ProxmoxMCP-Plus — Watchlist

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

Follow Proxmox API and VM or container operation coverage due infrastructure impact

Reviewed Oct 5, 2026 · Documentation review; complete setup workflow not independently tested

Best fit

Policy-controlled management of Proxmox VE virtual infrastructure.

What we know

Proxmox control plane exposing stdio, Streamable HTTP and OpenAPI for VM/LXC/storage/snapshot/backup/ISO/job operations with explicit auth and policy controls.

Maintenance / activity evidence

Observed Oct 1, 2026 (UTC)release: prepare v0.5.24 OAuth configuration update ( 142)

Tracking evidence observed Oct 5, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: high.

Activity source · commits ↗Activity source · releases ↗

Verification gaps / watch-outs

Installation and comprehensive security have not been independently audited.
Proxmox RBAC plus tool/target/command policy. Writes: VM/LXC lifecycle; Snapshots/backups/restores; Config changes; Guest/container commands.
Proxmox token + inbound HTTP auth.
Sensitive access: Virtual infrastructure, SSH keys, Credentials

Privileged infrastructure gateway; use least privilege, read-only targets and command approval.

Security source · repository notice ↗Security source · policy file ↗

Full authority, access and evidence limits are available in Review context and Access & risk.

Popularity

555 repository stars

Stars observed Sep 25, 2026.

Do not overwrite existing reviewed stars/download metrics with nulls from this enrichment batch.

All limitations / Review context

Which Proxmox actions and approval boundaries remain documented?

The bounded assessment reviewed the official README, repository notices, security policy path, and security page for known material public-tracking blockers. No such blocker was identified. This is a public-tracking assessment, not an installation safety certification.

Privileged infrastructure gateway; use least privilege, read-only targets and command approval.
Proxmox RBAC plus tool/target/command policy.
Proxmox token + inbound HTTP auth.
Infrastructure state and job data; optional persistent job/OAuth stores.
Reviewed write actions: VM/LXC lifecycle; Snapshots/backups/restores; Config changes; Guest/container commands
Sensitive access: Virtual infrastructure, SSH keys, Credentials
Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
No independent runtime, installation, or comprehensive security audit was performed.
No installation, runtime, client matrix, or complete tool-contract audit was performed in this review.
Requires Proxmox token/RBAC.
SSH/guest command tools materially increase authority.
HTTP deployments need bearer/OAuth/TLS/Origin controls.

Original activity observations

2026-10-01T13:04:03Z: release: prepare v0.5.24 OAuth configuration update ( 142)

Technical identity

github.com/rekklesna/proxmoxmcp-plus

Exact implementation source: https://github.com/rekklesna/proxmoxmcp-plus ↗
Reviewed resource type: Gateway
Repository identity: rekklesna/proxmoxmcp-plus
Package identity: pypi:proxmox-mcp-plus
Service endpoint: http://localhost:8000/mcp

Evidence & Sources

Evidence basis: Recorded source evidence
Setup runtime verification: Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed Oct 5, 2026 · Latest source observation Oct 7, 2026

GitHub repository ↗
rekklesna/proxmoxmcp-plus
Recorded repository material and project history.
Includes references whose attribution is not established.

Setup · Watchlist

Self-hosted gateway service setup

Publisher instructions.

Source evidence observed Oct 14, 2026.

Additional setup details required — see the specific gaps below.

Install / connect
Publisher instructions
ProxmoxMCP-Plus offers Proxmox API operations as an MCP server.
publisher setup or prerequisite · Publisher instructions
uvx proxmox-mcp-plus
Configure / authenticate
MCP100 setup guide
For local clients register `uvx proxmox-mcp-plus` with PROXMOX_HOST, PROXMOX_USER, PROXMOX_TOKEN_NAME, PROXMOX_TOKEN_VALUE; native Streamable HTTP Docker alternative requires `docker compose --profile mcp-http up -d proxmox-mcp-http`.
Check connection
Suggested check
Look for `get_nodes` and `get_vms` in client's MCP tool list; check container liveness separately.
Remove / uninstall / revoke
MCP100 setup guide
For stdio, unregister the `proxmox-mcp-plus` entry in the selected MCP client, e.g. Claude Code `claude mcp remove proxmox-mcp-plus` if registered under that name. For hosted Docker HTTP, run `docker compose --profile mcp-http stop proxmox-mcp-http` in the deployment directory. Keep Proxmox VM data intact.
Client unregistration, program uninstall, persistent-data deletion, and credential revocation must be treated separately.
Stop deployment / service · MCP100 composed guide
docker compose --profile mcp-http stop proxmox-mcp-http

Official Documentation & Sources

What it does

Proxmox control plane exposing stdio, Streamable HTTP and OpenAPI for VM/LXC/storage/snapshot/backup/ISO/job operations with explicit auth and policy controls.

Capability: Cloud & DevOps
Resource type: Gateway
Best fit: Policy-controlled management of Proxmox VE virtual infrastructure.

Representative uses

Inspect cluster/VM/LXC/storage state
Create/start/stop/delete VMs/LXCs
Backup/restore/snapshot
Optionally run guest/container commands

Limitations

Requires Proxmox token/RBAC.
SSH/guest command tools materially increase authority.
HTTP deployments need bearer/OAuth/TLS/Origin controls.

Reviewed access

Access & risk

Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.

Authentication: Proxmox token + inbound HTTP auth.
Permissions: Proxmox RBAC plus tool/target/command policy.
Data handling: Infrastructure state and job data; optional persistent job/OAuth stores.
Cost: free
Risk and cautions: Privileged infrastructure gateway; use least privilege, read-only targets and command approval.

Access scope and cautions

Write actions: VM/LXC lifecycle Snapshots/backups/restores Config changes Guest/container commands
Sensitive access: Virtual infrastructure SSH keys Credentials
Risk level: high

FAQ

Based on reviewed evidence as of 2026-10-07. Watchlist tracking is not a recommendation or a security certification.

Which tasks are documented for this implementation?

The reviewed tasks include: Inspect cluster/VM/LXC/storage state; Create/start/stop/delete VMs/LXCs; Backup/restore/snapshot; Optionally run guest/container commands.

What setup and authentication are documented?

Recorded installation/entrypoint step: uvx proxmox-mcp-plus. Recorded endpoint: http://localhost:8000/mcp. Recorded transport: stdio, streamable_http, openapi. Recorded environment-variable notes: PROXMOX_HOST; PROXMOX_USER; PROXMOX_TOKEN_NAME; PROXMOX_TOKEN_VALUE; MCP_API_KEY optional. No configuration values are supplied here. Prerequisites: Proxmox VE; Python/uvx or Docker. These are the documented setup details, not a claim that installation or client compatibility was independently tested. Authentication: Proxmox token + optional inbound MCP API key/OAuth.

Can it modify data or perform write operations?

Documented write actions include: VM/LXC lifecycle; Snapshots/backups/restores; Config changes; Guest/container commands. Recorded permission boundary: Proxmox RBAC plus tool/target/command policy.

What data-handling boundary should I consider?

Infrastructure state and job data; optional persistent job/OAuth stores. Recorded sensitive-access context: Virtual infrastructure; SSH keys; Credentials.

What limitations and risks should I check before use?

Privileged infrastructure gateway; use least privilege, read-only targets and command approval. Requires Proxmox token/RBAC. SSH/guest command tools materially increase authority. HTTP deployments need bearer/OAuth/TLS/Origin controls. No independent runtime, installation, or comprehensive security audit was performed.

Is this an official MCP?

RekklesNA is listed as First-party MCP in MCP100’s current evidence.