Proxmox MCP - Opening a Virtualization API to an Agent, With the Dangerous Parts Locked

It started as wanting to ask about the home server

Running a home server on Proxmox, there's always something to check. Which VMs are up, how much storage is left, whether last night's backup ran. The web UI answers all of it, but switching to it mid-task in a terminal is friction.

So I exposed the Proxmox VE API over MCP, and now the agent answers.

But a virtualization API deserves care

That's where the problem is. The Proxmox API can delete VMs, roll back snapshots and reboot nodes. Hand an agent the whole API and one misread sentence removes a VM.

So operations are separated.

• Read operations just work: listing, status checks, and the like.
• State-changing operations run only when explicitly allowed.

Prompting "are you sure you want to delete this?" isn't enough, because an agent asked a question answers yes. What's allowed is written into configuration by a person, in advance.

If you only want reads, creating a token with the PVEAuditor role on the Proxmox side is stronger still. However open the server is, a token can't do what it isn't permitted to do.

It is not an HTTP service

It's a local stdio server. An MCP host launches it as a process; it exposes no HTTP endpoint. A home-server management tool opening another port on the network is not a good trade.

It's built with TypeMCP. As tools accumulate, having something keep declarations and types in agreement was the easier path.

Installing

There is no npm package. The distribution is the GitHub Release archive and its SHA-256 checksum. Download, verify, extract.

curl -fLO https://github.com/Theorvane/proxmox-mcp/releases/download/v0.1.1/proxmox-mcp-0.1.1.tar.gz
curl -fLO https://github.com/Theorvane/proxmox-mcp/releases/download/v0.1.1/proxmox-mcp-0.1.1.tar.gz.sha256
shasum -a 256 -c proxmox-mcp-0.1.1.tar.gz.sha256
tar -xzf proxmox-mcp-0.1.1.tar.gz

Do this on the machine where the MCP host will run.

• GitHub
• proxmox.theorvane.tech