, requests served, cache hit rate and average origin response time, plus optional charts (ba…No findings
Why it is in this group
- The name "bunny_get_statistics" says "get": a word for reading.
Description, as the server wrote it
CDN traffic statistics for the account or one pull zone: total bandwidth, origin traffic, requests served, cache hit rate and average origin response time, plus optional charts (bandwidth, requests, origin traffic, response times, 3xx/4xx/5xx errors, geographic distribution). bunny.net: GET /statistics.
Annotations the server declares
- title: Get CDN statistics
- readOnlyHint: true
bunny_get_storage_zoneFetch one edge storage zone: hostname, region, replication, storage used, files stored, 404 handling and connected pull zones.Reads private dataNo findings
Why it is in this group
- The name "bunny_get_storage_zone" says "get": a word for reading.
What it can reach
- private-dataThe description's first sentence says "fetch" and "file": it reads files.
Description, as the server wrote it
Fetch one edge storage zone: hostname, region, replication, storage used, files stored, 404 handling and connected pull zones. Storage passwords are redacted. bunny.net: GET /storagezone/{id}.
Annotations the server declares
- title: Get a storage zone
- readOnlyHint: true
bunny_get_storage_zone_statisticsDaily charts of storage used and file count for one storage zone.Reads private dataNo findings
Why it is in this group
- The name "bunny_get_storage_zone_statistics" says "get": a word for reading.
What it can reach
- private-dataThe description's first sentence says "file": it reads files.
Description, as the server wrote it
Daily charts of storage used and file count for one storage zone. bunny.net: GET /storagezone/{id}/statistics.
Annotations the server declares
- title: Get storage zone statistics
- readOnlyHint: true
bunny_get_video_libraryFetch one Stream video library with its full configuration (resolutions, DRM, referrer rules, transcribing, watermark).No findings
Why it is in this group
- The name "bunny_get_video_library" says "get": a word for reading.
Description, as the server wrote it
Fetch one Stream video library with its full configuration (resolutions, DRM, referrer rules, transcribing, watermark). Library API keys are redacted. bunny.net: GET /videolibrary/{id}.
Annotations the server declares
- title: Get a video library
- readOnlyHint: true
bunny_list_dns_recordsList the records in one DNS zone, optionally filtered by type or search term.No findings
Why it is in this group
- The name "bunny_list_dns_records" says "list": a word for reading.
Description, as the server wrote it
List the records in one DNS zone, optionally filtered by type or search term. Record Type comes back as bunny.net's integer code (0=A, 1=AAAA, 2=CNAME, 3=TXT, 4=MX, 5=Redirect, 6=Flatten, 7=PullZone, 8=SRV, 9=CAA, 10=PTR, 11=Script, 12=NS, 13=SVCB, 14=HTTPS, 15=TLSA). bunny.net: GET /dnszone/{zoneId}/records.
Annotations the server declares
- title: List DNS records
- readOnlyHint: true
bunny_list_dns_zonesList the DNS zones hosted on bunny.net, with nameserver detection, DNSSEC and logging status.No findings
Why it is in this group
- The name "bunny_list_dns_zones" says "list": a word for reading.
Description, as the server wrote it
List the DNS zones hosted on bunny.net, with nameserver detection, DNSSEC and logging status. bunny.net: GET /dnszone.
Annotations the server declares
- title: List DNS zones
- readOnlyHint: true
bunny_list_pull_zonesList the CDN pull zones on the account.No findings
Why it is in this group
- The name "bunny_list_pull_zones" says "list": a word for reading.
Description, as the server wrote it
List the CDN pull zones on the account. By default returns a compact view per zone (id, name, origin URL, enabled/suspended, hostnames, linked storage zone, bandwidth and charges this month); set full=true for every setting. bunny.net: GET /pullzone.
Annotations the server declares
- title: List pull zones
- readOnlyHint: true
bunny_list_regionsList bunny.net's edge regions with their IDs, codes, location and per-GB traffic price.No findings
Why it is in this group
- The name "bunny_list_regions" says "list": a word for reading.
Description, as the server wrote it
List bunny.net's edge regions with their IDs, codes, location and per-GB traffic price. A cheap way to confirm the API key works. bunny.net: GET /region.
Annotations the server declares
- title: List edge regions
- readOnlyHint: true
bunny_list_storage_zonesList the edge storage zones on the account: region, replication regions, storage used, file count, tier and connected pull zones.Reads private dataNo findings
Why it is in this group
- The name "bunny_list_storage_zones" says "list": a word for reading.
What it can reach
- private-dataThe description's first sentence says "list" and "file": it reads files.
Description, as the server wrote it
List the edge storage zones on the account: region, replication regions, storage used, file count, tier and connected pull zones. Storage passwords are redacted. bunny.net: GET /storagezone.
Annotations the server declares
- title: List storage zones
- readOnlyHint: true
bunny_list_video_librariesList the Stream video libraries: video count, storage and traffic usage, linked pull/storage zones and player/encoding settings.No findings
Why it is in this group
- The name "bunny_list_video_libraries" says "list": a word for reading.
Description, as the server wrote it
List the Stream video libraries: video count, storage and traffic usage, linked pull/storage zones and player/encoding settings. Library API keys are redacted. bunny.net: GET /videolibrary.
Annotations the server declares
- title: List video libraries
- readOnlyHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged untrusted-input or outbound.

Reads private data3: Reads files, mail, messages, databases, secrets, calendars or repositories.; bunny_get_storage_zone
bunny_get_storage_zone_statistics
bunny_list_storage_zones
Reads text others write0: Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out0: Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Install

Pinned to version 1.16.4. Values in angle brackets are yours to fill in.

claude mcp add --transport http bunny-net https://bunny-net.usefulapi.io/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__bunny-net__bunny_list_pull_zones",
      "mcp__bunny-net__bunny_get_pull_zone",
      "mcp__bunny-net__bunny_list_storage_zones",
      "mcp__bunny-net__bunny_get_storage_zone",
      "mcp__bunny-net__bunny_get_storage_zone_statistics",
      "mcp__bunny-net__bunny_list_dns_zones",
      "mcp__bunny-net__bunny_get_dns_zone",
      "mcp__bunny-net__bunny_list_dns_records",
      "mcp__bunny-net__bunny_list_video_libraries",
      "mcp__bunny-net__bunny_get_video_library",
      "mcp__bunny-net__bunny_get_statistics",
      "mcp__bunny-net__bunny_list_regions",
      "mcp__bunny-net__bunny_get_billing",
      "mcp__bunny-net__bunny_get_audit_log"
    ],
    "ask": [
      "mcp__bunny-net__bunny_export_dns_zone"
    ],
    "deny": [
      "mcp__bunny-net__bunny_purge_pull_zone_cache",
      "mcp__bunny-net__bunny_purge_url",
      "mcp__bunny-net__bunny_add_dns_record",
      "mcp__bunny-net__bunny_update_dns_record",
      "mcp__bunny-net__bunny_set_edge_rule_enabled",
      "mcp__bunny-net__bunny_add_blocked_ip",
      "mcp__bunny-net__bunny_remove_blocked_ip"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as bunny-net. Review it before you use it.

Capability tags behind 3 rules

mcp__bunny-net__bunny_list_storage_zones private-data
mcp__bunny-net__bunny_get_storage_zone private-data
mcp__bunny-net__bunny_get_storage_zone_statistics private-data

Keep track

Get told when this server's tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/io.usefulapi/bunny-net/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Anlyon alternative

8 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Compare with other servers for the same product.

Source: MCP Registry · repository. Synced Oct 22, 2026, 11:18 UTC.

For agents: Markdown · JSON · report this listing