MCP server for Proxmox VE management (VM, LXC, nodes)
MCP server for Proxmox VE management (VM, LXC, nodes)
Valid MCP server (2 strong, 3 medium validity signals). No known CVEs in dependencies. Package registry verified. Imported from the Official MCP Registry.
8 files analyzed · 1 issue found
Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.
This plugin requests these system permissions. Most are normal for its category.
Set these up before or after installing:
Environment variable: NANDI_PROXMOX_CONFIG
Add this to your MCP configuration file:
{
"mcpServers": {
"io-github-nandi-services-nandi-proxmox-mcp": {
"env": {
"NANDI_PROXMOX_CONFIG": "your-nandi-proxmox-config-here"
},
"args": [
"-y",
"nandi-proxmox-mcp"
],
"command": "npx"
}
}
}From the project's GitHub README.
Turn your Proxmox cluster into an AI-driven platform with 140+ tools for automation, monitoring, and controlled execution.
Open source MCP server for Proxmox VE, powered by NANDI Services.
nandi-proxmox-mcp exposes Proxmox inventory, lifecycle, storage, backup, networking, firewall, access, monitoring, SSH diagnostics, and guarded remote/container operations without removing the safety rails needed for production clusters.
read-only, read-execute, full.PVE_MODULE_MODE=core|advanced.PVE_CATEGORIES, PVE_TOOL_BLACKLIST, PVE_TOOL_WHITELIST.confirm=true.listNodes, getVMStatus, startVM, stopContainer.stdio transport for MCP clients and Streamable HTTP transport for controlled remote deployments.The server needs two trust channels and both are preserved intentionally:
pct exec, batch SSH diagnostics, and container-level Docker inspection tools.pct and SSH-based diagnostics.More detail: docs/PERMISSIONS.md
Operations marked destructive do not execute unless the caller sends confirm=true.
Examples:
pve_exec_in_containerThe server returns a structured CONFIRMATION_REQUIRED error when confirmation is missing. This behavior is unchanged and reinforced.
read-only
read-execute
full
PVE_MODULE_MODE=core hides advanced tools without renaming or removing canonical tool IDs from the codebase.
Required:
PROXMOX_HOSTPROXMOX_USERPROXMOX_REALMPROXMOX_TOKEN_NAMEPROXMOX_TOKEN_SECRETPROXMOX_SSH_HOSTPROXMOX_SSH_USERPROXMOX_SSH_KEY_PATHOptional:
PROXMOX_PORT default 8006PROXMOX_SSH_PORT default 22PROXMOX_ALLOW_INSECURE_TLS default falsePVE_ACCESS_TIER=read-only|read-execute|fullPVE_MODULE_MODE=core|advancedPVE_CATEGORIESPVE_TOOL_BLACKLISTPVE_TOOL_WHITELISTHTTP transport:
MCP_TRANSPORT=stdio|httpMCP_HOST default 0.0.0.0MCP_PORT default 3000MCP_ALLOWED_HOSTSMCP_ALLOWED_ORIGINSMCP_RATE_LIMIT_WINDOW_MSMCP_RATE_LIMIT_MAXMCP_MAX_BODY_SIZE_BYTESMCP_HEADERS_TIMEOUT_MSMCP_REQUEST_TIMEOUT_MSMCP_KEEPALIVE_TIMEOUT_MSMCP_MAX_HEADERS_COUNTSetup writes .nandi-proxmox-mcp/config.json and .vscode/mcp.json.
The config loader now rejects:
Guided setup:
npx nandi-proxmox-mcp setup
npx nandi-proxmox-mcp doctor --check mcp-config,nodes,vms,cts,node-status,remote-op
Direct run with environment variables:
$env:PROXMOX_HOST="pve.local"
$env:PROXMOX_PORT="8006"
$env:PROXMOX_USER="svc_mcp"
$env:PROXMOX_REALM="pve"
$env:PROXMOX_TOKEN_NAME="nandi-mcp"
$env:PROXMOX_TOKEN_SECRET="<SECRET>"
$env:PROXMOX_SSH_HOST="pve.local"
$env:PROXMOX_SSH_USER="root"
$env:PROXMOX_SSH_KEY_PATH="$env:USERPROFILE\.ssh\id_ed25519"
npx nandi-proxmox-mcp run
This MCP server operates real Proxmox infrastructure and is not a sandboxed environment.
The following risks are inherent to the system design:
Privileged Operations
Full access tier and container execution capabilities can perform destructive or system-level actions.
SSH Execution Boundary
Remote command execution relies on SSH and inherits the security posture of the target system.
Optional Insecure TLS Mode
When enabled (PROXMOX_ALLOW_INSECURE_TLS=true), TLS certificate validation is bypassed and may expose connections to MITM attacks. Intended for lab use only.
External Dependency Synchronization
Package distribution and listing visibility depend on npm, MCP Registry, and marketplace propagation timing.
Users are responsible for:
When MCP_TRANSPORT=http is enabled, the server now applies:
Origin header413 responses/mcpX-Content-Type-Options: nosniffCache-Control: no-storeHealth/readiness endpoints:
GET /healthGET /readyPOST /mcpFunctionality is unchanged, but the execution path is stricter:
spawn(..., { shell: false })BatchMode, IdentitiesOnly, public-key auth, and explicit connection liveness controlsdockerLogsInContainer now validates and shell-escapes container names instead of interpolating raw user inputpve_exec_in_container flow with confirmation requiredMitigations in the repo:
overrides for critical transitive packagesnpm pack --dry-run, and auditThreat model and residual risks: docs/THREAT_MODEL.md
Release order is strict:
npm run lintnpm run typechecknpm run buildnpm testnpm audit --include=dev --audit-level=moderatenpm ls expressnpm ls path-to-regexpnpm pack --dry-runnpm packnpm whoaminpm publish --access publicnpm view nandi-proxmox-mcp versionmcp-publisher validate .mcp/server.jsonmcp-publisher publish .mcp/server.jsonThe tag-based release.yml now publishes npm first and only then publishes the MCP Registry descriptor, preventing npm/registry drift on the same version.
Manual fallback and troubleshooting: docs/RELEASE.md
npm ci
npm run lint
npm run typecheck
npm run build
npm test
npm run validate:release
npm pack --dry-run
This repository enforces a pre-commit documentation sync gate.
change, fix, or refactor, evaluate whether README.md, AGENTS.md, and CONTRIBUTING.md must be updated.no-doc-change justification is required.https://www.npmjs.com/package/nandi-proxmox-mcphttps://registry.modelcontextprotocol.io/https://mcp-marketplace.io/server/io-github-nandi-services-nandi-proxmox-mcpMIT. See LICENSE.
A well-designed MCP server for Proxmox automation with a strong focus on operational clarity and safety. The implementation is clean, predictable, and suitable for real infrastructure workflows. It exposes meaningful capabilities without unnecessary complexity, which is essential in environments where mistakes are costly. From a security perspective, the behavior is transparent and controllable, which is critical for infrastructure-level integrations. Overall, a solid and reliable tool that fills a real gap in the MCP ecosystem.
by Modelcontextprotocol · Developer Tools
Read, search, and manipulate Git repositories programmatically
by Toleno · Developer Tools
Toleno Network MCP Server — Manage your Toleno mining account with Claude AI using natural language.
by mcp-marketplace · Developer Tools
Create, build, and publish Python MCP servers to PyPI — conversationally.
by Microsoft · Content & Media
Convert files (PDF, Word, Excel, images, audio) to Markdown for LLM consumption
by mcp-marketplace · Developer Tools
Scaffold, build, and publish TypeScript MCP servers to npm — conversationally
by mcp-marketplace · Finance
Free stock data and market news for any MCP-compatible AI assistant.