ProxmoxMCP-Plus

ProxmoxMCP-Plus

Operate Proxmox VE from MCP clients, AI agents, and OpenAPI tooling through one security-conscious control plane for VMs, LXCs, snapshots, backups, ISOs, container commands, and persistent long-running jobs.

Quick Start | Client Install | Demo | Tools | Safety | Scenarios | Docs | Wiki

MCP and OpenAPI are alternative entry points into the same workflows and may run in separate processes. Solid arrows show requests and execution; dashed arrows show persisted job and audit state. Approval gates, SSH execution and MCP HTTP OAuth depend on configuration. Select the diagram to view it at full size.

Why ProxmoxMCP-Plus

ProxmoxMCP-Plus sits between AI clients and Proxmox VE so operators do not have to stitch together raw API calls, one-off shell scripts, and custom job polling for every workflow.

It exposes the same operational surface in two ways:

• MCP for Claude Desktop, Cursor, VS Code, Open WebUI, Codex, and other MCP-capable agents
• OpenAPI for HTTP automation, dashboards, internal tools, and no-code workflows

What you get:

• VM and LXC lifecycle actions
• snapshot create, rollback, and delete
• backup and restore workflows
• ISO download and cleanup
• node, storage, and cluster inspection
• SSH-backed container command execution with guardrails
• opt-in guarded Proxmox node SSH commands
• persistent job tracking for async Proxmox tasks

What Makes It Different

Quick Start

1. Prepare Proxmox Credentials

Create a Proxmox API token with only the permissions your workflows need. Then create the local config file:

cp proxmox-config/config.example.json proxmox-config/config.json

Then edit proxmox-config/config.json with your environment. At minimum, it needs:

• proxmox.host
• proxmox.port
• auth.user
• auth.token_name
• auth.token_value

Add an ssh section as well if you want container command execution. Add a jobs section if you want job state persisted somewhere other than the default local SQLite file.

For real live verification, use a separate proxmox-config/config.live.json created from proxmox-config/config.live.example.json. Do not point live e2e at a placeholder or local-only config.json unless you intentionally run a local API tunnel there.

Optional job persistence config:

{

"jobs": { "sqlite_path": "proxmox-jobs.sqlite3" } }

Optional tool exposure filtering can reduce the schemas sent to MCP clients. It is disabled by default, so existing configurations continue to expose every available tool. Configure exactly one mode under mcp:

{

"mcp": { "tool_allowlist": ["get_nodes", "get_vms", "get_containers", "get_storage"] } }

Alternatively, use tool_denylist, or the comma-separated environment variables MCP_TOOL_ALLOWLIST and MCP_TOOL_DENYLIST. Do not configure both modes. Environment selection replaces the file-level filtering mode. An empty allowlist exposes no tools; an empty denylist hides none. Exact lowercase tool names are required, and unknown names fail startup so a typo cannot silently widen access. Restart or reconnect the MCP server after changing the filter.

2. Choose One Runtime Path

Docker examples publish host ports on 127.0.0.1 by default; Compose modes are opt-in. Set only the selected mode's key: MCP_API_KEY for native HTTP or PROXMOX_API_KEY for OpenAPI. See Compose deployment and upgrade notes for reverse proxies, tunnels, explicit LAN bindings and container recreation.

MCP stdio with PyPI

uvx proxmox-mcp-plus

Or install it first:

pip install proxmox-mcp-plus

proxmox-mcp-plus

Use this path when the MCP client launches a local stdio server.

Code Mode (opt-in)

Code Mode is disabled by default to preserve the legacy full tool catalog. Enable it with mcp.code_mode: true in the config file or MCP_CODE_MODE=true. When enabled, MCP exposes three tools instead: proxmox_code_search, proxmox_code_get_schema, and proxmox_code_execute. Code execution runs in an isolated sandbox and reaches domain tools through the existing validation, policy, and approval path. Discovery uses the filtered runtime catalog, so it also works in installed wheels. For example:

await call_tool("get_nodes", {"target": "default"})

The final expression is returned as data.result; tool results use MCP JSON content blocks (and structured content where supplied). Use proxmox_code_get_schema for arguments, including target and approval tokens. Scripts have no filesystem or network access except registered tool calls. Limits: 64,000 source characters, 100 MB sandbox memory, 25 tool calls, 16 KB final JSON, and two concurrent executions. Execution has a 30-second budget; cancelling or failing a script does not roll back tool side effects. Do not automatically retry a failed mutation script.

Optional worker reuse: set mcp.code_mode_pool_reuse: true or MCP_CODE_MODE_POOL_REUSE=true. The default remains one fresh worker per execution. Reuse keeps up to two workers for the server lifetime, recycles each after 100 checkouts, and starts a new sandbox session per request. Globals, approvals, output collectors and call limits are not shared between requests. HTTP clients share the server-owned pool; disconnecting a client does not close it. Run python scripts/benchmark_code_mode.py to measure local startup overhead; this is a microbenchmark, not an estimate of Proxmox operation latency.

Native MCP HTTP with Docker

Use this path when a remote MCP client supports Streamable HTTP:

export MCP_API_KEY="$(openssl rand -hex 32)"

docker run --rm -p 127.0.0.1:8000:8000 \ -e PROXMOX_MCP_MODE=mcp-http \ -e MCP_HOST=0.0.0.0 \ -e MCP_PORT=8000 \ -e MCP_TRANSPORT=STREAMABLE_HTTP \ -e MCP_API_KEY="$MCP_API_KEY" \ -v "$(pwd)/proxmox-config/config.json:/app/proxmox-config/config.json:ro" \ ghcr.io/rekklesna/proxmoxmcp-plus:latest

Point MCP clients at:

http://127.0.0.1:8000/mcp

For remote clients, use the configured proxy/tunnel URL or explicitly widen the host binding as described in Docker deployment.

Send Authorization: Bearer with every native MCP HTTP request. The key is independent of Proxmox credentials. Native Streamable HTTP and SSE require a key by default. For an endpoint protected by an external access-control layer such as Tailscale ACLs, explicitly set MCP_ALLOW_UNAUTHENTICATED_HTTP=true or mcp.allow_unauthenticated_http: true in JSON configuration. This allows keyless startup and logs a warning; it does not configure or verify the external access controls. A configured MCP_API_KEY is always enforced, even with opt-out. This setting does not change OpenAPI authentication or DNS rebinding protection.

OAuth browser gate for MCP clients

Native MCP HTTP can optionally expose an OAuth authorization-code flow with PKCE while keeping MCP_API_KEY as the only human credential an operator has to manage. OAuth protocol handling is delegated to the MCP Python SDK (mcp>=1.30.0,<2), while ProxmoxMCP-Plus provides the API-key consent policy and persistent OAuth state.

OAuth state is stored in PostgreSQL. This allows multiple MCP server instances or hosts, when deployed explicitly, to share registered clients, authorization codes, access tokens, refresh tokens, refresh-token replay protection, and login-rate-limit state without relying on a local filesystem.

The client starts at the SDK /authorize endpoint. After the SDK validates the client, redirect URI, scope, PKCE request, and resource, the browser is redirected to /oauth/consent on the same MCP origin. The user reviews the client name, redirect origin, and requested scopes, then enters MCP_API_KEY. The API key is never placed in a URL and is never returned to the OAuth client.

Required OAuth settings:

export MCP_API_KEY="$(openssl rand -hex 32)"

Replace with the database user's password.

export MCP_OAUTH_DATABASE_URL='postgresql://proxmox_oauth: @postgres.example:5432/proxmox_oauth'

Example server:

docker run --rm -p 127.0.0.1:8000:8000 \

-e PROXMOX_MCP_MODE=mcp-http \ -e MCP_HOST=0.0.0.0 \ -e MCP_PORT=8000 \ -e MCP_TRANSPORT=STREAMABLE_HTTP \ -e MCP_API_KEY="$MCP_API_KEY" \ -e MCP_OAUTH_ENABLED=true \ -e MCP_OAUTH_ISSUER=https://mcp.example.com \ -e MCP_OAUTH_DATABASE_URL="$MCP_OAUTH_DATABASE_URL" \ -e MCP_ALLOWED_HOSTS=mcp.example.com:*,localhost:* \ -e MCP_ALLOWED_ORIGINS=https://mcp.example.com \ -v "$(pwd)/proxmox-config/config.json:/app/proxmox-config/config.json:ro" \ ghcr.io/rekklesna/proxmoxmcp-plus:latest

Then connect the OAuth-capable client to:

https://mcp.example.com/mcp

OAuth mode exposes these endpoints on the same public origin:

• /.well-known/oauth-protected-resource/mcp - RFC 9728 protected-resource metadata
• /.well-known/oauth-authorization-server - SDK authorization-server metadata
• /register - SDK dynamic client registration (DCR)
• /authorize - SDK authorization endpoint
• /token - SDK authorization-code/refresh-token exchange
• `