Verified

Proxmox MCP Server

Proxmox VE resource management via 50 dedicated tools for nodes, VMs, and snapshots.

Data last scanned today · Reviewed today

40 6 dangerous tools50 tools★ 2PythonMIT

Overview

Proxmox MCP Server provides an interface for interacting with Proxmox VE environments directly from an AI assistant. It offers 50 distinct tools covering nodes, QEMU VMs, LXC containers, storage systems, and snapshots, allowing users to query and manage their virtualization infrastructure without complex manual navigation. The server is designed for simplicity, utilizing environment variables for configuration rather than relying on external files, databases, or persistent state. It supports both stdio and HTTP communication modes, and it outputs raw JSON to ensure that LLMs receive clean, programmatic data during operation.

Our verdict

This server carries a high risk level (security score: 30/100) and is not recommended for production environments where strict security boundaries are required. Because it is community-maintained and has not yet undergone editorial review or security audits, users should exercise extreme caution. Its current status as a single-contributor project with unreviewed authentication methods necessitates a cautious approach, ideally limiting its use to isolated or non-sensitive Proxmox testing clusters.

Zero direct dependencies minimize the software supply chain surface area.
Provides fifty specialized tools for comprehensive virtualization management.
Features a read-only default mode to prevent accidental destructive operations.
Supports multi-arch Docker images for deployment on diverse hardware.

High risk level score due to lack of independent security review.
Single contributor poses a potential long-term maintenance and bus-factor risk.
Authentication methods have not yet been formally audited for vulnerabilities.

Tools

Tool	Description	Risk
list_nodes	List all cluster nodes with status, CPU, memory, uptime	low
get_node_status	Detailed node metrics (CPU, memory, disk, load, kernel)	low
get_node_networks	Network interfaces on a node	low
get_node_disks	Physical disks on a node	low
get_node_services	Proxmox system services and their state	low
get_node_updates	Pending APT package updates	low
get_node_rrd_data	Historical CPU/memory/disk/network metrics (RRD)	low
get_node_tasks	Recent tasks on a node, optionally errors only	low
get_task_status	Status of a specific task by UPID	low
get_task_log	Log output from a task	low

Compatibility

Client	Local	Docker	Remote	Read-only
ChatGPT
Claude Desktop
Cursor
VS Code
Windsurf

Frequently asked questions

›How do I secure the server against destructive operations?

The server is read-only by default. You can control the allowed level of destructive operations by setting the PROXMOX_RISK_LEVEL environment variable to 'read', 'lifecycle', or 'all'.

›Which authentication methods are supported?

You can use either a Proxmox API token or a password. If both are configured, the token authentication method will take precedence.

›Does the server require specific host permissions?

It is recommended to create a dedicated user and token for the MCP server rather than using root. You should grant this user and token roles that align with your chosen risk level, such as PVEAuditor for read-only access.

›How can I configure the server without modifying my shell profile?

You can declare environment variables directly within the 'env' block of your MCP client configuration file instead of setting them in your shell profile.

›What should I do if the server fails to start with token authentication?

Ensure both PROXMOX_TOKEN_NAME and PROXMOX_TOKEN_VALUE are correctly set. If only one half of the pair is provided, the server will report a startup error.

›Are sensitive fields masked in the output?

Yes, by default the server masks 'cipassword' and 'sshkeys' in the responses. This behavior is controlled by the PROXMOX_REDACT_SECRETS environment variable.