Enables execution of commands on a Proxmox host via SSH, allowing for the management and monitoring of virtual machines and containers while implementing security filters to prevent destructive system actions.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@Proxmox SSH MCP Server list all virtual machines and their current status"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
A Model Context Protocol (MCP) server that enables AI assistants to execute commands on a Proxmox host via SSH.
SSH key-based authentication (no passwords in code)
Built-in security: dangerous commands are blocked
Single tool: proxmox_run_host_command
Related MCP server: SSH MCP Server
Node.js 18+
SSH key pair (~/.ssh/id_ed25519)
Public key added to Proxmox server's ~/.ssh/authorized_keys
git clone https://github.com/Zaptimist/mcp-proxmox.git
cd mcp-proxmox
npm installSet your Proxmox host via environment variables or edit index.js:
Option 1: Environment variables (recommended)
export PROXMOX_HOST=192.168.1.100
export PROXMOX_USER=root
export PROXMOX_PORT=22
export PROXMOX_KEY_PATH=~/.ssh/id_ed25519Option 2: Edit index.js directly
const sshConfig = {
host: process.env.PROXMOX_HOST || '192.168.1.100', // Your Proxmox IP
username: process.env.PROXMOX_USER || 'root',
port: parseInt(process.env.PROXMOX_PORT) || 22,
privateKeyPath: process.env.PROXMOX_KEY_PATH || path.join(os.homedir(), '.ssh', 'id_ed25519')
};The MCP server will automatically detect if SSH keys are missing or not configured and provide setup instructions. But here's the manual process:
Generate a key (if you don't have one):
ssh-keygen -t ed25519Copy public key to Proxmox:
Windows (PowerShell):
type $env:USERPROFILE\.ssh\id_ed25519.pub | ssh root@YOUR_PROXMOX_IP "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"Linux/Mac:
ssh-copy-id root@YOUR_PROXMOX_IPTest the connection:
ssh root@YOUR_PROXMOX_IP "echo 'SSH key auth works!'"If you haven't set up SSH keys yet, the MCP server will return helpful instructions when you try to use it.
Add to your MCP client config (e.g., ~/.kiro/settings/mcp.json):
{
"mcpServers": {
"proxmox": {
"command": "node",
"args": ["/path/to/mcp-proxmox/index.js"],
"env": {
"PROXMOX_HOST": "192.168.1.100"
},
"disabled": false,
"autoApprove": ["proxmox_run_host_command"]
}
}
}The server exposes one tool:
proxmox_run_host_commandExecute a command on the Proxmox host.
Input:
command (string, required): The command to execute
Example:
{
"command": "qm list"
}Response:
{
"success": true,
"command": "qm list",
"host": "192.168.1.100",
"exitCode": 0,
"stdout": "VMID NAME STATUS MEM(MB) ...",
"stderr": ""
}The following commands are blocked for safety:
VM/Container deletion (qm destroy, pct destroy)
File operations (rm, rmdir, dd)
System operations (shutdown, reboot, halt)
Package removal (apt remove, apt purge)
Service management (systemctl stop)
Storage deletion (zfs destroy, lvremove)
Destructive actions must be performed manually via the Proxmox web interface.
MIT
Execute a command on the Proxmox host via SSH
| Name | Required | Description | Default |
|---|---|---|---|
| command | Yes | The command to execute on the Proxmox host |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. While it mentions execution via SSH (implying potential security/permission requirements), it doesn't address critical aspects like whether this is a read-only vs. destructive operation, error handling, rate limits, or what the response format looks like. The description adds minimal behavioral context beyond the basic action.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence with zero wasted words. It's appropriately sized for a single-parameter tool and immediately communicates the core functionality without unnecessary elaboration.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a command execution tool with no annotations and no output schema, the description is insufficiently complete. It doesn't address what kind of commands are appropriate, security implications, expected output format, error conditions, or any behavioral characteristics. The agent would have significant gaps in understanding how to properly use this tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already fully documents the single 'command' parameter. The description doesn't add any meaningful semantic context beyond what's in the schema (e.g., examples of valid commands, command syntax constraints, or execution environment details). The baseline 3 is appropriate when the schema does all the parameter documentation work.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Execute a command') and target ('on the Proxmox host via SSH'), providing a specific verb+resource combination. However, with no sibling tools mentioned, there's no opportunity to demonstrate differentiation from alternatives, preventing a perfect score.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives, prerequisites, or constraints. It simply states what the tool does without any context about appropriate use cases or limitations.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
With only one tool, there is no possibility of ambiguity or overlap between tools. The tool's purpose is clearly defined as executing commands on the Proxmox host via SSH, leaving no room for confusion with other tools.
Since there is only one tool, naming consistency is inherently perfect. The tool name 'proxmox_run_host_command' follows a clear verb_noun pattern, and with no other tools to compare, there are no inconsistencies in naming conventions.
A single tool is too few for a server named 'Proxmox SSH MCP Server', which implies broader functionality for managing Proxmox environments via SSH. This minimal toolset feels thin and under-scoped for the apparent domain, limiting agents to only command execution without other common operations.
The tool surface is severely incomplete for Proxmox management via SSH. It lacks basic operations such as listing VMs/containers, managing resources, or performing configuration tasks, which are essential for this domain. Agents will face significant gaps and likely fail to accomplish typical Proxmox-related workflows.
Unclaimed servers have limited discoverability.
If you are the server author, to access and configure the admin panel.
Let AI operate servers without SSH. Choose actions, approve risky changes, and audit every step.
Operate Linux, macOS and Windows from your LLM. Every action runs through an auditable allowlist.
Scoped, audited SSH exec, sessions, and SFTP on your saved servers without exposing credentials
Provides capabilities that let LLM agents perform a range of infrastructure management tasks.
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/Zaptimist/mcp-proxmox'
If you have feedback or need assistance with the MCP directory API, please join our Discord server
