Proximo
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| PROXIMO_AUDIT_KEYED | No | Defaults to on; set to 'off' to disable HMAC-SHA256 keying of the audit ledger. | 1 |
| PROXIMO_ENABLE_EXEC | No | Opt-in: enables near-root LXC exec via SSH. Off by default. | 0 |
| PROXIMO_CT_ALLOWLIST | No | Comma-separated list of CTIDs allowed for exec (fail-closed). | |
| PROXIMO_ENABLE_AGENT | No | Opt-in: enables qemu-guest-agent operations inside VMs. Off by default. | 0 |
| PROXIMO_LEDGER_REDACT | No | If set to '1', record fingerprint instead of SQL body/command argv in ledger (privacy). | 0 |
| PROXIMO_A2A_TOKEN_FILE | No | Path to a file containing the bearer token for A2A server (non-localhost bind requires this). | |
| PROXIMO_AGENT_ALLOWLIST | No | Comma-separated list of VMIDs allowed for agent operations (fail-closed). | |
| PROXIMO_AUDIT_EXPECTED_HEAD | No | Expected head hash for audit verification (off-box anchor against tail truncation/forgery). |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| proximo_findB | READ-ONLY: find API addresses by plain words ('list datastores'). A verb picks the method. Returns access and blast-radius tier. 5 by default. |
| proximo_planA | READ-ONLY, mutates nothing: the governed verdict (armed, tier, consent) for one address, with the parameters you gave and the required ones you lack; fields='name1,name2' or 'all' shows the vendor's full schema. A mutation's plan also reads the target: current, change, noop. Run before proximo_call. path may be words: one match is planned, several come back to pick from. |
| proximo_readA | READ-ONLY: run a GET by /path, or by words with no slash. args = query parameters (params: old name). Rows come lean with a total; fields='all' or 'name,status' for others; over the cap you get counts and a next line. since='24h': what changed, from the door's snapshots. wait=N on .../tasks/{upid}/status waits up to N s (max 600). diagnose=true on a node or guest path: health and advisory flags. Credentials come back withheld. |
| proximo_callA | MUTATION: run a governed POST/PUT/DELETE. Without confirm=true it returns the plan (verdict, consent id, current, change) and mutates nothing. Refused unless the operator is armed AND the address has an authored blast-radius tier. Every call, refused or executed, is receipted. Task-backed calls are waited on (wait=N s, default 60, max 600; 0 submits only). method=undo with path=<undo.id> puts a receipt's capture back, plan first; withheld or unpublished keys come back as skipped. |
| audit_entriesC | READ-ONLY: the PROVE ledger, newest first, bounded; says when it truncated. |
| audit_verifyA | READ-ONLY: walk the chain, report the first break; expected_head catches a cut tail; path= checks a sealed archive. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
| safe_migration | Runbook: migrate a guest (by vmid) to another node safely (look, plan, call, verify). |
| diagnose_cluster | Runbook: read-only health sweep of the cluster (DIAGNOSE, no changes). |
| provision_container | Runbook: provision a new LXC within policy (look, plan, call, verify). |
| safe_backup | Runbook: back up a guest (by vmid) and verify the backup landed. |
| review_receipts | Runbook: verify the PROVE ledger against a head you hold, and read what it holds. |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 6 tools
The core split (find = discover addresses, plan = dry-run verdict, read = GET, call = mutate, audit = ledger) is clear and each tool has a distinct role. The one soft spot is that proximo_read also accepts plain words while proximo_find exists specifically to resolve words to addresses, and proximo_plan also reads current state, which could cause a misselection.
Names follow a predictable prefix_action pattern (proximo_read/call/find/plan, audit_entries/audit_verify), which is easy to scan. Minor deviation: audit_entries uses a noun while the others use verbs, splitting the set into two prefixes, but readability is unaffected.
Six tools is well-scoped for a governed API client: one each for discovery, read, plan, mutate, and two for audit integrity. No tool appears redundant or vestigial.
The surface covers the full lifecycle: discovery (proximo_find), schema/verdict inspection (proximo_plan), reads (proximo_read), mutations with plan-first safety and undo (proximo_call), plus ledger inspection and chain verification (audit_entries/audit_verify). No obvious dead ends for the stated purpose.