Skip to main content
Glama

proxmox-ops-mcp

An MCP server for Proxmox VE, built for operations work: finding out what is wrong with a cluster, whether the backups are actually there, and whether a node can be taken down for maintenance. Write access exists, but it is off by default and every change needs an explicit second call.

CI codecov PyPI License: MIT

Why another Proxmox MCP server

The existing ones mostly expose the API endpoint by endpoint. That is fine for "start VM 104", but questions like "which guests have no backup from last night?" then need a dozen calls, and the model has to know Proxmox well enough to combine them correctly. It usually doesn't. For example, it won't know that a token without VM.Backup gets an empty backup list instead of an error.

This server puts that knowledge into the tools. backup_audit reads the backup volumes, applies the same guest selection as vzdump jobs and checks whether the token is even allowed to see the volumes. The model gets a list of findings back, each with a stable code and a recommendation.

Related MCP server: proxmox-mcp

Status

Version 0.1, usable but young. What has been tested where:

Proxmox VE 9.2, single node, ZFS, two backup storages

all read tools, all write tools (on a throwaway VM in a dedicated pool)

Multi-node clusters, HA, Ceph

unit and integration tests with realistic payloads only

Proxmox VE 8, Proxmox Backup Server storages

not tested live yet; reports welcome

The live tests found three things the API documentation doesn't mention, and the server handles each of them:

  • PVE 9 reports cpu and wait as 0 in the node status call.

  • Backup listings come back empty, without an error, when the token lacks privileges.

  • /cluster/resources lags a few seconds behind the real guest state.

Install

uvx proxmox-ops-mcp --version          # run without installing (uv)
pipx install proxmox-ops-mcp           # or as a CLI tool
docker pull ghcr.io/derdennis1012/proxmox-ops-mcp

Python 3.11 or newer. From source: git clone … && uv sync && uv run proxmox-ops-mcp.

Setup

1. Create an API token. Read-only to start with:

pveum user add mcp@pve
pveum acl modify / --users mcp@pve --roles PVEAuditor
pveum user token add mcp@pve ops --privsep 1          # prints the secret once
pveum acl modify / --tokens 'mcp@pve!ops' --roles PVEAuditor

With only this role, backup_audit cannot see backups. Higher tiers need more privileges, and Proxmox's ACL rules have a few traps. Both are covered in docs/proxmox-setup.md.

2. Check the connection.

$ export PROXMOX_HOST=pve1.example.com PROXMOX_TOKEN_ID='mcp@pve!ops' PROXMOX_TOKEN_SECRET=…
$ uvx proxmox-ops-mcp check
OK    connected to pve1.example.com:8006 as mcp@pve!ops
      Proxmox VE 9.2.5 (release 9.2)
      3 node(s) visible, access tier: read_only

If this fails with SSLError, the node certificate probably does not cover the address you use. That is common when connecting over a VPN. check prints the command to pin the certificate instead.

3. Add it to your client. Claude Code:

claude mcp add proxmox-ops \
  -e PROXMOX_HOST=pve1.example.com \
  -e PROXMOX_TOKEN_ID='mcp@pve!ops' \
  -e PROXMOX_TOKEN_SECRET=… \
  -- uvx proxmox-ops-mcp

Claude Desktop, Cursor, VS Code, OpenAI Codex, Gemini CLI, Hermes Agent, OpenClaw and Docker: see docs/clients.md. It also covers what to watch out for when an autonomous agent uses the server.

Tools

Tool

Tier

cluster_health

read_only

Quorum, offline nodes, CPU/memory, storage fill levels, HA errors

ceph_health

read_only

Ceph health checks with hints, OSD and PG state, monitor quorum, capacity

compare_nodes

read_only

I/O wait, load, swap, memory/I/O pressure (PSI), version drift between nodes

backup_audit

read_only

Missing, stale and unscheduled backups; failed jobs; PBS verification

recent_task_failures

read_only

Failed tasks in a time window

storage_health

read_only

ZFS pool state, device and data errors, scrub age, SMART, SSD wear

node_maintenance_status

read_only

Pending Proxmox updates, needed reboots, expiring node certificates

recommend_placement

read_only

Where a new guest fits, with a score and the reason for every node

plan_node_evacuation

read_only

Can a node be drained, what blocks it, and the commands to do it

list_nodes, list_guests, get_guest, get_task_status

read_only

Inventory, guest config (secrets redacted), task logs

guest_power

operator

start, shutdown, reboot; stop needs admin

create_snapshot

operator

Snapshot before a risky change

migrate_guest

admin

Live migration for VMs, restart migration for containers

Parameters and all finding codes: docs/tools.md.

Example, plan_node_evacuation(node="pve1"), shortened:

{
  "feasible": true,
  "summary": "pve1 can be drained: 3 guests to 2 target nodes, 1 container(s) with a brief restart.",
  "guests": [
    { "vmid": 100, "name": "db01",  "mode": "ha-managed",            "target": "pve3" },
    { "vmid": 101, "name": "web01", "mode": "live-with-local-disks", "target": "pve2",
      "warnings": ["local disks will be copied: scsi0@local-lvm"] },
    { "vmid": 200, "name": "dns01", "mode": "restart",               "target": "pve3" }
  ],
  "steps": [
    "ceph osd set noout   # prevent rebalancing while the node is down",
    "ha-manager crm-command node-maintenance enable pve1   # HA moves its guests automatically",
    "qm migrate 101 pve2 --online --with-local-disks",
    "pct migrate 200 pve3 --restart",
    "# perform maintenance on pve1, reboot, verify it rejoined the cluster",
    "ha-manager crm-command node-maintenance disable pve1",
    "ceph osd unset noout"
  ]
}

Write access

PROXMOX_ACCESS_TIER is read_only unless you change it, and tools above the tier are not registered at all. A write tool works in two steps:

  1. Called normally, it checks the request against the live guest state and returns a preview of what would happen, plus a confirmation token.

  2. Called again with the same arguments and that token, it executes.

The token works once, expires after five minutes and is bound to the exact parameters. That includes the node, so a guest that migrated in between invalidates it. Writes can additionally be limited to named pools or VMIDs and capped per hour. Every preview, execution and rejection is written to an audit log.

The token makes sure that what runs is what was previewed. It does not prove that a person approved it, because the model sees the token. Keep tool approval switched on in your MCP client for the write tools. There are no tools that delete anything.

The details, including the HTTP transport defaults, are in docs/security-model.md.

Configuration

Environment variables with the PROXMOX_ prefix: HOST, TOKEN_ID and TOKEN_SECRET are required. Optional are ACCESS_TIER, CA_BUNDLE or TLS_FINGERPRINT, AUDIT_LOG and a few more. A .env file is only read when passed with --env-file. The full list is in docs/configuration.md.

Development

make install   # uv sync + pre-commit
make check     # ruff, mypy --strict, pytest

The diagnostic logic in src/proxmox_ops_mcp/analysis/ is plain functions over API payloads and is tested without a cluster. tests/live/ runs read-only checks against a real one if you point it at an env file. docs/architecture.md explains the layout, and CONTRIBUTING.md explains how to contribute.

Documentation site: https://derdennis1012.github.io/proxmox-ops-mcp/. Planned next: direct Proxmox Backup Server checks (garbage collection, prune and verify jobs), replication jobs, guest snapshot hygiene.

License

MIT. Proxmox is a trademark of Proxmox Server Solutions GmbH; this project is not affiliated with it.

Available Tools

13 tools
backup_auditBackup auditA
Read-onlyIdempotent

Find guests with missing or stale backups, unscheduled guests and failed jobs.

Reads backup volumes directly from every backup storage (including Proxmox Backup Server), so it reports what actually exists - not what the schedule promises. Set max_age_hours to match your schedule (e.g. ~170 for weekly backups). Failed tasks come from the cluster's recent task list, which only covers recent history.

NameRequiredDescriptionDefault
nodeNoOnly audit guests on this node.
max_age_hoursNoBackups older than this are stale.

Output Schema

NameRequiredDescription
guestsYes
statusYes
findingsYes
guests_okYes
guests_staleYes
guests_totalYes
max_age_hoursYes
guests_missingYes
guests_unknownYes
guests_unscheduledYes
unreadable_storagesYes

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already establish readOnly/idempotent/non-destructive and closed-world, so the safety profile is covered. The description goes beyond them by explaining data provenance (queries every backup storage including Proxmox Backup Server directly, so results reflect actual volumes rather than scheduled intent) and by disclosing a real coverage limitation in the task-derived failures. It does not mention cost/latency of scanning all storages, which is the one behavioral trait an agent might still want.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded: the first sentence states exactly what is found, before any caveats. The remaining sentences each contribute a distinct fact (data provenance, parameter tuning rule, task-history limitation) with no restatement of the title or name.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, return-shape details are correctly omitted, and the description covers provenance, the key limitation, and parameter intent. The only gap for a cluster-wide audit tool is any hint about scale/latency when many nodes and storages are scanned.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is a 3. The description adds genuine meaning beyond the schema's terse 'Backups older than this are stale' by telling the agent how to derive a value from its own backup schedule. The `node` parameter is left entirely to the schema, keeping it at 4 rather than 5.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The first sentence names the specific verb+resource (audit of backups) and enumerates the three distinct findings it reports: missing/stale backups, unscheduled guests, and failed jobs. The second sentence adds a differentiating scope claim ('reads backup volumes directly from every backup storage ... not what the schedule promises') that separates it from schedule-based or task-list-based siblings like recent_task_failures.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives concrete usage guidance for tuning max_age_hours ('~170 for weekly backups') and discloses a boundary condition: failed tasks come from the recent task list, so only recent history is covered. What's missing is explicit routing to alternatives (e.g. when to prefer recent_task_failures or storage_health), but the context for when this tool is the right call is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ceph_healthCeph health analysisA
Read-onlyIdempotent

Analyse Ceph: health checks, OSD up/in counts, PG states, monitor quorum, capacity.

Use for "why is Ceph degraded/warning?". Each Ceph health check becomes a finding with operator guidance.

NameRequiredDescriptionDefault

No parameters

Output Schema

NameRequiredDescription
pgsYes
fsidYes
monsYes
osdsYes
statusYes
capacityYes
findingsYes
ceph_healthYes

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, non-destructive, closed-world, so the safety profile is covered. The description adds genuinely new behavioral context: each health check is emitted as a finding with operator guidance, telling the agent the output is diagnostic and actionable rather than a raw status dump. It says nothing about cost, timeouts, or auth, keeping it short of a 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, front-loaded with the resource inventory and immediately followed by the use case. Every clause carries information; there is no filler or repetition of the title.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no parameters, full annotation coverage, and an output schema that handles return values, the description only needs to convey scope and intent — both are present. The one missing piece is sibling differentiation against storage_health and cluster_health, which would complete the picture for an agent choosing among health tools.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, which is the baseline-4 case; there is no parameter surface that needs explaining. Nothing in the description contradicts or complicates the empty schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (analyse) and resource (Ceph) and enumerates exactly what is inspected: health checks, OSD up/in counts, PG states, monitor quorum, capacity. That is well beyond a restated name. It does not, however, distinguish itself from overlapping siblings such as storage_health and cluster_health, which an agent must disambiguate on its own.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives an explicit trigger condition — use when asking "why is Ceph degraded/warning?" — which maps a real user intent to this tool. No exclusions or named alternatives are provided, so the agent gets clear positive guidance but no routing rule against storage_health/cluster_health.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

cluster_healthCluster health checkA
Read-onlyIdempotent

Check quorum, node availability, CPU/memory pressure, storage fill levels and HA.

Start here for any "is something wrong with the cluster?" question. Findings are sorted worst-first and each carries a concrete recommendation.

NameRequiredDescriptionDefault

No parameters

Output Schema

NameRequiredDescription
nodesYes
statusYes
quorateYes
findingsYes
nodes_totalYes
cluster_nameYes
guests_totalYes
nodes_onlineYes
guests_runningYes

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already establish readOnly, idempotent, non-destructive and closed-world, so the safety profile needs no restating. The description adds behavior beyond that: findings are sorted worst-first and each carries a concrete recommendation, which tells the agent what the response looks like and how to act on it. No cost or latency/scope limitations are mentioned.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, front-loaded with the check list and immediately followed by the routing cue. No filler and nothing buried.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Zero parameters, rich annotations, and an output schema all carry the structural burden, so the description only needed to state scope and result shape. It does both, including ordering and the presence of recommendations, which is sufficient for an agent to invoke it confidently.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so there is nothing for the description to disambiguate; baseline 4 applies. The description correctly makes no parameter claims.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Specific verb (check) plus an enumerated resource set: quorum, node availability, CPU/memory pressure, storage fill, HA. An agent knows exactly what the tool inspects. It stops short of distinguishing itself from siblings like ceph_health and storage_health, which overlap on 'storage fill levels', so the boundary is left implicit.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

'Start here for any "is something wrong with the cluster?" question' gives clear entry-point guidance and situational context. It does not name when to prefer ceph_health or storage_health instead, so the alternative-routing half of the guideline is missing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

compare_nodesCompare nodesA
Read-onlyIdempotent

Compare live CPU, I/O wait, load, memory, swap and versions across nodes.

Use for "why is node X slower than node Y?". Flags I/O-bound nodes, swapping, overload, version drift and memory imbalance.

NameRequiredDescriptionDefault
nodesNoNodes to compare. Defaults to all online nodes.

Output Schema

NameRequiredDescription
nodesYes
statusYes
findingsYes

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations already establish that this is a safe, read-only, idempotent operation. The description adds useful behavioral context by naming the live metrics compared and the diagnostic conditions it flags, such as I/O-bound nodes, swapping, overload, version drift and memory imbalance.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two compact sentences. The core comparison is front-loaded, followed by the diagnostic purpose and the specific conditions it flags, with no wasted text.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simple one-parameter interface, full schema coverage, complete annotations, and an output schema, the description supplies everything needed for an agent to understand the tool's purpose and usage. Return-value details and the default node behavior are covered by structured fields.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and the single `nodes` parameter is already documented as defaulting to all online nodes. The description does not add syntax, formatting, or selection guidance beyond the schema, so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: comparing live CPU, I/O wait, load, memory, swap and versions across nodes. It also explains the diagnostic framing, making it clearly distinct from sibling tools like list_nodes or cluster_health.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives a clear use case: answering "why is node X slower than node Y?" and lists the conditions it flags. It does not explicitly name when not to use it or which sibling tool to choose instead, so it stops short of full routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_guestShow guest detailsA
Read-onlyIdempotent

Show one guest's live status and full configuration (secrets redacted).

NameRequiredDescriptionDefault
vmidYesVM or container id.

Output Schema

NameRequiredDescription
guestYes
configYesGuest configuration; secrets are redacted.

TDQS

A3.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, non-destructive and closed-world, so the safety profile is covered. The description adds genuinely new context: the data is 'live' (real-time, not cached) and secrets are redacted in the output, which an agent needs to know before relaying results.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One sentence, front-loaded with the scope ('one guest') and ending with the most decision-relevant caveat (secrets redacted). Nothing is padded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need no explanation, and annotations carry the safety profile. The description covers scope and redaction, leaving only minor gaps such as behavior for a nonexistent or stopped guest.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There is a single required parameter, vmid, with 100% schema description coverage, so the schema already explains it as a VM or container id. The description adds no further syntax or format detail, which is the baseline expectation when the schema does the work.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: show one guest's live status plus its full configuration. The singular 'one guest' implicitly separates it from list_guests, but the sibling is never named, so the differentiation is left to inference.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is only implied: 'one guest' signals a single-item lookup rather than the enumeration that list_guests performs. There is no explicit statement of when to reach for this versus the sibling, and no prerequisites or exclusions are given.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_task_statusGet task status and logB
Read-onlyIdempotent

Return the state of a Proxmox task and the tail of its log.

NameRequiredDescriptionDefault
nodeYesNode the task ran on.
upidYesTask id (UPID) as returned by write tools.
log_linesNoLog lines to return from the end of the task log.

Output Schema

NameRequiredDescription
nodeYes
typeYes
upidYes
statusYes
log_tailYes
succeededYes
exit_statusYes

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, openWorldHint=false, and destructiveHint=false, covering the safety profile. The description adds that the tool returns both task state and a log tail, but does not mention log truncation behavior, permissions, or response limitations beyond what the schema and output schema provide.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence with no filler. It efficiently communicates the core return content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With rich annotations, full schema descriptions, and an output schema, the description is mostly complete for a simple read-only diagnostic tool. It could still mention task completion or failure semantics, but the structured metadata carries most of the needed context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents node, upid, and log_lines in detail. The description adds no additional parameter semantics, which is acceptable given full schema coverage but does not exceed the baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb and resource: it returns the state of a Proxmox task plus the tail of its log. It is clear what the tool does, but it does not explicitly distinguish itself from sibling tools such as recent_task_failures.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives no explicit guidance on when to use this tool versus alternatives. It implies usage from the name and description, but does not state prerequisites, exclusions, or sibling comparisons.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_guestsList VMs and containersB
Read-onlyIdempotent

List VMs and containers across the cluster with resource usage, tags and HA state.

NameRequiredDescriptionDefault
tagNoOnly guests carrying this tag.
nodeNoOnly guests on this node.
statusNoFilter by state.
guest_typeNo'qemu' (VM) or 'lxc' (container).
include_templatesNoAlso list VM and container templates.

Output Schema

NameRequiredDescription
totalYes
guestsYes

TDQS

B3.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint and non-destructive behavior, so the safety profile is covered. The description adds that results carry resource usage, tags and HA state, but says nothing about pagination, result size on large clusters, or cost of a cluster-wide scan.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with no filler. The purpose and returned content are stated in the first clause.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With rich annotations and an output schema, the description needn't explain returns or safety, and it does mention returned fields. However, for a 5-filter list tool it omits the existence of filtering entirely, which is the main thing an agent needs in order to call it well.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so every filter is documented in the schema itself. The description adds no parameter semantics beyond the schema, which sets the baseline at 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('List VMs and containers') and scopes it to 'across the cluster', which separates it from get_guest (single guest) and list_nodes (nodes). It does not explicitly name any sibling, so it falls just short of 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives no when-to-use guidance or alternatives. Critically, it never mentions that the tool supports filtering by tag, node, status, guest_type, or templates, so an agent has to open the schema to learn the tool's main usage pattern.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_nodesList cluster nodesA
Read-onlyIdempotent

List all cluster nodes with status, CPU and memory utilisation.

NameRequiredDescriptionDefault

No parameters

Output Schema

NameRequiredDescription
nodesYes

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, destructiveHint=false and openWorldHint=false, so the safety profile is covered elsewhere. The description adds useful context by disclosing what data the response carries (status, CPU, memory utilisation), though it says nothing about pagination or scale limits on large clusters.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with no filler. The resource and returned fields are packed into one clause, so an agent can read it in one pass.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be explained, and rich annotations cover the safety semantics. For a zero-parameter read tool, the description supplies everything an agent needs to select and invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes no parameters, so there is nothing for the description to disambiguate; the baseline for zero-param tools applies. The description correctly implies an unfiltered full-list call rather than suggesting any filtering options.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('List all cluster nodes') plus the fields returned (status, CPU, memory utilisation), which tells an agent exactly what it gets. It does not differentiate against siblings such as compare_nodes or node_maintenance_status, so the boundary between this and related node tools is left implicit.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied by the scope phrase 'all cluster nodes' — an agent can infer this is the broad inventory call. However, there is no explicit when-to-use/when-not guidance and no mention of the sibling compare_nodes or node_maintenance_status as alternatives for narrower questions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

node_maintenance_statusUpdates, reboots and certificatesA
Read-onlyIdempotent

Show pending Proxmox updates, needed reboots and expiring node certificates.

A reboot is needed when a newer kernel is installed than the one running.

Covers the Proxmox package set (kernel, QEMU, ZFS, pve-*). Reflects apt's last package list refresh, which Proxmox runs daily.

NameRequiredDescriptionDefault
nodeNoOnly this node. Default: all.

Output Schema

NameRequiredDescription
nodesYes
statusYes
findingsYes
certificatesYes

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare this a safe, idempotent read, so the description correctly avoids repeating that. It adds real context beyond the annotations: the reboot criterion (installed kernel newer than running one) and, importantly, the data-freshness caveat that results reflect apt's last daily refresh — critical for interpreting staleness. It does not, however, state what the certificate expiry window or package set boundaries actually enumerate in output.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short paragraphs, front-loaded with the primary purpose, then the reboot heuristic, then scope/freshness caveats. Every sentence carries distinct information with no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return structure needn't be explained. The description covers what is checked, the reboot logic, package coverage, and the staleness limitation — everything needed to interpret results correctly for a one-parameter read-only tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and the single optional 'node' parameter is already documented as 'Only this node. Default: all.' The description adds nothing about the parameter, so baseline 3 applies — the schema does all the work.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and three concrete resources (pending updates, needed reboots, expiring certificates) scoped to Proxmox nodes. None of the siblings (list_nodes, storage_health, ceph_health, backup_audit) overlap with this maintenance-oriented check, so an agent can route correctly without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The usage situation is implied — check this for update/reboot/certificate posture — and the node parameter default of 'all' is noted. However, there is no explicit when-to-use or when-not-use guidance and no pointer to a sibling for related concerns, so the agent must infer scope.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

plan_node_evacuationPlan node evacuationA
Read-onlyIdempotent

Plan how to empty a node for maintenance without breaking HA or overloading others.

Detects passthrough devices, bind mounts, local disks, locks and HA-managed guests, assigns every guest a target and migration mode, and returns the exact command sequence (including Ceph 'noout' and HA maintenance mode). Executes nothing.

NameRequiredDescriptionDefault
nodeYesNode to drain for maintenance.
memory_limitNoMax memory use allowed on targets.
exclude_targetsNoNodes that must not receive guests.

Output Schema

NameRequiredDescription
nodeYes
stepsYes
guestsYes
summaryYes
targetsYes
feasibleYes

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly/idempotent/non-destructive, but 'Executes nothing' independently confirms the returned command sequence is advisory and will not be applied, which is the single most important fact for an agent about to act on the output. The enumeration of hazards it detects and the mention of Ceph 'noout' and HA maintenance mode add genuine behavioral context; it does not, however, say how it reports infeasible evacuations or whether the plan is safe to run verbatim.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The purpose and the safety-critical 'Executes nothing' both land early, and the middle sentence carries the detection/assignment detail in one dense clause rather than prose. No filler sentences; every line contributes routing or behavioral information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a three-parameter planning tool with full schema coverage, complete annotations, and an output schema (so return shape needn't be described), the description covers detection, assignment, and non-execution. The remaining gap is edge behavior — what the plan looks like when no valid target exists — which is non-trivial for a tool whose whole job is feasibility planning.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so node, memory_limit, and exclude_targets are already documented in the schema, establishing the baseline of 3. The description lends implicit meaning — 'overloading others' gestures at the memory_limit threshold — but adds no syntax, units, or interaction detail (e.g., how exclude_targets interacts with HA failover targets) beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Specific verb and resource: 'Plan how to empty a node for maintenance,' with the two failure modes it guards against (breaking HA, overloading others). It then enumerates exactly what the tool inspects (passthrough devices, bind mounts, local disks, locks, HA guests) and what it emits (target + migration mode + exact command sequence), which clearly separates it from siblings like recommend_placement or node_maintenance_status.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The maintenance-drain context makes the intended moment of use unambiguous, and 'without breaking HA or overloading others' states the constraint the caller can tune. It stops short of naming alternatives or exclusions — e.g., when to prefer recommend_placement for pure placement questions or node_maintenance_status for reading current state — so the agent must infer routing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

recent_task_failuresRecent failed tasksA
Read-onlyIdempotent

List tasks that failed recently, grouped by type. Good first stop after an incident.

Based on the cluster-wide recent task list, which Proxmox keeps short; very old failures may no longer be included regardless of the window.

NameRequiredDescriptionDefault
hoursNoTime window to look back, in hours.
limitNoMaximum number of failed tasks to return.
task_typeNoe.g. 'vzdump', 'qmigrate', 'qmstart'.

Output Schema

NameRequiredDescription
tasksYes
totalYes
by_typeYes
window_hoursYes

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already establish read-only/idempotent safety, so the description's real contribution is the non-obvious data-completeness caveat: results derive from a cluster-wide list Proxmox keeps short, so very old failures may be missing regardless of the requested window. That materially changes how an agent should interpret empty or thin results and cannot be inferred from the structured fields.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences with the core purpose front-loaded and the caveat following. Every clause earns its place; nothing is redundant with the schema or annotations.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need no explanation, and the three parameters are fully documented in the schema. Purpose, incident-triage positioning, and the retention caveat are all covered, leaving nothing an agent needs to call this correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3 — the hours/limit/task_type meanings are already documented. The description adds value by warning that the `hours` window may not be honored for very old failures, which reframes how that parameter should be trusted, pushing it above baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ("List tasks that failed recently") plus a distinct output shape ("grouped by type"). An agent can immediately separate this from get_task_status (single task) and cluster_health (overall health) without opening any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

"Good first stop after an incident" gives clear situational guidance for when to reach for this tool. It stops short of naming alternatives or exclusion cases (e.g. when to prefer get_task_status for a specific task), so it lands at 4 rather than 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

recommend_placementRecommend guest placementA
Read-onlyIdempotent

Rank nodes for a new VM/container by memory headroom, CPU load and vCPU over-commit.

Every node gets a score and the reasons it was accepted or rejected.

NameRequiredDescriptionDefault
coresYesvCPUs the guest needs.
storageNoRequire this storage id.
disk_gibNoDisk size in GiB (0 = skip).
memory_gibYesMemory in GiB.
exclude_nodesNoNever pick these.

Output Schema

NameRequiredDescription
requestYes
candidatesYes
recommended_nodeYes
recommended_storageYes

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint and destructiveHint=false, so the safety profile is covered. The description does add that every node is scored and that rejections come back with reasons, which is useful behavioral context, but it omits how exclude_nodes and required-storage filters affect the result set.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, front-loaded with the ranking criteria and followed by what the output contains. Nothing is padded, though the second sentence is somewhat thin given how much it has to carry.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With rich annotations, full schema coverage and an output schema, the description supplies enough for an agent to call it correctly. The remaining gap is the advisory-only nature of the operation, which matters but is partly signaled by the name 'recommend'.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and every parameter carries its own description, so the schema does the heavy lifting. The description's mention of memory headroom, CPU load and over-commit loosely maps to cores/memory_gib but adds no syntax or constraint detail beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The first sentence names a specific verb (rank), the resource (nodes), and the exact decision it serves: placing a new VM/container by memory headroom, CPU load and vCPU over-commit. That scoping distinguishes it in practice from compare_nodes and plan_node_evacuation, though it never names a sibling explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is only implied by 'for a new VM/container' — the description never says when to prefer this over list_nodes/compare_nodes, nor does it state that the result is advisory and that the tool does not actually create the guest. An agent must infer that boundary.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

storage_healthStorage hardware healthA
Read-onlyIdempotent

Check ZFS pools and physical disks for anything that threatens data.

Covers pool state, device errors, data errors, fill level, scrub age, SMART health, SSD wear and bad sectors.

Use when asking whether the storage underneath the guests is healthy, or before maintenance on a node.

NameRequiredDescriptionDefault
nodeNoOnly this node. Default: all.

Output Schema

NameRequiredDescription
disksYes
poolsYes
statusYes
findingsYes

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly/idempotent/non-destructive/closed-world, so the safety profile is covered. The description adds genuine substance by listing exactly what is checked (pool state, data errors, scrub age, SMART, SSD wear, bad sectors), which tells the agent what a clean result actually certifies.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The purpose sentence is front-loaded and the checklist and usage clause follow in a logical order. The coverage list is long but each item is a distinct diagnostic signal rather than filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema, full annotation coverage and a single well-documented parameter, the description carries what it needs to. The only gap is not relating itself to ceph_health for non-ZFS storage, which matters in a cluster with both.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with a single optional 'node' parameter already documented as 'Only this node. Default: all.' The description adds no scoping detail beyond the schema, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Names a specific verb and resource ('Check ZFS pools and physical disks') and enumerates the concrete signals it inspects. Naming ZFS implicitly separates it from the ceph_health sibling, though the description never says so outright.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives clear triggering contexts: 'whether the storage underneath the guests is healthy' and 'before maintenance on a node.' It stops short of explicit exclusions or pointing at ceph_health for non-ZFS storage, so the agent must infer the split.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 13 tool updatesv0.1.0
    • First observedbackup_audit
    • First observedceph_health
    • First observedcluster_health
    • First observedcompare_nodes
    • First observedget_guest
    • First observedget_task_status
    • First observedlist_guests
    • First observedlist_nodes
    • First observednode_maintenance_status
    • First observedplan_node_evacuation
    • First observedrecent_task_failures
    • First observedrecommend_placement
    • First observedstorage_health

TDQS

A3.8/5.0

Scored across 13 tools

Disambiguation4/5

Most tools target clearly distinct resources or diagnostic concerns: cluster, Ceph, storage, node comparison, guests, tasks, backups, placement, and evacuation. There is some overlap between cluster_health, ceph_health, and storage_health around storage fill and health checks, but descriptions mostly clarify that cluster_health is a broad first-stop while the others are focused deep dives.

Naming Consistency3/5

All names use snake_case and are readable, but the naming convention is mixed: action-oriented names like list_nodes, compare_nodes, get_guest, recommend_placement, and plan_node_evacuation coexist with noun-based names like ceph_health, storage_health, cluster_health, backup_audit, and recent_task_failures. The inconsistency is understandable but prevents a fully predictable pattern.

Tool Count5/5

Thirteen tools is well within a reasonable range for a broad Proxmox operations/diagnostics server. Each tool covers a distinct operational concern such as cluster health, storage health, backup auditing, placement, or evacuation planning, and none appears redundant.

Completeness4/5

The surface covers the main diagnostic and planning areas for Proxmox operations: cluster/node/Ceph/storage health, guest listing and inspection, task status and failures, backup auditing, maintenance status, placement recommendation, and evacuation planning. Minor gaps include network health, deeper HA state inspection, and any execution-oriented guest lifecycle operations, though the latter may be intentionally out of scope for this diagnostic/planning server.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    A
    maintenance
    Enables management of Proxmox VE virtual environments (VMs, containers, storage, snapshots, etc.) through natural language via MCP, with async task polling for reliable write operations.
    16
    74 npm
    1
    MIT
  • A
    license
    A
    quality
    D
    maintenance
    Enables LLM agents to monitor and manage a Proxmox VE cluster, including cluster status, VM/container lifecycle, and node actions via MCP tools.
    8
    MIT
  • F
    license
    Not graded
    quality
    C
    maintenance
    Provides read-only Proxmox cluster oversight and configuration compliance checks through MCP, covering health, inventory, storage, backups, snapshots, and updates.
    -
  • A
    license
    A
    quality
    B
    maintenance
    Enables MCP-compatible clients like Claude Desktop, Claude Code, Codex, and local-model hosts to inspect Proxmox VE clusters, nodes, VMs, containers, storage, snapshots, and tasks, with opt-in write operations for starting, stopping, cloning, backing up, and migrating guests. Read-only by default, it supports both stdio and Streamable HTTP transports.
    14
    MIT