Proxmox MCP Server

vm_agent_exec

Execute commands inside a Proxmox VM through the QEMU Guest Agent, passing input to stdin for scripted or remote tasks without direct console access.

Instructions

Execute a command inside a VM via the QEMU Guest Agent.

Args: node: The node name. vmid: The VM ID. command: The command to execute. A string is split into arguments using POSIX shell rules (quote paths containing spaces). A list is passed through unchanged and is recommended for Windows guest paths with backslashes, since POSIX splitting otherwise strips them. input_data: Data to pass to stdin.

Input Schema

Name	Required	Description	Default
`node`	Yes
`vmid`	Yes
`command`	Yes
`input_data`	No

Output Schema

Name	Required	Description	Default
`result`	Yes

Schema Changelog

Changes observed during successful MCP inspections.

Changed2 schema fields changedv1.4.4Oct 23, 2026

addedInput schema / properties / command / anyOf

Added value: +[
+  {
+    "type": "string"
+  },
+  {
+    "items": {
+      "type": "string"
+    },
+    "type": "array"
+  }
+]

removedInput schema / properties / command / type
```
Removed value: -"string"
```

First observedv1.3.0May 28, 2026

TDQS

B3.3/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full disclosure burden, and it does add real value by explaining POSIX splitting and the string-vs-list tradeoff. However, it omits key operational traits: that this is arbitrary code execution inside a running guest, that the guest agent must be present, and how this relates to the sibling vm_agent_exec_status (which suggests execution/PID/output retrieval semantics).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded one-sentence purpose followed by a compact Args block; nearly every line earns its place, with the command-splitting guidance being genuinely load-bearing. Slight redundancy in restating the trivial node/vmid descriptions.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be explained, and all four params are covered. But for a remote-code-execution tool with zero annotations, the absence of prerequisites (guest agent required, VM must be running) and of the relationship to vm_agent_exec_status leaves notable gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must carry parameter meaning, and it does for the two non-obvious parameters: 'command' semantics (POSIX splitting for strings, pass-through for lists, backslash handling for Windows paths) and 'input_data' as stdin. 'node' and 'vmid' are restated trivially, which is the only shortfall.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource ('Execute a command inside a VM') and names the mechanism ('via the QEMU Guest Agent'), which separates it from siblings like send_vm_monitor_command or vm_agent_file_write. It doesn't explicitly name the alternatives, so differentiation is implied rather than stated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no statement of when to use this versus send_vm_monitor_command, vm_agent_exec_status, or vm_agent_file_read/write, and no prerequisites such as the guest agent needing to be installed and running in the VM. The agent must infer all selection context from the tool name.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server