Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@@bakhshb/proxmox-mcp-openapi check if VM 100 is running on node pve"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Open Source
An OpenAPI-driven 2-tool MCP server for Proxmox VE. Instead of defining 35+ explicit tools, it exposes just 2 generic tools that can execute any of the 480+ Proxmox API operations dynamically — plus dedicated tools for executing commands inside VMs and containers.
Saves ~95% tokens compared to traditional explicit-tool MCP servers.
proxmox-apiExecute any Proxmox VE API operation dynamically.
Param | Type | Required | Description |
| string | yes | API path, e.g. |
| enum | no | HTTP method (auto-detected if omitted) |
| object | no | Path parameter values, e.g. |
| object | no | Query params (GET) or request body (POST/PUT/PATCH) |
proxmox-api-schemaDiscover available API operations from the OpenAPI spec.
Param | Type | Required | Description |
| string | no | Filter by tag: |
| string | no | Get details for a specific path |
| enum | no | Filter by HTTP method |
proxmox-execute-container-commandExecute shell commands inside LXC containers via SSH + pct exec.
Note: The Proxmox REST API has no endpoint for LXC command execution. This tool SSHes to the Proxmox node and runs
pct execlocally.
Param | Type | Required | Description |
| string | yes | Proxmox node name (e.g. |
| string|number | yes | Container ID (e.g. |
| string | yes | Shell command to run inside the container |
Returns: { success, exitCode, output, error, node, vmid, command }
proxmox-execute-vm-commandExecute commands inside VMs via QEMU guest agent.
Requirements: VM must be running with
qemu-guest-agentinstalled inside the guest.
Param | Type | Required | Description |
| string | no | Proxmox node name (default: |
| number | yes | VM ID (e.g. |
| string | yes | Single executable with args (no pipes/redirects) |
| number | no | Timeout in ms (default: |
Returns: { success, exitCode, output, error, outTruncated?, errTruncated? }
Related MCP server: Proxmox MCP Enhanced
Node.js 18+
npm or yarn
Proxmox VE instance with API token
For container commands: SSH key access to Proxmox node
# Clone the repository
git clone https://github.com/bakhshb/proxmox-mcp-openapi.git
cd proxmox-mcp-openapi
# Install dependencies
npm install
# Build TypeScript
npm run buildnpm install -g @bakhshb/proxmox-mcp-openapiThen register with your MCP client (see MCP Client Configuration).
cp .env.example .envRequired:
Variable | Description |
| Base URL including |
| Token in |
Optional:
Variable | Default | Description |
|
| Skip TLS cert verification (for self-signed certs) |
|
| Request timeout in ms |
|
| Path to SSH private key |
|
| SSH username |
|
| SSH port |
In Proxmox Web UI: Datacenter → Permissions → API Tokens → Add
Copy the token in format: user@realm!tokenid=secret
Assign appropriate permissions to the token (e.g. PVEAuditor for read-only, PVEEditor for modifications)
# Generate SSH key
ssh-keygen -t ed25519 -f ~/.ssh/proxmox_mcp
# Add public key to Proxmox
# Copy: cat ~/.ssh/proxmox_mcp.pub
# Paste in: Proxmox Web UI → Permissions → SSH Keys → Add{
"mcp": {
"servers": {
"proxmox-mcp": {
"command": "npx",
"args": ["@bakhshb/proxmox-mcp-openapi"],
"env": {
"PROXMOX_URL": "https://your-proxmox:8006/api2/json",
"PROXMOX_API_TOKEN": "root@pam!mytoken=your-secret",
"PROXMOX_INSECURE": "true",
"PROXMOX_SSH_KEY_PATH": "~/.ssh/proxmox_mcp"
}
}
}
}
}{
"mcpServers": {
"proxmox-mcp": {
"command": "npx",
"args": ["@bakhshb/proxmox-mcp-openapi"],
"env": {
"PROXMOX_URL": "https://your-proxmox:8006/api2/json",
"PROXMOX_API_TOKEN": "root@pam!mytoken=your-secret",
"PROXMOX_INSECURE": "true",
"PROXMOX_SSH_KEY_PATH": "~/.ssh/proxmox_mcp"
}
}
}
}Add the same configuration to settings.json under mcp.servers.
// Get VM status
proxmox-api path="/nodes/pve/qemu/100/status/current"
// List all VMs
proxmox-api path="/nodes/pve/qemu"
// Start a VM
proxmox-api path="/nodes/pve/qemu/100/status/start" method=POST
// Get cluster resources
proxmox-api path="/cluster/resources"
// Discover storage operations
proxmox-api-schema tag="storage"
// Get parameters for a specific endpoint
proxmox-api-schema path="/nodes/{node}/qemu/{vmid}/config"// Get OS version
proxmox-execute-container-command node="pve" vmid=110 command="cat /etc/os-release"
// Check hostname
proxmox-execute-container-command node="pve" vmid=110 command="hostname"
// Disk usage
proxmox-execute-container-command node="pve" vmid=110 command="df -h"
// Update packages
proxmox-execute-container-command node="pve" vmid=110 command="apt update && apt upgrade -y"// Simple command
proxmox-execute-vm-command node="pve" vmid=100 command="hostname"
// → { success: true, output: "dokploy-swarm-1" }
// Check disk space (note: no flags, QEMU agent limitation)
proxmox-execute-vm-command node="pve" vmid=100 command="df"
// → { success: true, output: "Filesystem..." }
// For shell features (pipes, redirects), use proxmox-api directly:
// 1. POST /agent/exec with input-data for stdin
// 2. GET /agent/exec-status?pid=<pid>MCP Server | Architecture | Tools | Token Cost |
Traditional Proxmox MCP | One tool per API operation | ~35 explicit tools | ~15,000–20,000 tokens |
@bakhshb/proxmox-mcp-openapi | OpenAPI-driven dynamic | 2 generic tools + 2 exec tools | ~500–1,000 tokens |
Result: ~95% token reduction
MCP servers send their tool schemas to the LLM on every request. With a 200k token context window:
Traditional approach: 15-20k tokens just for schema, leaving less room for actual work
OpenAPI-driven: ~500 tokens, leaving the context window for your data
Instead of hardcoding all tools:
// Traditional: 35+ explicit tools
server.tool("list_nodes", {...})
server.tool("get_vm_status", {...})
server.tool("start_vm", {...})
// ... 30 more
// OpenAPI-driven: 2 dynamic tools
server.tool("proxmox-api", {...}) // executes any API operation
server.tool("proxmox-api-schema", {...}) // discovers available operationsThe schema is loaded from the OpenAPI spec at startup, not hardcoded in the tools.
This project builds on two key inspirations:
ProxmoxMCP-Plus — The original 35-tool Python MCP server for Proxmox VE. It proved the full API surface area but carried high token overhead.
limehawk/dokploy-mcp — Demonstrated that a 2-tool OpenAPI-driven pattern could dramatically reduce token costs while maintaining full API coverage.
The proxmox-mcp-openapi takes the best of both: the dynamic OpenAPI approach from dokploy-mcp applied to Proxmox, with the additional SSH-based container command execution tools carried over from ProxmoxMCP-Plus.
Traditional MCP: 35 tools × detailed schemas = 15k+ tokens
↓
OpenAPI-driven: 2 tools + runtime schema loading = ~500 tokens
↓
Result: 95% token reduction with full API coverage2 core tools + 2 execution tools
OpenAPI-driven: 480 operations dynamically loaded from spec
TypeScript: Type-safe, compiled to JavaScript
Pure REST API: No Proxmox Perl library dependencies
SSH key auth for container commands (no API token needed for LXC exec)
Exec tools carried over from the original ProxmoxMCP-Plus (SSH+pct for LXC, QEMU agent for VMs)
Includes the Proxmox VE API v2 specification with 480 operations across:
cluster (122 operations)
nodes (311 operations)
storage (5 operations)
access (36 operations)
pools (5 operations)
version (1 operation)
Verify SSH key added to Proxmox Web UI → Permissions → SSH Keys
Verify container is running (not stopped)
Test SSH manually: ssh -i ~/.ssh/proxmox_mcp root@<proxmox-host>
Check node parameter is correct (use node name like pve, not IP)
Verify SSH is running on Proxmox node
Check firewall allows port 22
Verify token format: user@realm!tokenid=secret (not just the UUID)
Check token has appropriate permissions in Proxmox
QEMU agent doesn't support shell features (pipes, redirects)
Use proxmox-api directly with input-data for stdin
QEMU guest agent not installed or not running inside the VM
Install with: apt install qemu-guest-agent (Linux) or enable via Hyper-V/VMware tools
MIT
Execute any Proxmox VE API operation. Specify the path from the OpenAPI spec (e.g. /nodes/{node}/qemu) and optional path params, query params, or body. HTTP method is auto-detected from the spec. Use proxmox-api-schema to discover paths and parameters.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | The API path as defined in the OpenAPI spec, e.g. "/nodes/{node}/qemu/{vmid}/status/current". Use proxmox-api-schema to discover available paths. | |
| method | No | HTTP method. If omitted, auto-detected from the OpenAPI spec (prefers GET when available). | |
| params | No | For GET/DELETE: query string parameters. For POST/PUT/PATCH: JSON request body. | |
| pathParams | No | Path parameter values to substitute into the URL, e.g. { "node": "pve", "vmid": 100 } |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description reveals that the tool can execute any Proxmox operation and that the method is auto-detected, which is useful behavioral context. The annotations already signal readOnlyHint=false and openWorldHint=true, so the non-read-only nature is covered. Missing are cautions about destructive or irreversible API operations, permissions, or response/error behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and front-loaded with the core purpose. The guidance to use proxmox-api-schema is useful, though it slightly repeats the path parameter description in the schema. Overall, every sentence earns a place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is a broad generic API executer, and the description covers the essential invocation pattern: specify an OpenAPI path, supply pathParams, and pass query/body params. However, with no output schema and very broad behavior, it would benefit from stating that responses are raw Proxmox API responses and from warning about the potential impact of write/destructive operations.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents path, method, params, and pathParams. The description adds a helpful example path and clarifies that params can be query params or JSON bodies, but it mostly restates what the input schema already conveys.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Execute any Proxmox VE API operation.' It clearly conveys that this is a generic raw API passthrough and distinguishes it from the specialized command siblings by framing it as the tool for any OpenAPI-defined operation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives useful guidance to use proxmox-api-schema for path and parameter discovery, and mentions HTTP method auto-detection. However, it does not explicitly say when to prefer the specialized sibling tools (proxmox-execute-vm-command, proxmox-execute-container-command) or warn against using this generic tool for operations those tools are designed to handle.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Discover Proxmox VE API operations and their parameters from the OpenAPI spec. Call with no args for a tag summary, with tag to list operations, or with path for full parameter details.
| Name | Required | Description | Default |
|---|---|---|---|
| tag | No | Filter operations by tag, e.g. "nodes", "cluster", "storage", "access" | |
| path | No | Get details for a specific path, e.g. "/nodes/{node}/qemu/{vmid}/status/current" | |
| method | No | Filter by HTTP method when combined with path (defaults to listing all methods for that path) |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint and idempotentHint, so the bar for added behavioral disclosure is lower. The description adds context by explaining the three levels of output detail and that it reads from the OpenAPI spec, which goes beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with no filler. The purpose is front-loaded and the usage modes are summarized in a compact, scannable second sentence.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only discovery tool with three all-optional parameters, the description covers the important call variants without needing to describe an output schema. It lacks explicit mention of sibling alternatives, but this is not essential for using the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents tag, path, and method. The description adds meaningful semantics by mapping argument combinations to output granularity: no args → tag summary, tag → operations, path → full details, which is not fully captured in the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Discover') and resource ('Proxmox VE API operations and their parameters from the OpenAPI spec'), which clearly identifies what the tool does. It also distinguishes itself from execution-focused siblings by framing itself as a discovery/schema-exploration tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit invocation guidance: no args for a tag summary, tag for operation lists, and path for full parameter details. It does not explicitly name alternatives or state when not to use this tool, but the usage modes are clear enough for an agent to call it correctly.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Execute a shell command inside a running LXC container via SSH + pct exec. Uses SSH key to connect to the Proxmox node and runs 'pct exec -- ' inside the container. Requires the container to be running. Configure SSH via PROXMOX_SSH_KEY_PATH, PROXMOX_SSH_USER, PROXMOX_SSH_PORT environment variables.
| Name | Required | Description | Default |
|---|---|---|---|
| node | Yes | Proxmox node name (e.g. 'pve', 'pve1') | |
| vmid | Yes | Container ID (e.g. 110, '110') | |
| command | Yes | Shell command to run inside the container |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses the underlying SSH mechanism, the exact pct exec invocation, the prerequisite that the container must be running, and the required environment variables. This adds meaningful operational context beyond the minimal annotations (readOnlyHint false, openWorldHint false) without contradicting them.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three focused sentences with the main purpose front-loaded, followed by prerequisites and configuration. Minor redundancy exists between the first sentence (via SSH + pct exec) and the second sentence (Uses SSH key... and runs pct exec), but each sentence still contributes useful operational detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 3-parameter command-execution tool with no output schema, the description adequately covers how to invoke it and what is required. It does not mention return values or error behavior, but the prerequisites, authentication, and execution method are sufficiently explained.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for all three parameters, so the schema already defines node, vmid, and command. The description adds no parameter-specific semantics beyond what the schema provides, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific verb ('execute'), resource ('shell command inside a running LXC container'), and mechanism ('SSH + pct exec'). It explicitly targets containers, which distinguishes it from the sibling proxmox-execute-vm-command without requiring schema inspection.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives clear context: the container must be running, and SSH must be configured via environment variables. However, it does not explicitly call out the sibling proxmox-execute-vm-command for VM use cases, leaving the VM/container split implicit rather than stating when-not-to-use.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Execute a command inside a running VM via QEMU guest agent. The VM must have the QEMU guest agent installed and running. Pass command as a single string (e.g., 'apt-get update' or 'uname -a'). The tool parses it into an array per the guest agent API. Shell features like pipes (|) and redirects (2>&1) are NOT supported. Uses the Proxmox API (PROXMOX_URL, PROXMOX_API_TOKEN) for communication.
| Name | Required | Description | Default |
|---|---|---|---|
| node | No | Proxmox node name (e.g. 'pve', 'pve1') | pve |
| vmid | Yes | VM ID (e.g. 100, 101) | |
| command | Yes | Command to run inside the VM via QEMU guest agent. The command string is parsed into an array per the guest agent API (e.g., 'uname -a' becomes ['uname', '-a']). Note: shell features like pipes (|) and redirects (2>&1) are NOT supported — pass a single executable with arguments only. | |
| timeoutMs | No | Maximum time to wait for command completion in milliseconds (default: 30000) |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only declare readOnlyHint=false and openWorldHint=false, so the description carries the burden of operational detail. It adds meaningful constraints: command parsing into argv arrays, guest agent prerequisite, and no shell features. It does not disclose return/output or exit-code behavior, but the operational boundaries it provides are valuable.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three tight sentences: purpose first, then the key prerequisite, then the command-format limitation. Every sentence earns its place and the most important selection information is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers prerequisites, command parsing, and unsupported shell features well, but this is a mutating execution tool with no output schema, so the description should say what the caller gets back (stdout, exit code, timeout result). That omission prevents an agent from fully anticipating the outcome of the call.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with the command, timeout, vmid, and node parameters already documented in the schema. The description reinforces the command semantics with examples, but adds no meaning beyond what the schema already provides, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: executing a command inside a running VM via the QEMU guest agent. The VM vs. container framing distinguishes it from the sibling proxmox-execute-container-command without needing to open the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Clear context is provided: the VM must have the QEMU guest agent installed and running, and shell features like pipes/redirects are unsupported. However, it does not explicitly name an alternative tool for containers or state when this tool should not be used.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
v1.1.1proxmox-apiproxmox-api-schemaproxmox-execute-container-commandproxmox-execute-vm-commandScored across 4 tools
The schema-discovery and generic execution tools are clearly separated, and the two command tools are distinguished by target (LXC container vs QEMU VM). There is mild overlap because proxmox-api could invoke the same guest-agent endpoints that proxmox-execute-vm-command wraps, but the descriptions make the intended use clear.
All tools share the proxmox- prefix and use lowercase hyphenated names, but the API tools are noun-style (proxmox-api, proxmox-api-schema) while the command tools are verb-noun-style (proxmox-execute-...-command). This is readable and grouped, yet the verb/noun convention is not consistent across the set.
Four tools is within the ideal range. The schema-discovery plus generic-execution pair makes the full Proxmox API available without requiring dozens of endpoint-specific tools, and the two command-execution tools add distinct practical guest operations.
Because proxmox-api can execute any operation from the OpenAPI spec, the tool set covers the entire Proxmox management API surface. The schema tool provides the necessary discovery loop, and the container/VM command tools cover common guest execution workflows.
The OpenRouter for tools. One MCP connection gives any AI agent 254 hosted tools, pay per call.
MCP server for progressive tool usage at any scale (see https://klavis.ai)
One MCP endpoint for Claude, GPT & Gemini: 100+ tools + no-code connectors + agent workers.
MCP-Native LLM Orchestration Agent