SSH into a system and gather hardware/system information. If credentials were stored with credentials add, username and password are auto-injected from the keyring — omit them. If authentication fails with 'No credentials found', run homelab-mcp credentials add <hostname> <username> in the terminal or call list_keyring_credentials to see what is already stored. Recommended follow-up after onboarding: run the configure_host_fingerprint prompt to capture per-host capability signals for drift detection.

Execute a command on a remote system via SSH. If credentials were stored with credentials add, username and password are auto-injected from the keyring — omit them. If authentication fails with 'No credentials found', run homelab-mcp credentials add <hostname> <username> in the terminal or call list_keyring_credentials to see what is already stored.

Start an interactive web-based shell session on a remote system. Opens a browser-based terminal with full TTY support for running interactive commands and scripts. Perfect for Proxmox community scripts or any interactive command-line tools. Requires HTTP server mode (--http flag). In stdio mode, this tool returns an error with setup instructions.

Discover a device via SSH and store it in the network site map database. Recommended follow-up: run the configure_host_fingerprint prompt to capture per-host capability signals for drift detection.

Discover multiple devices via SSH and store them in the network site map database

Get all discovered devices from the network site map database

Analyze the network topology and provide insights about the discovered devices

Suggest optimal deployment locations based on current network topology and device capabilities

Get change history for a specific device

Remove sitemap rows for devices where discovery failed (status='error' or empty/null/'unknown' hostname). Pass dry_run=true to preview the removal candidates without deleting them. (Equivalent to purge_devices with the failed-discovery filter — preserves the 4-clause OR semantics; bare purge_devices(filter_type='status', value='error') matches ONLY status='error' rows, NOT zombie hostnames.) Use remove_device for inventory-only deletion of one row; use purge_devices for bulk filter-based inventory deletion; use decommission_device when host-side cleanup (stop services, remove from clusters) is required before deletion.

Bulk-delete sitemap rows by filter. Single mutually-exclusive filter per call selected by filter_type. Supported filter_types: 'hostname' (exact-match string, no glob/LIKE), 'last_seen_older_than_days' (integer N — rows where last_seen < now - N days, exclusive boundary; N=0 matches all rows older than this instant), 'status' (exact match string like 'error' or 'success'), 'ip_range' (CIDR string like '192.168.1.0/24' or '2001:db8::/32' — rows whose connection_ip is not a valid IP are silently skipped). Composite/ANDed filters are NOT supported (use two calls). Pass dry_run=true to preview the candidate set without deleting. Zero-match returns success with purged_count=0, never an error. Note: filter_type='status', value='error' covers ONLY status='error' rows; use purge_failed_discoveries for the broader failed-discovery filter (includes zombie hostnames). Use remove_device for inventory-only deletion of one row; use purge_devices for bulk filter-based inventory deletion; use decommission_device when host-side cleanup (stop services, remove from clusters) is required before deletion.

Preview the result of purge_devices without persisting. Returns the candidate set the bulk delete would touch. Read-only — no DB write. Phase 44 D-11.

Delete a single sitemap row by device_id. Pure SQL DELETE on the sitemap row plus cascade DELETE on discovery_history rows for that device_id. No SSH dial, no Ansible runs, no Terraform plans on the handler call path. The keyring credential entry bound via ssh_credential_id is preserved — only the sitemap row is dropped, so a subsequent discover_and_map can re-bind without re-adding the credential. Pass dry_run=true to preview the would-delete row payload without writing. Use remove_device for inventory-only deletion of one row; use purge_devices for bulk filter-based inventory deletion; use decommission_device when host-side cleanup (stop services, remove from clusters) is required before deletion.

Preview the result of remove_device without persisting. Returns the would-delete row payload. Read-only — no DB write, no keyring touch. Phase 44 D-11.

Merge fingerprint data (kernel, OS, package digest, capabilities) into a device's sitemap row. Top-level keys overwrite (last-write-wins). The capabilities sub-dict updates one level deep — each incoming top-level capability key REPLACES its stored entry entirely (NOT a recursive merge); stored capability keys not present in the call are preserved. Callers updating any field within a capability must pass the full capability dict. Run discover_and_map first to populate the device. See the configure_host_fingerprint prompt for the conversational workflow. Persists to DB and bumps updated_at; last_seen is preserved (Phase 38 REVIEW-FIX WR-03).

Preview the merge result of update_device_fingerprint without persisting. Returns the would-be merged fingerprint dict using the same merge rules: top-level overwrite + capabilities one-level overwrite (incoming capability keys replace stored entries entirely; not recursive). Read-only — no DB write, no last_seen or updated_at mutation. Phase 38 D-05c.

Deploy new infrastructure based on AI recommendations or user specifications

Update configuration of an existing device

Safely remove a device from the network infrastructure. Stops services, removes the device from clusters, optionally migrates services per migration_plan, then deletes the sitemap row. Use remove_device for inventory-only deletion of one row; use purge_devices for bulk filter-based inventory deletion; use decommission_device when host-side cleanup (stop services, remove from clusters) is required before deletion.

Scale services up or down based on resource analysis

Validate infrastructure changes before applying them

Create a backup of current infrastructure state

Rollback recent infrastructure changes

Preview what decommission_device would affect without executing. Returns a structured dry-run report. No infrastructure is modified.

Preview what rollback_infrastructure_changes would affect without executing. Returns a structured dry-run report. No infrastructure is modified.

Deploy a new VM/container on a specific device

Control VM state (start, stop, restart)

Get detailed status of a specific VM

List all VMs/containers on a device

Get logs from a specific VM/container

Remove a VM/container from a device

Preview what remove_vm would affect without executing. Returns a structured dry-run report. No infrastructure is modified.

List all available homelab services that can be installed

Get detailed information about a specific service

Check if a device meets the requirements for a service installation

Install a homelab service on a target device

Get the current status of an installed service

Generate a Terraform plan to preview changes without applying them

Destroy a Terraform-managed service and clean up all resources

Refresh Terraform state and detect configuration drift

Check the status of an Ansible-managed service deployment

Run an existing Ansible playbook for a service

Preview what destroy_terraform_service would affect without executing. Returns a structured dry-run report. No resources are destroyed.

Verify SSH connectivity to a registered server using keyring credentials. Does not write any credentials — credentials must already be stored via homelab-mcp credentials add <hostname> <username> in the CLI. Returns a status object with verified=true on successful handshake.

List all registered servers with their SSH credentials and connection status

List hosts that have credentials stored in the OS keyring registry. Call this before ssh_discover or ssh_execute_command to check whether a host has stored credentials. Returns hostname and username per entry.

Search Proxmox community installation scripts from the community-scripts/ProxmoxVE repository

Get detailed information about a specific Proxmox community script

List all Proxmox cluster resources (VMs, containers, nodes, storage).

Get detailed status of a Proxmox node (CPU, memory, uptime, etc.)

Get status of a specific VM or container

Manage a VM or container (start, stop, shutdown, reboot, reset, suspend, resume)

Create a new LXC container on Proxmox

Create a new VM (QEMU) on Proxmox

Clone a VM or container to create a new one

Delete a VM or container from Proxmox

Preview what delete_proxmox_vm would affect without executing. Returns a structured dry-run report. No VM is deleted.

Scan for infrastructure drift against the sitemap. Returns a four-bucket coverage report — probed_ok (sitemap host probed successfully), unreachable (sitemap host that did not respond), unknown (reserved for Phase 39 — infrastructure present on a Proxmox hypervisor but absent from sitemap), and changed (reserved for Phase 39 — fingerprint differs from stored). All four buckets are always present in the response (empty arrays for Phase-39-reserved buckets) so client code can iterate without defensive checks. Each scan also returns a counts sub-dict mirroring bucket sizes and, when zero hosts were scanned (empty sitemap or filter narrowed to zero), a top-level guidance field pointing to the sitemap CRUD tools (discover_and_map, get_network_sitemap, purge_failed_discoveries, decommission_device). Recovery from credential-resolution failure is handled via 'homelab-mcp credentials add --type proxmox'.