Skip to main content
Glama
Sign In
deenesjakoruzh
proxmox-safe-mcp

proxmox-safe-mcp

by bgauger
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Local

Proxmox Safe MCP

A focused Proxmox MCP server exposing bounded inventory/status reads and only two narrow mutation classes: allowlisted guest power actions and snapshot creation. Extracted from spectrenet-mcp commit 2e63f009d8f4642e17398685baef0251811d6637; this repository is self-contained.

Alpha: tests are synthetic. Proxmox API compatibility has not been certified against every release; test on non-production infrastructure.

Safety contract

  • Nodes are explicitly allowlisted for node-targeted operations (node_status) and both mutation tools; guest types are only qemu and lxc; VMIDs must be positive integers.

  • cluster_status and list_guests intentionally return cluster-wide API views and are not filtered by the node allowlist. Scope the dedicated Proxmox API account/token to limit what these read tools can see.

  • Power actions are only start, shutdown, reboot, and stop.

  • Snapshot names are 1–64 ASCII letters, digits, _, or -.

  • Every mutation needs byte-for-byte APPROVE <action> <target> confirmation.

  • Mutation responses are submission receipts, not completion proof. Verify the returned UPID and final state separately.

  • There are no guest/snapshot deletion, host-power, storage mutation, allocation, migration, or configuration tools. node_status deliberately excludes storage enumeration.

  • Responses/lists/audit fields are bounded and TLS verification defaults on.

Related MCP server: proxmox-mcp

Install and run

uv sync --extra test
uv run proxmox-safe-mcp --help
uv run proxmox-safe-mcp

The server uses MCP stdio. It does not load .env; use .env.example only as fake documentation and inject secrets through a supervisor or secret manager.

Verify

uv sync --locked --extra test
uv run --locked pytest
uv run --locked python -m compileall -q src tests
uv build

See architecture and operations and security details. MIT © 2026 Ben Gauger.

Available Tools

5 tools
cluster_statusD

Inputs: no named parameters. Returns: object

guest_powerD

Inputs: node (required), vmid (required), action (required), guest_type (required), +1 more. Returns: object

list_guestsD

Inputs: no named parameters. Returns: result

node_statusD

Inputs: node (required).

snapshot_guestD

Inputs: node (required), vmid (required), guest_type (required), snapshot_name (required), +1 more. Returns: object

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

    Deploy Server
    One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

    TDQS

    D1.9/5.0

    Scored across 5 tools

    Disambiguation5/5

    Each tool targets a distinct aspect of the Proxmox environment: cluster status, node status, guest listing, guest power control, and guest snapshotting. There is no overlap in purposes, making selection unambiguous.

    Naming Consistency3/5

    The names mix noun-initial patterns (cluster_status, node_status, guest_power) with verb-initial patterns (list_guests, snapshot_guest). This inconsistency is noticeable but still readable and predictable overall.

    Tool Count5/5

    With only 5 tools, the server is tightly scoped and each tool serves a clear purpose. This is well-balanced for a specialized MCP server focused on monitoring and safe guest operations.

    Completeness3/5

    The set covers status, listing, power, and snapshot operations but lacks lifecycle management (create, update, delete guests). While potentially intentional for a 'safe' server, it leaves notable gaps for full Proxmox administration.

    Resources

    Related MCP Connectors

    Related MCP Servers

    • Proximo

      john-broadway
      A
      license
      A
      quality
      A
      maintenance
      Enables management of Proxmox VE infrastructure via its REST API and execution of commands inside LXC containers via SSH, with built-in trust layers for planning, audit, undo, and diagnosis.
      6
      443 PyPI
      93
      AGPL 3.0

    • proxmox-mcp

      ssan9876
      F
      license
      A
      quality
      D
      maintenance
      Enables an AI assistant to fully navigate a single-node Proxmox VE host over SSH, with modes for read-only inspection, safe operations, and full control including provisioning and destruction.
      34
      -

    • rustproxmoxmcp

      mechubsec
      A
      license
      Not graded
      quality
      B
      maintenance
      Enables management of many Proxmox VE clusters from a single server, exposing read and inventory tools plus guarded destructive operations that follow a plan → approve → apply flow. Per-cluster tokens, fail-closed guest protection with time-boxed waivers, and audit logging keep every action scoped, attributable, and reversible.
      1
      MIT

    • proxmox-ops-mcp

      derdennis1012
      A
      license
      A
      quality
      B
      maintenance
      Enables MCP clients to diagnose Proxmox VE clusters — quorum and HA state, Ceph and ZFS health, backup coverage audits, task failures, pending updates and node evacuation planning — with answers returned as findings and recommended steps. VM power, snapshot and migration operations are available but disabled by default, requiring a preview and a bound confirmation token before anything executes.
      13
      14 PyPI
      MIT