Proxmox VE MCP
Manage Proxmox VE clusters, nodes, VMs, containers, storage, snapshots, and tasks, with optional write operations for starting, shutting down, rebooting, cloning, backing up, and migrating guests.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Proxmox VE MCPlist all virtual machines on the cluster"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Proxmox VE MCP
Manage Proxmox VE through any client that speaks the Model Context Protocol: Claude Desktop, Claude Code, Codex, or an MCP-capable application using a local model. No model API key or model-specific SDK is required by this server.
Inspect clusters, nodes, QEMU virtual machines, LXC containers, storage, snapshots, and tasks. Opt in to starting, shutting down, rebooting, cloning, backing up, and migrating guests. Track operations through Proxmox task IDs.
Read-only by default. Write tools are absent from discovery until enabled. HTTPS certificate verification is enabled; API token secrets are kept out of startup diagnostics and upstream error messages. Both stdio and local Streamable HTTP are supported through the official MCP Python SDK.
Project status
Community release, version 0.2.1. Automated tests exercise the API adapter, MCP discovery and tool calls, a real stdio subprocess, and Streamable HTTP. Proxmox API responses are mocked: a live Proxmox cluster has not yet been validated. Client examples use standard MCP configuration; individual desktop apps have not been manually certified. Please report compatibility results with your PVE/client version. This project is independent of Proxmox Server Solutions GmbH.
Requires Python 3.11+ and network access from the server process to Proxmox VE. Proxmox Backup Server and Datacenter Manager are different APIs and are not supported.
Related MCP server: proxmox-mcp
Quick start
Install from source (no PyPI publication is assumed):
git clone https://github.com/nite-crawler/proxmox-mcp.git
cd proxmox-mcp
python3 -m venv .venv
.venv/bin/python -m pip install --require-hashes --only-binary=:all: -r requirements.lock -r requirements-build.lock
.venv/bin/python -m pip install --no-deps --no-build-isolation .
cp .env.example .env
chmod 600 .envOn Windows, use py -m venv .venv and .venv\Scripts\python.exe in the pip commands.
Set restrictive file permissions appropriate to your OS. Edit .env locally:
PROXMOX_URL=https://pve.example.com:8006
PROXMOX_TOKEN_ID=mcp@pve!assistant
PROXMOX_TOKEN_SECRET=replace-with-your-token-secret
PROXMOX_READ_ONLY=true
PROXMOX_VERIFY_SSL=true
# PROXMOX_CA_BUNDLE=/absolute/path/to/proxmox-ca.pemCreate a dedicated Proxmox user and a privilege-separated API token under
Datacenter → Permissions → API Tokens. Give the user and token the appropriate
ACLs; PVEAuditor on / with propagation is a convenient starting point for
cluster-wide monitoring, but exposes cluster-wide inventory. Narrow ACL paths if
needed. The token's permissions intersect with the user's permissions. See
permissions and deployment before enabling writes.
Use your Proxmox CA certificate or a publicly trusted certificate. The CA bundle must be obtained through a trusted channel; do not work around trust errors by disabling verification on production infrastructure.
Check installation without contacting Proxmox:
.venv/bin/proxmox-mcp --versionClaude Desktop
Merge this entry into your Claude Desktop MCP configuration, replacing both absolute paths. Keep credentials in the env file, not in a shared JSON file.
{
"mcpServers": {
"proxmox": {
"command": "/absolute/path/proxmox-mcp/.venv/bin/proxmox-mcp",
"args": ["--env-file", "/absolute/path/proxmox-mcp/.env"]
}
}
}On Windows, command is the absolute path to .venv\\Scripts\\proxmox-mcp.exe.
Restart the client after changing configuration. See the
official local MCP connection guide.
Claude Code
claude mcp add --transport stdio proxmox -- /absolute/path/proxmox-mcp/.venv/bin/proxmox-mcp --env-file /absolute/path/proxmox-mcp/.envSee Claude Code MCP documentation.
Codex
Add to ~/.codex/config.toml, or a trusted project's .codex/config.toml:
[mcp_servers.proxmox]
command = "/absolute/path/proxmox-mcp/.venv/bin/proxmox-mcp"
args = ["--env-file", "/absolute/path/proxmox-mcp/.env"]Or register with the CLI:
codex mcp add proxmox -- /absolute/path/proxmox-mcp/.venv/bin/proxmox-mcp --env-file /absolute/path/proxmox-mcp/.envSee official Codex MCP documentation.
Local models and other clients
Configure the same command and arguments in an MCP-capable host, or connect to the local HTTP endpoint below. A bare model inference endpoint (including an Ollama API by itself) is not an MCP client: its host application must discover tools, dispatch tool calls, and return the results to the model.
examples/list_nodes.py is a minimal model-independent
Python client that launches this server, performs the MCP handshake, discovers
tools, and calls list_nodes:
.venv/bin/python examples/list_nodes.py --env-file /absolute/path/proxmox-mcp/.envStreamable HTTP
Generate a separate bearer token locally, store it as PROXMOX_HTTP_TOKEN in your
protected env file, and configure your MCP client to send
Authorization: Bearer <that-token>. Never reuse the Proxmox API token secret.
Generate a token with:
python3 -c 'import secrets; print(secrets.token_urlsafe(32))'.venv/bin/proxmox-mcp --env-file .env --transport streamable-http --port 8000Connect your MCP client to http://127.0.0.1:8000/mcp. HTTP is deliberately bound
to IPv4 loopback and uses SDK Host/Origin validation. Every HTTP method requires
one valid bearer header; missing/invalid credentials return 401 before MCP processing.
HTTP startup fails without a token. The token is a shared credential, not OAuth
or per-user authorization: all authenticated clients share the configured Proxmox
identity. Rotate it by replacing the env value, restarting, and updating clients.
Do not expose the plain HTTP endpoint remotely. A remote deployment needs TLS,
appropriate client identity/authorization, and a separate gateway threat model.
Legacy HTTP+SSE transport is not provided. stdio does not require an HTTP token.
Available tools
Every successful result has a data field. Read results are filtered through
operator-configurable field allowlists; omitted fields must not be treated as unset.
Failures become MCP tool errors (isError: true), without raw upstream bodies.
Mode | Tools |
Read-only (default, 14 tools) |
|
Sensitive-output opt-ins (independent) |
|
Write-enabled (7 additional tools) |
|
Destructive opt-in (3 additional tools) |
|
To expose normal write tools, set PROXMOX_READ_ONLY=false and restart the server.
To additionally expose forced stop and snapshot removal/rollback, also set
PROXMOX_ALLOW_DESTRUCTIVE=true. These switches are operator configuration, never
tool arguments. They do not grant Proxmox permissions. Graceful shutdown, reboot,
migration, and some backup modes can still cause downtime in ordinary write mode.
MCP annotations describe impact; client-side approval behavior varies by host.
Use guest_type="qemu" for VMs and guest_type="lxc" for containers. Provisioning
is supported through clone_guest from an existing guest or template. This release
does not expose arbitrary API requests, shell execution, guest deletion, guest
configuration updates, or VM creation from scratch.
Writes returning a UPID:... string are asynchronous submissions, not successful
completion. Call get_task_status with the source node and that UPID until
status is stopped, then check exitstatus == "OK". Use get_task_log for
diagnostics when task-log access is enabled. A timeout does not prove a write failed; check list_tasks before
retrying. The server intentionally never retries writes automatically.
Example requests to your assistant:
“List my VMs and containers and summarize their current state.”
“Show storage capacity on pve1 and recent failed tasks.”
“Clone template 9000 to VM 101, then monitor the clone task.”
“Create a before-upgrade snapshot of VM 101 and confirm the task completed.”
Configuration
Environment variables override values in an explicitly supplied --env-file.
The server never implicitly loads a .env from the working directory.
Variable | Default | Purpose |
| Required | HTTPS origin, e.g. |
| Required | Full ID, e.g. |
| Required | API token secret |
|
| Certificate and hostname verification |
| System trust | PEM CA bundle path |
|
| HTTP timeout in seconds, greater than 0 and at most 300 |
|
| Total operation/HTTP-request deadline in seconds, including slow response streams (0–300, exclusive of 0) |
|
| Maximum upstream response size; enforced while streaming (1 KiB–128 MiB) |
|
| Maximum MCP HTTP request body (1 KiB–4 MiB) |
|
| Concurrent HTTP requests and concurrent tool API calls per server instance (1–64); excess work is rejected |
| Unset | Required for HTTP; separate random bearer token, 32–256 URL-safe characters |
|
| Expose full guest configuration tool, with known secret fields redacted |
|
| Expose task-log tool; logs may contain arbitrary sensitive text |
| Built-in allowlists | JSON object replacing selected output views' field lists; see output policy |
|
| Omit write tools and block writes in the API client |
|
| Enable force-stop, snapshot delete and rollback; requires writes enabled |
Ambient HTTP proxy variables are ignored to keep API tokens on the configured direct connection. Redirects are not followed. Logs go to stderr so stdout remains valid MCP traffic. Freeform descriptions/notes and unlisted fields are omitted by default. Known secret keys and configured credential values are redacted recursively. Allowlisted names, statuses, and opted-in raw data can still contain arbitrary sensitive text; only connect clients you trust with your inventory.
Write audit events are emitted at WARNING level even with default settings.
Capture stderr and configure retention in your MCP host or service manager.
Use --log-level INFO for additional diagnostics; see
audit semantics and limitations.
Responses exceeding the byte limit fail without returning partial data. Compressed
upstream responses are rejected (the client requests Accept-Encoding: identity)
to avoid decompression-based memory exhaustion. Busy HTTP requests return 429;
busy stdio tool calls return a tool error. Limits are shared across sessions of
one server instance; separately launched processes have separate budgets.
Docker (stdio)
docker build -t proxmox-mcp .
docker run --rm -i --env-file .env proxmox-mcpUse -i, not -t, to preserve stdio framing. The image runs as a non-root user.
The final image excludes pip and its bootstrap files; update dependencies by
rebuilding the image, not by installing packages inside a running container.
If using a CA bundle, mount it read-only and point PROXMOX_CA_BUNDLE at its
container path. Host loopback addresses and paths are not automatically available
inside containers. HTTP inside Docker is not exposed by this image.
Development
.venv/bin/python -m pip install --require-hashes --only-binary=:all: -r requirements-dev.lock
.venv/bin/python -m pip install --no-deps --no-build-isolation -e .
.venv/bin/ruff check .
.venv/bin/ruff format --check .
.venv/bin/mypy
.venv/bin/pytest
.venv/bin/python -m build --no-isolation
.venv/bin/pip-audit --require-hashes -r requirements.lockTests use synthetic credentials and mocked Proxmox transport; they never require
or target a live cluster. Coverage includes branches and enforces a 90% minimum.
CI runs the test suite on Python 3.11–3.14 and checks packaging, lint, types, and
dependency vulnerabilities. Container CI reports all OS/Python vulnerabilities and
blocks HIGH/CRITICAL findings with available fixes; unfixed findings remain in the
downloadable report for review. Scheduled weekly CI refreshes the scans.
uv.lock and hashed exports pin runtime, development, and build dependencies;
the Docker base is digest-pinned and Dependabot proposes weekly updates.
See lockfile maintenance. The SDK is bounded to the
tested 1.x maintenance line; upgrading to 2.x requires a separate compatibility review.
See CONTRIBUTING.md, SECURITY.md, architecture, and the live validation checklist. The project is distributed under the MIT license.
Available Tools
14 toolsget_cluster_statusARead-onlyIdempotent
Get cluster quorum and member status (also useful on standalone nodes).
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the safety profile is covered. The description adds a useful behavioral nuance by noting the tool is also useful on standalone nodes, going beyond the annotations without contradicting them.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One concise, information-dense sentence. It puts the core purpose first and adds the standalone-node note without any fluff or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With zero parameters, rich annotations, and an output schema present, the description provides everything needed to select and invoke this tool. The standalone-node note adds helpful context beyond the minimally required summary.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so there is no parameter semantics burden on the description. The input schema confirms the absence of parameters, and the description appropriately says nothing about arguments.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific verb and resource: retrieving cluster quorum and member status. It doesn't explicitly distinguish this from sibling tools like get_node_status or list_nodes, but the resource scope is specific enough for an agent to infer its purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context: use this tool to get cluster quorum and member status, and it also applies to standalone nodes. It doesn't name alternatives or when-not-to-use conditions, but for a zero-parameter read-only tool the context is adequate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_guest_configBRead-onlyIdempotent
Read an allowlisted configuration summary; omitted fields are not unset.
| Name | Required | Description | Default |
|---|---|---|---|
| node | Yes | ||
| vmid | Yes | ||
| guest_type | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already convey readOnly, idempotent, and non-destructive behavior. The description adds useful context beyond annotations by clarifying that omitted fields are not unset, which can prevent a costly misunderstanding for an agent reading a partial configuration summary.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, tight sentence. The primary action is front-loaded, and the important behavioral caveat ('omitted fields are not unset') is appended without verbosity. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only tool with a full output schema and safety annotations, the description is reasonably complete. The main gap is the lack of any usage context or alternate-tool guidance, but the core behavior and non-destructive nature are adequately conveyed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description needs to compensate by explaining parameters, but it does not mention node, vmid, or guest_type at all. The parameter names and enum are somewhat self-explanatory, but no additional semantic meaning is provided beyond the schema itself.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Read') and resource ('allowlisted configuration summary'), which clearly distinguishes this from sibling tools like get_guest_status or list_guests. However, the term 'allowlisted' is not explained, leaving some ambiguity about what exactly is included or excluded.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives such as get_guest_status or list_guests. There is no mention of prerequisites, when a configuration summary is appropriate, or when another tool should be preferred.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_guest_statusARead-onlyIdempotent
Get a guest's power state and current resource usage.
| Name | Required | Description | Default |
|---|---|---|---|
| node | Yes | ||
| vmid | Yes | ||
| guest_type | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and destructiveHint=false, so the safe/read-only profile is covered. The description adds what is being read (power state, current resource usage) but reveals no additional behavioral traits such as authentication requirements, freshness guarantees, or failure behavior. It does not contradict the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence that states the operation and the data returned with no wasted words. The short length is appropriate for a read-only status tool with an output schema and annotations.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple status-read tool, the description plus the readOnly/idempotent annotations and existing output schema cover the essential context. The main gaps are the lack of explicit parameter semantics and sibling routing, but they do not make the tool unusable.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description does not compensate by explaining node, vmid, or guest_type; it only refers generically to 'a guest'. The property names and constraints carry some meaning, but an agent gets no help on how the three required parameters relate to the operation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Get') and resource ('a guest'), and names the exact data returned: power state and current resource usage. This distinguishes it from siblings like get_guest_config (configuration) and list_guests (enumerating guests).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use it—when a single guest's live state or resource usage is needed—but it gives no explicit exclusions or pointers to alternatives such as get_guest_config or list_guests. The context is clear but the guidance is implicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_next_vmidARead-onlyIdempotent
Find an available VM ID. This does not reserve it; concurrent users may claim it.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and idempotentHint=true, so the safety profile is clear. The description adds crucial behavioral context beyond those annotations by explicitly warning that the ID is not reserved and that concurrent users may claim it. This is valuable information that affects how an agent should use the result.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences deliver complete and essential information with no fluff. The primary purpose is front-loaded, followed by the key caveat. Every word earns its place, making it easy for an agent to parse quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter read-only utility with an output schema present, the description is fully complete. It states the core function and the one behavioral nuance that could change how the result is used. Nothing necessary for correct invocation is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so there is no parameter semantics to elaborate on. The baseline of 4 applies, and the description does not need to add parameter-level details. It does not waste space describing nonexistent inputs.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Find') and resource ('an available VM ID'), making the tool's function immediately clear. It also adds the distinguishing caveat that the ID is not reserved, which differentiates it from any reservation or creation tool. The scope is unambiguous and distinct from sibling tools like list_guests or get_cluster_status.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description does not state when to use this tool versus alternatives. It does not mention that the tool should be used before creating a VM or that it complements creation workflows. It also gives no guidance on what to do after obtaining the ID. The only contextual hint is the reservation caveat, which is more behavioral than usage-oriented.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_node_statusARead-onlyIdempotent
Get a node's CPU, memory, swap, load, and uptime.
| Name | Required | Description | Default |
|---|---|---|---|
| node | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already establish read-only, idempotent, non-destructive behavior. The description adds the concrete set of returned metrics but no additional behavioral context such as units, timing, failure modes, or permissions. It is adequate but not exceptional.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler. Every word contributes to what the tool returns, making it easy to scan during tool selection.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple, one-parameter read-only status tool with an output schema and strong safety annotations, the description provides enough information to select and invoke the tool correctly. Return values are presumably covered by the output schema, so no critical detail is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single required parameter 'node' is referenced by the description, and the schema's name and regex pattern make the expected value fairly obvious. However, schema description coverage is 0% and the description does not explain the node format or that it is required, so it only partially compensates.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Uses a specific verb and resource: 'Get a node's CPU, memory, swap, load, and uptime.' This clearly identifies the tool's scope and differentiates it from sibling tools like get_cluster_status and get_guest_status by focusing on node-level metrics.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is for retrieving node resource metrics, so an agent can infer when to call it. However, it does not explicitly state when not to use it or name alternatives, leaving usage guidance implied rather than explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_task_statusARead-onlyIdempotent
Poll a task; completion succeeds only if status=stopped and exitstatus=OK.
| Name | Required | Description | Default |
|---|---|---|---|
| node | Yes | ||
| upid | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly, idempotent, and non-destructive behavior. The description adds valuable context beyond annotations by specifying the exact completion condition (status=stopped and exitstatus=OK), which is important for polling loops and success determination.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence that front-loads the core action and immediately states the critical success condition. There is no redundant wording or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, return values do not need explanation. Combined with rich annotations and a clear success condition, the description is nearly complete for a simple read-only polling tool. The main gap is parameter semantics, but that is already reflected in that dimension.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description carries the burden of explaining parameters. It does not explain what 'node' or 'upid' mean or how they identify a task, though the schema titles and patterns offer partial hints. The description adds minimal parameter-level meaning.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action ('Poll a task') and a precise resource ('task'), with a clear completion condition. It is distinguishable from sibling tools like list_tasks or get_guest_status because it focuses on polling a single task's status and defines success criteria.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies polling a task is the use case, but it does not explicitly state when to use this tool versus siblings like list_tasks or get_guest_status. No alternatives or exclusion criteria are mentioned, leaving some inference to the agent.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_versionARead-onlyIdempotent
Get the connected Proxmox VE version and release.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the safety profile is fully covered. The description adds the 'connected Proxmox VE' scope, clarifying that this returns the version of the currently attached environment. There is no hidden behavioral complexity to disclose for a zero-parameter getter.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, information-dense sentence with no filler. The key action and target resource are front-loaded, and every word contributes to understanding the tool's purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter, read-only, idempotent getter with an output schema, the description is fully sufficient. The annotations cover safety, the output schema covers return structure, and siblings provide enough context to avoid confusion.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the baseline is 4. The description adds meaning about what the returned version represents (the connected Proxmox VE instance) without needing parameter details.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Get') tied to a clear resource ('connected Proxmox VE version and release'). It is immediately distinguishable from all sibling tools, which are about cluster status, resources, nodes, storage, guests, snapshots, tasks, etc.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context: use this tool when you need the Proxmox VE version and release of the connected environment. No exclusions or alternatives are needed because none of the sibling tools serve this purpose and there are no parameters or conditions to disambiguate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_guestsARead-onlyIdempotent
List QEMU virtual machines or LXC containers on one node.
| Name | Required | Description | Default |
|---|---|---|---|
| node | Yes | ||
| guest_type | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and destructiveHint, so the safety profile is covered. The description aligns with these annotations by saying 'List', but adds no extra behavioral detail beyond the node-scope context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The entire description is one focused sentence with no filler. Every word contributes to understanding the tool's purpose and scope.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only listing tool with only two required parameters, an output schema, and safety annotations, the description is sufficiently complete. The only notable omission is explicit sibling differentiation, which is more of a usage-guideline concern than a completeness gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description partially compensates: 'QEMU virtual machines or LXC containers' maps to the guest_type enum values, and 'on one node' clarifies the node parameter. However, it adds no detail about node constraints or how guest_type values map beyond what the schema's enum already provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('List'), specific resource types ('QEMU virtual machines or LXC containers'), and a clear scope ('on one node'). This distinguishes it from broader sibling tools like list_resources and list_nodes without ambiguity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'on one node' implies this tool is for per-node guest listing, but the description does not explicitly mention when to prefer it over alternatives such as list_resources or get_guest_status. Usage context is implied rather than clearly stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_nodesARead-onlyIdempotent
List nodes with uptime, CPU, and memory usage.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the safety profile is covered. The description adds the specific output fields (uptime, CPU, memory usage) beyond the annotations, but does not disclose other behavioral traits like pagination, ordering, or limits. Given the annotations cover the main behavioral concerns, a score of 3 is appropriate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence that front-loads the verb and resource, then lists the specific fields. There is no waste or repetition; every word contributes to clarity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple list tool with no parameters and an existing output schema, the description is sufficient to understand its purpose. It does not explicitly say 'all nodes' but that is implied. The presence of an output schema means return values are documented elsewhere, so the description does not need to elaborate on them. The description is complete enough for an agent to call the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the schema is fully covered (100%) and there is nothing to explain. The baseline for zero parameters is 4, and the description adds no unnecessary parameter information, which is correct.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('List') and resource ('nodes'), and explicitly names the returned metrics (uptime, CPU, memory usage). This clearly distinguishes it from siblings like list_resources or list_storage, leaving no ambiguity about what the tool does.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives such as get_node_status or list_resources. It does not mention any exclusions, prerequisites, or conditions that would help an agent choose this tool over others. The usage is implied but not stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_resourcesBRead-onlyIdempotent
List cluster resources visible to this token; vm includes QEMU and LXC.
| Name | Required | Description | Default |
|---|---|---|---|
| resource_type | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the safety profile is covered. The description adds useful behavioral context: results are filtered by the token's visibility and 'vm' includes both QEMU and LXC. These are consistent with the annotations and add value, but no further behavioral details are disclosed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that front-loads the main action and scope, then adds a useful clarification about the vm type. There is no filler or redundant text; every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple with one optional parameter, annotations cover the safety profile, and an output schema exists. The description communicates the token-scoped visibility and resolves ambiguity in the vm type. The main gap is not stating the default behavior when resource_type is omitted, but the overall definition is adequate for a tool of this complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description carries the burden for explaining resource_type. It clarifies the 'vm' value but leaves 'storage', 'node', 'pool', and 'sdn' semantically undefined. It also does not explain what happens when resource_type is null (the default), which is important for correct invocation. The agent must rely on enum names and inference.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('List'), a specific resource ('cluster resources'), and a scope qualifier ('visible to this token'). It also clarifies the 'vm' resource type by noting it includes QEMU and LXC. It does not explicitly contrast itself with sibling tools like list_nodes or list_storage, but it is clear enough that an agent can understand the core purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides context about token-scoped visibility, which implies the tool respects permissions. However, it gives no explicit guidance on when to use this tool versus the more specific sibling tools (list_guests, list_storage, list_nodes), nor does it say when not to use it. Usage is only implied by the generic resource_type parameter.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_snapshotsBRead-onlyIdempotent
List guest snapshots and their parent relationships.
| Name | Required | Description | Default |
|---|---|---|---|
| node | Yes | ||
| vmid | Yes | ||
| guest_type | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and idempotentHint=true, covering safety and idempotency. The description adds the detail about 'parent relationships,' giving a hint about the output structure. No other behavioral traits like pagination or ordering are mentioned, but given the annotations, this is acceptable.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence with zero wasted words. The action is front-loaded, and the description is appropriately brief for a simple listing tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has an output schema, so return values are covered elsewhere. The description is minimal but sufficient for a straightforward listing operation. However, the parameters are not explained at all, and with 0% schema description coverage, an agent might be uncertain about parameter semantics. The description could be more helpful by clarifying parameters or the meaning of 'parent relationships.'
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description does not explain any parameters. The schema provides types, a pattern for node, min/max for vmid, and an enum for guest_type, but the description adds no additional meaning. It doesn't clarify that vmid is the guest ID or that guest_type selects between QEMU and LXC. With 0% coverage, the description should compensate but fails to.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action 'List' and the resource 'guest snapshots' with an additional detail about 'parent relationships.' This distinguishes it from sibling tools like list_guests and list_storage_content, though it doesn't explicitly name them. The purpose is specific and unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description offers no explicit guidance on when to use this tool versus alternatives. It implies usage for snapshot listing, but lacks any when-to-use or when-not-to-use statements. For a listing tool, this is adequate but could be improved by noting it requires a specific guest and is for snapshot management.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_storageBRead-onlyIdempotent
List storage availability and capacity on a node.
| Name | Required | Description | Default |
|---|---|---|---|
| node | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already provide readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the description need not repeat safety traits. The description adds the node scope but that is already evident from the parameter. It does not disclose additional behaviors like rate limits or response format specifics, so it meets the baseline for annotation-covered tools.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence with no redundant words. It is front-loaded with the action and resource, making it efficient for an agent to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple with one parameter and an output schema, so the description is nearly adequate. However, it lacks usage guidance and does not clarify what 'availability and capacity' means precisely (e.g., disk space vs. storage pools). This leaves minor gaps for an agent, but the output schema likely fills in return details.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate for the 'node' parameter. It says 'on a node', which clarifies the parameter's role as the target, but it does not explain what constitutes a node or any constraints beyond the schema's pattern. This is minimal added value over the parameter name itself.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action 'list' and the resource 'storage' scoped to 'a node'. It is specific enough to distinguish from sibling tools like list_storage_content, though it does not explicitly differentiate. The phrase 'availability and capacity' is somewhat ambiguous but still conveys the core purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given on when to use this tool versus alternatives such as list_storage_content or list_nodes. There are no mentions of conditions, prerequisites, or exclusions, leaving the agent to infer usage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_storage_contentARead-onlyIdempotent
List volumes, backups, ISOs, or container templates in a storage.
| Name | Required | Description | Default |
|---|---|---|---|
| node | Yes | ||
| content | No | ||
| storage | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the safety profile is covered. The description adds no additional behavioral details beyond listing, which is acceptable given the annotations, but it also does not enrich behavioral understanding further.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, front-loaded sentence with no filler. Every phrase adds meaning, and the core action and resource are stated immediately.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is a read-only list operation with annotations and an output schema, so return value details are not needed. The description is sufficient for basic invocation, though it could briefly clarify the role of the node parameter or mention sibling tool list_storage for contrast.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It does map the content parameter to human-readable categories ('volumes, backups, ISOs, container templates'), but it leaves the required node and storage parameters unexplained. Parameter names help, but the description only partially covers the parameter space.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('List') and identifies a clear resource: volumes, backups, ISOs, or container templates within a storage. This makes the tool's purpose immediately distinguishable from siblings like list_storage or list_nodes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context for when to use the tool: to enumerate storage contents of various types. It does not name alternative tools or provide exclusion criteria, but the intended use case is evident from the wording.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_tasksARead-onlyIdempotent
List recent node tasks; use start and limit for pagination.
| Name | Required | Description | Default |
|---|---|---|---|
| node | Yes | ||
| limit | No | ||
| start | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark it read-only and non-destructive, so the description only needs to add behavior on top. It adds 'recent' and pagination, but doesn't disclose ordering, time-window semantics, or whether tasks of all statuses are included. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence that front-loads the core operation and appends the only usage hint needed. No filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Annotations, input constraints, and an output schema cover safety, bounds, and return shape. The description completes the picture with recency and pagination, though 'recent' is left somewhat vague and the sibling get_task_status is not mentioned.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With zero parameter descriptions in the schema, the description must compensate. It does give start and limit a clear purpose (pagination), but it leaves 'node' to be inferred and doesn't define what start represents (offset). This is adequate but not thorough.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
'List recent node tasks' names a specific action and resource, and the 'recent' qualifier narrows the scope. It is clearly a list operation rather than a status lookup, but it doesn't explicitly contrast with get_task_status or list_nodes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The pagination hint ('use start and limit') is useful operational guidance, but there is no statement about when to choose this over get_task_status or when it should not be used. Sibling differentiation is left to the agent's inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
14 tool updates
v0.2.1- First observed
get_cluster_status - First observed
get_guest_config - First observed
get_guest_status - First observed
get_next_vmid - First observed
get_node_status - First observed
get_task_status - First observed
get_version - First observed
list_guests - First observed
list_nodes - First observed
list_resources - First observed
list_snapshots - First observed
list_storage - First observed
list_storage_content - First observed
list_tasks
TDQS
Scored across 14 tools
Most tools target distinct resources such as version, cluster, nodes, storage, guests, and tasks. The only potential confusion is list_nodes versus get_node_status, which both expose node CPU/memory/uptime, but the added detail and singular/plural distinction are clarified in the descriptions.
All tools follow a consistent list_ and get_ convention: list_ prefixes for collections and get_ prefixes for singular resources or statuses. There are no mixed naming styles or vague verbs.
14 tools sits within the ideal well-scoped range and each one serves a clear monitoring or query purpose. No redundant or trivial tools are present.
Read-only coverage is solid: cluster, nodes, storage, guests, snapshots, and tasks are all queryable. However, there are no lifecycle operations to create, modify, delete, start, or stop guests, and get_next_vmid strongly implies provisioning without a corresponding create tool, creating a dead-end.
Maintenance
Related MCP Connectors
- QuallaaOAuthcom.quallaa
Talk to your public-facing AI from any MCP client — Claude, ChatGPT, Cursor, Cline, Windsurf.
A comprehensive Model Context Protocol (MCP) server that enables AI assistants to interact with yo…
MCP server for mandates, delegation, policy-gated execution, credential grants, and audit.
MCP server for Superserve sandboxes: create, exec, and manage Firecracker microVMs
Related MCP Servers
- AlicenseAqualityBmaintenanceMCP server for managing Proxmox VE clusters — provision VMs and containers, manage snapshots and backups, execute commands, browse storage, and monitor resources through natural language3494 PyPI16MIT
- FlicenseNot gradedqualityDmaintenanceMCP server for Proxmox VE that enables AI assistants to inspect and manage LXC containers, VMs, snapshots, and resource pools via the Proxmox API.-
- AlicenseNot gradedqualityBmaintenanceMCP server for managing Proxmox VE virtualization infrastructure, providing tools for VMs, containers, snapshots, storage, cluster nodes, and tasks. Compatible with Claude Desktop, Cline, and other MCP clients via natural language.70 npmMIT
- FlicenseNot gradedqualityBmaintenancePolicy-aware MCP server for Proxmox VE that maps the official API schema to MCP tools, enabling node health, disk, network, journal, updates, guest configuration, snapshots, backups, consoles, task lifecycle, service, command, and file-transfer operations with role-based access control.1-