Log inSubmit server
Proxmox MCP logo

Proxmox MCP

Manage and inspect Proxmox VE clusters through gated MCP tools using API-token authentication.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install Proxmox MCP

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "proxmox-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@solomonneas/proxmox-mcp"
      ],
      "env": {
        "PROXMOX_URL": "YOUR_VALUE_HERE",
        "PROXMOX_TOKEN_ID": "YOUR_VALUE_HERE",
        "PROXMOX_TOKEN_SECRET": "YOUR_VALUE_HERE",
        "PROXMOX_TLS_INSECURE": "YOUR_VALUE_HERE",
        "PROXMOX_ENABLE_DESTRUCTIVE": "YOUR_VALUE_HERE"
      }
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

Values are written into the snippet above so you can paste it as is. They never leave your browser.

Automated check passed— started and listed 96 tools correctly (3d ago).

Overview

proxmox-mcp connects AI clients to Proxmox VE clusters through the Proxmox API and exposes inventory, status, task, storage, guest, and provisioning tools. Read operations can inspect nodes, VMs, LXC containers, backups, snapshots, networks, permissions, and resource metrics. State-changing calls require confirmation, while destructive actions additionally require an explicit flag and process-level environment setting. Use it when an agent needs controlled access to a homelab or virtualization cluster without direct root-shell access.

Use cases

  • Inventory VMs and LXC containers across a Proxmox cluster
  • Inspect storage, backups, snapshots, and resource metrics
  • Trace asynchronous Proxmox tasks and retrieve their logs
  • Provision or clone guests with confirmation gates
  • Operate guest services and files without granting host shell access

Key features

  • Proxmox VE API-token authentication
  • Cluster, VM, container, storage, and guest inspection
  • Three-part destructive-operation safety gate
  • UPID task status, polling, and log tools
  • Gated guest commands and file operations
  • VM and LXC provisioning, cloning, snapshots, and backups

Tools96

What Proxmox MCP lets your agent do. Expand a tool for its parameters.

Verified live~16.1k tokens of context

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked 1d ago

Recent health check succeeded.

What it can do

From the 96 tools this server returned when we ran it; 96 declare their own safety hints.

Runs commands · 1Can delete or modify data · 18Writes files · 1Handles credentials · 8Makes network requests · 1Read-only tools · 76
Network at startup3 connections
Files written at startupNone
Install scriptsNone
npm provenanceSigned build
Package age160 days
Maintainers1

Observed 2026-10-25 in an isolated sandbox. A description of reach, not a security audit.

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 9d ago via OSV.dev · @solomonneas/proxmox-mcp (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars11Stargazers on the source repository.
npm downloads538Package downloads in the last 30 days.
Last commit6d agoMost recent push to the default branch.
Availability100%Our rolling endpoint + install checks that succeeded.
Install checkPassedOur sandbox started it and listed its tools.
Tools exposed96Callable tools this server registers over MCP.

How Proxmox MCP works

What proxmox-mcp does

proxmox-mcp gives MCP-compatible AI clients a structured interface to Proxmox VE. It can inspect cluster and node status, enumerate QEMU VMs and LXC containers, read guest configuration, review storage and backups, inspect firewall and access-control data, and trace asynchronous Proxmox tasks.

The broader tool surface also supports controlled operations such as starting, stopping, rebooting, snapshotting, backing up, cloning, and creating guests. Guest-oriented tools can read files, inspect paths and services, execute shell commands, and write text files inside LXC containers or QEMU VMs. The project is aimed at homelab and virtualization operations where an agent needs API access but should not receive a general-purpose shell on the host.

How it works

The server authenticates to Proxmox with an API URL, token ID, and token secret. It communicates with an MCP client over the standard server interface; the example configuration launches the npm package through npx.

Tools are organized around write-safety tiers. Read-only calls can run without confirmation. Guest reads and safe state changes require confirm: true. Destructive operations require that confirmation, a destructive: true request flag, and PROXMOX_ENABLE_DESTRUCTIVE=1 in the server process environment. The gate rejects an unsafe call before it sends an HTTP request to Proxmox.

Many Proxmox operations return UPIDs. Task tools can list recent tasks, retrieve one task's status or log tail, and poll until completion or timeout.

Setup and configuration

Configure the MCP client to start the package with npx -y @solomonneas/proxmox-mcp, then provide these environment variables:

  • PROXMOX_URL: Proxmox API endpoint, such as https://host:8006.
  • PROXMOX_TOKEN_ID: Proxmox API token identifier.
  • PROXMOX_TOKEN_SECRET: API token secret.
  • PROXMOX_TLS_INSECURE: TLS verification setting; the example uses false.
  • PROXMOX_ENABLE_DESTRUCTIVE: set to 1 only when destructive tools should be eligible.

The destructive environment gate is separate from per-call confirmation, so enabling it does not by itself authorize a destructive request.

Tools and capabilities

The read-oriented surface includes tools for:

  • Cluster, node, HA, quorum, service, disk, update, and resource status.
  • VM and container inventory, configuration, templates, snapshots, networks, and VMID allocation.
  • Storage definitions, content, usage, backups, scheduled backup jobs, and replication.
  • Firewall rules, firewall options, users, roles, ACLs, pools, tokens, and permissions.
  • Guest file and service inspection, task tracking, and resource metrics.

Gated operations cover guest commands and file writes, lifecycle changes, snapshots, backups, guest creation, and cloning. The project documents a 96-tool surface, while the available tools and permissions depend on the Proxmox token and target resources.

Limitations and notes

The project is marked WIP and remains pre-1.0. Proxmox permissions still govern what the API token can access; for example, pending-update inspection requires a token with Sys.Modify. Destructive actions remain unavailable unless both the request-level gates and the process environment gate are satisfied. TLS behavior must be configured deliberately, especially for clusters using certificates that the client does not trust.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about Proxmox MCP

proxmox-mcp is an MCP server that connects AI clients to Proxmox VE clusters through API-token authentication. Its main tools inspect VMs, LXC containers, nodes, storage, tasks, backups, snapshots, and permissions, while gated tools can operate guests, provision resources, clone workloads, and manage selected lifecycle actions.

Install it through an MCP client configuration that runs `npx -y @solomonneas/proxmox-mcp`. Set `PROXMOX_URL`, `PROXMOX_TOKEN_ID`, and `PROXMOX_TOKEN_SECRET`; configure `PROXMOX_TLS_INSECURE` as needed for certificate verification.

Destructive actions require three conditions: `confirm: true`, `destructive: true`, and `PROXMOX_ENABLE_DESTRUCTIVE=1` in the server process environment. The server rejects a request that misses a gate before making an HTTP request to Proxmox.

Yes. Claude Desktop is named as a supported MCP host, and the documented configuration starts proxmox-mcp with `npx` and the Proxmox connection environment variables.

The API token's Proxmox permissions determine which resources and operations are available. Some capabilities need additional privileges; pending-update inspection, for example, requires a token with `Sys.Modify`.

Related MCP servers

All in Cloud Platforms All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewProxmox MCP AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/proxmox-mcp?style=directory)](https://allmcps.com/mcp/proxmox-mcp)
HTML Embed
<a href="https://allmcps.com/mcp/proxmox-mcp"><img src="https://allmcps.com/api/badge/proxmox-mcp?style=directory" alt="Proxmox MCP on AllMCPs" /></a>