2026.10.18
ProxmoxMCP-Plus Adds an MCP and OpenAPI Control Plane for Proxmox VE
ProxmoxMCP-Plus connects MCP clients and OpenAPI automation to Proxmox VE for VM, LXC, snapshot, backup, ISO, and asynchronous job workflows. It fits homelab and platform operators exploring AI-assisted administration, but high-risk actions still require deliberate permissions, approvals, and human verification.
What the project does
ProxmoxMCP-Plus is an open-source control plane for Proxmox VE. It connects MCP clients, AI agents, and ordinary HTTP tooling to Proxmox VE, reducing the need to assemble raw API calls, ad-hoc scripts, and custom polling for each operational task. The project exposes two alternative entry points: MCP for MCP-capable clients, and OpenAPI for HTTP automation, dashboards, internal tools, and no-code workflows.
Who it suits
The project is aimed at homelab users, developers, and platform operators who already run Proxmox VE and want to introduce natural-language assistance or repeatable automation into virtualization operations. The README lists Claude Desktop, Cursor, VS Code, Open WebUI, and Codex among possible MCP clients. Operators who only want to expose a subset of capabilities can configure an allowlist or denylist; unknown tool names fail startup rather than silently widening access.
For teams that do not want an AI client to receive the full administrative surface, the project documents Proxmox API tokens, command policy, approval tokens, OpenAPI bearer authentication, and MCP HTTP Host/Origin controls. These are configuration mechanisms, not a guarantee that a deployment is secure by default. Their effectiveness depends on how the operator combines them with network and identity controls.
Known capabilities
Documented workflows include VM and LXC lifecycle operations, snapshot creation, rollback and deletion, backup and restore, ISO download and cleanup, node, storage and cluster inspection, and guarded container command execution. Asynchronous Proxmox tasks can be tracked with stable job IDs and Proxmox UPIDs, with polling, retry, cancellation, and audit history described by the project. Job state can use local SQLite, although persistence details must be configured for the environment.
Version 0.6.3 adds node time, node storage, node diagnostics, and cluster join information. It also introduces LXC migration preflight checks and guarded migration submission. Migration returns a task UPID and may return a local job ID; the release requires migration confirmation, with a separate downtime confirmation when restarting is requested. The project says migration is never automatically retried.
Limitations before adoption
Because an AI client can invoke real infrastructure operations, “tool access works” is not enough for production adoption. Start with a Proxmox API token containing only the permissions required by the intended workflows, and separate read-only, mutating, and high-risk actions. SSH-backed execution and optional node SSH commands should be enabled only after reviewing command policy, network exposure, and credential handling.
Migration needs a particularly careful operator workflow. The 0.6.3 release explicitly says that no live Proxmox migration was performed. Its assessment does not reserve capacity or verify backup freshness or restorability, application health, or every Proxmox migration constraint. Complex mounts, unused volumes, custom devices, and HA-managed guests require separate handling. If submission returns SUBMISSION_UNCERTAIN, operators should inspect Proxmox tasks and the guest’s location before considering another call.
Deployment considerations
The project documents local MCP stdio, native MCP HTTP in Docker, and an OpenAPI Docker path. Remote HTTP deployments should address authentication, TLS, Host/Origin validation, external access control, and key lifecycle. The README notes that allowing unauthenticated HTTP only bypasses the project’s own key check; it does not configure or verify an external access-control layer. After upgrading to 0.6.3, workers should be restarted and MCP clients reconnected to refresh tool discovery. The release says existing SQLite state and legacy OAuth metadata can be preserved and that no database migration is introduced. The repository reports an MIT License, while permissions, backups, and change approval remain deployment responsibilities.
Sources
Sources checked: 2026-10-18