Mutations stay behind a gate
Start, stop, snapshot, delete — every write is gated behind an explicit confirmation and a dry-run that shows what would change, so an agent can never mutate a host on a hunch.
Safety-gated MCP server · Proxmox VE
Proxmox, behind a safety gate.
Proxmox MCP lets an AI agent operate a Proxmox VE host — list nodes, read status, snapshot, start and stop — but every mutating call stays behind an explicit, auditable boundary instead of raw API access.
What it does / 01
Full control,
never raw access.
Proxmox MCP is a boundary, not a passthrough. Reads flow freely; every mutation is named, previewable, confirmed, and logged.
A typed MCP contract
Built on TypeMCP's decorator-first typed contracts, every tool has a declared shape and a declared boundary. No hand-rolled JSON, no raw API surface leaking through.
Read and write, cleanly separated
Reads — nodes, VMs, containers, status — stay open and fast. Writes are a separate, named class of operation, and every one of them lands in an auditable log.
Works with any MCP client
Point any MCP-compatible client at it — an autonomous agent, an assistant, your own tooling. The same gated contract governs all of them the same way.
Where the line is / 02
Reads open.
Writes gated.
The whole design is one boundary drawn on purpose: what an agent can see, and what it must ask before it does.
- Read operationsList nodes, VMs, and containers and read status — open, no confirmation needed.
- Gated mutationsStart, stop, and snapshot require an explicit confirmation before they run.
- Dry-run firstPreview the exact changes a write would make before committing to it.
- Audit logEvery mutating call is recorded — who asked, what ran, what changed.
Open source · MIT
Give an agent Proxmox, not the keys.
Get Proxmox MCP ↗
A Theorvane product · built on TypeMCP