Proxmox PlusBLOCK
Use MCP and OpenAPI to safely control Proxmox VE VMs, LXCs, backups, and snapshots from LLMs and AI agents.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Operate Proxmox VE from MCP clients, AI agents, and OpenAPI tooling through one security-conscious control plane for VMs, LXCs, snapshots, backups, ISOs, container commands, and persistent long-running jobs.
Quick Start | Client Install | Demo | Tools | Safety | Scenarios | Docs | Wiki
Why ProxmoxMCP-Plus
ProxmoxMCP-Plus sits between AI clients and Proxmox VE so operators do not have to stitch together raw API calls, one-off shell scripts, and custom job polling for every workflow.
It exposes the same operational surface in two ways:
MCPfor Claude D
96650e63095fOBSERVED · 2026-10-02Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add proxmox-mcp-plus --env PROXMOX_TOKEN_VALUE=${PROXMOX_TOKEN_VALUE} -- uvx proxmox-mcp-plus==0.5.24Exposed tools (5)
5 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
get_nodes | read | return [{ |
ping | read | return |
protected_action | read | if approval_token != |
proxmox_code_get_schema | read | tools = self._runtime_tools() |
proxmox_code_search | read | query_l = query.lower().strip() |
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (3 observation(s))
- Network
- declared (2 observation(s))
- Shell
- declared (1 observation(s))
- Dependencies
- pinned
- Secrets in source
- found
Findings (19)
f"printf '%s\\n' '{escaped}' {redirect} /root/.ssh/authorized_keys"" && chmod 600 /root/.ssh/authorized_keys"
__import__(pkg)
MCP_OAUTH_TEST_DATABASE_URL: postgresql://postgres:[email protected]:5432/proxmox_mcp_test
.mcpbignore
exec(
"Your ~/.ssh/config still contains jump-host entries. This usually means the real PVE lives behind a jump host, not on localhost."
log(f"Updating authorized_keys inside container {ctid}")key_file = "/home/user/.ssh/proxmox_key"
if curl --fail --silent --show-error http://127.0.0.1:18811/livez > livez.json; then
curl --fail --silent --show-error http://127.0.0.1:18811/livez | jq -e '.status == "ok"'
livez = wait_for_http(f"http://127.0.0.1:{port}/livez")health = wait_for_http(f"http://127.0.0.1:{port}/health", headers=openapi_headers())f"http://127.0.0.1:{port}/openapi.json",[](https://cursor.com/en/install-mcp?name=proxmox-mcp-plus&config=eyJjb21tYW5kIjoidXZ4IHByb3htb3gtbWNwL
[](https://cursor.com/en/install-mcp?name=proxmox-mcp-plus&config=eyJjb21tYW5kIjoidXZ4IHByb3htb3gtbWNwL
decoded = base64.b64decode(credentials, validate=True).decode("utf-8")cat ~/.ssh/proxmox_key.pub
docs/assets/proxmoxmcp-demo.gif
Gates applied: no_behavioural_pass.
96650e63095ffull audit observations/trust-audit/mcp-server/rekklesna__proxmox-plus.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-02 | 96650e63095f | BLOCK | D | 69 | first audit |
Questions
What is the Proxmox Plus MCP server?
Use MCP and OpenAPI to safely control Proxmox VE VMs, LXCs, backups, and snapshots from LLMs and AI agents.
What tools does Proxmox Plus expose?
5 in total: 5 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Proxmox Plus safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 2 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does Proxmox Plus need?
It reads COMMAND_POLICY_APPROVAL_TOKEN, COMMAND_POLICY_HIGH_RISK_APPROVAL_TOKEN, MCP_API_KEY, MCP_OAUTH_ACCESS_TOKEN_TTL_SECONDS, MCP_OAUTH_CLIENT_IP_HEADER, MCP_OAUTH_DATABASE_URL, MCP_OAUTH_DB_COMMAND_TIMEOUT_SECONDS, MCP_OAUTH_DB_POOL_MAX_SIZE, MCP_OAUTH_DB_POOL_MIN_SIZE, MCP_OAUTH_ENABLED, MCP_OAUTH_ISSUER and MCP_OAUTH_MAX_REGISTERED_CLIENTS from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does Proxmox Plus run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on PyPI as proxmox-mcp-plus.
How current is this page?
The grade is for one exact copy of the source (96650e63095f), read on 2026-10-02. The repository is watched and re-audited when it changes.