Proxmox (GethosTheWalrus) MCP Server
proxmox-mcp-server
PyPI
v1.4.1
Published by gethosthewalrus — no publish provenance, so origin is unverified, but the source is public: the repository link below is self-declared yet readable, so you can inspect the code before adopting it.
MCP server for Proxmox VE infrastructure management
The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.
1. Threat score — 100 − 0 = 100. What the published surface and source actually contain:
The deterministic scan raised no scored threat in the surface it inspected — the threat score stayed at 100. Capability observations and advisory notes are recorded but never lower it.
2. Client adoption risk — 100 − 4 = 96. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:
| Points | Adoption-risk factor |
|---|---|
| −3 | capability blast radius (moderate) — client exposure if the model is manipulated |
| −1 | publisher verification (public source) — no provenance, but the source is public and inspectable |
Capability observations and info notes are shown under Findings but never scored.
Open any row's finding below for the file, line and evidence behind a deduction.
Findings 2
low Shell/command execution in packaging/dev tooling (tests/test_server.py)MTC-SRC-002
In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_server.py:197`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: self): result = subprocess.run( [sys.executable, "scripts/generate_tool_manifest.py", "--check"],
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server tests/test_server.py
low Dynamic module load from a non-literal in packaging/dev tooling (tests/test_server.py)MTC-SRC-005
In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_server.py:46`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: r("test") mod = __import__(f"proxmox_mcp.tools.{module_name}", fromlist=["register"]) mod.register(test_
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server tests/test_server.py
Tools 200
Each tool and what it can reach — statically extracted from the published source.
download_appliance_templateingests untrusted inputdownload_file_restoreingests untrusted inputlist_backup_file_restorereads sensitive dataadd_firewall_ipset_entryno sensitive capabilitybulk_migrate_guestsno sensitive capabilitybulk_shutdown_guestsno sensitive capabilitybulk_start_guestsno sensitive capabilitychange_passwordno sensitive capabilityclone_containerno sensitive capabilityconvert_container_to_templateno sensitive capability
Show 190 more tools ↓
create_backup_jobno sensitive capabilitycreate_ceph_osdno sensitive capabilitycreate_ceph_poolno sensitive capabilitycreate_cluster_firewall_ruleno sensitive capabilitycreate_containerno sensitive capabilitycreate_container_firewall_ruleno sensitive capabilitycreate_container_snapshotno sensitive capabilitycreate_firewall_aliasno sensitive capabilitycreate_firewall_groupno sensitive capabilitycreate_firewall_group_ruleno sensitive capabilitycreate_firewall_ipsetno sensitive capabilitycreate_groupno sensitive capabilitycreate_ha_groupno sensitive capabilitycreate_ha_resourceno sensitive capabilitycreate_node_network_interfaceno sensitive capabilitycreate_poolno sensitive capabilitycreate_replication_jobno sensitive capabilitycreate_roleno sensitive capabilitycreate_userno sensitive capabilitycreate_user_tokenno sensitive capabilitycreate_vm_firewall_ruleno sensitive capabilitycreate_vzdumpno sensitive capabilitydelete_backup_jobno sensitive capabilitydelete_cluster_firewall_ruleno sensitive capabilitydelete_containerno sensitive capabilitydelete_container_snapshotno sensitive capabilitydelete_firewall_aliasno sensitive capabilitydelete_firewall_ipset_entryno sensitive capabilitydelete_groupno sensitive capabilitydelete_ha_groupno sensitive capabilitydelete_ha_resourceno sensitive capabilitydelete_poolno sensitive capabilitydelete_replication_jobno sensitive capabilitydelete_roleno sensitive capabilitydelete_userno sensitive capabilitydelete_user_tokenno sensitive capabilityget_aclno sensitive capabilityget_acme_accountno sensitive capabilityget_acme_pluginno sensitive capabilityget_auth_domainno sensitive capabilityget_backup_jobno sensitive capabilityget_backup_job_included_volumesno sensitive capabilityget_ceph_configno sensitive capabilityget_ceph_crush_rulesno sensitive capabilityget_ceph_flagsno sensitive capabilityget_ceph_metadatano sensitive capabilityget_ceph_status_clusterno sensitive capabilityget_ceph_status_nodeno sensitive capabilityget_cluster_configno sensitive capabilityget_cluster_config_nodesno sensitive capabilityget_cluster_firewall_optionsno sensitive capabilityget_cluster_firewall_ruleno sensitive capabilityget_cluster_join_infono sensitive capabilityget_cluster_logno sensitive capabilityget_cluster_optionsno sensitive capabilityget_cluster_resourcesno sensitive capabilityget_cluster_statusno sensitive capabilityget_cluster_tasksno sensitive capabilityget_cluster_totemno sensitive capabilityget_container_configno sensitive capabilityget_container_featureno sensitive capabilityget_container_firewall_optionsno sensitive capabilityget_container_interfacesno sensitive capabilityget_container_pendingno sensitive capabilityget_container_rrddatano sensitive capabilityget_container_statusno sensitive capabilityget_disk_smartno sensitive capabilityget_firewall_group_rulesno sensitive capabilityget_firewall_refsno sensitive capabilityget_groupno sensitive capabilityget_ha_groupno sensitive capabilityget_ha_manager_statusno sensitive capabilityget_ha_resourceno sensitive capabilityget_ha_statusno sensitive capabilityget_metric_serverno sensitive capabilityget_next_vmidno sensitive capabilityget_node_aplinfono sensitive capabilityget_node_apt_updateno sensitive capabilityget_node_capabilities_qemuno sensitive capabilityget_node_configno sensitive capabilityget_node_disksno sensitive capabilityget_node_dnsno sensitive capabilityget_node_firewall_logno sensitive capabilityget_node_firewall_optionsno sensitive capabilityget_node_hardware_pcino sensitive capabilityget_node_hardware_usbno sensitive capabilityget_node_hostsno sensitive capabilityget_node_journalno sensitive capabilityget_node_netstatno sensitive capabilityget_node_networkno sensitive capabilityget_node_network_interfaceno sensitive capabilityget_node_reportno sensitive capabilityget_node_statusno sensitive capabilityget_node_storage_scanno sensitive capabilityget_node_subscriptionno sensitive capabilityget_node_syslogno sensitive capabilityget_node_timeno sensitive capabilityget_node_versionno sensitive capabilityget_permissionsno sensitive capabilityget_poolno sensitive capabilityget_replication_jobno sensitive capabilityget_roleno sensitive capabilityget_task_logno sensitive capabilityget_task_statusno sensitive capabilityget_userno sensitive capabilityget_user_tokenno sensitive capabilityget_versionno sensitive capabilityget_vm_firewall_optionsno sensitive capabilityget_vzdump_defaultsno sensitive capabilityget_vzdump_extractconfigno sensitive capabilityjoin_clusterno sensitive capabilitylist_acme_accountsno sensitive capabilitylist_acme_pluginsno sensitive capabilitylist_auth_domainsno sensitive capabilitylist_backup_jobsno sensitive capabilitylist_ceph_fsno sensitive capabilitylist_ceph_managersno sensitive capabilitylist_ceph_mdsno sensitive capabilitylist_ceph_monitorsno sensitive capabilitylist_ceph_osdsno sensitive capabilitylist_ceph_poolsno sensitive capabilitylist_cluster_firewall_rulesno sensitive capabilitylist_container_firewall_rulesno sensitive capabilitylist_container_snapshotsno sensitive capabilitylist_containersno sensitive capabilitylist_dir_mappingsno sensitive capabilitylist_firewall_aliasesno sensitive capabilitylist_firewall_groupsno sensitive capabilitylist_firewall_ipset_entriesno sensitive capabilitylist_firewall_ipsetsno sensitive capabilitylist_firewall_macrosno sensitive capabilitylist_groupsno sensitive capabilitylist_ha_groupsno sensitive capabilitylist_ha_resourcesno sensitive capabilitylist_metric_serversno sensitive capabilitylist_node_firewall_rulesno sensitive capabilitylist_node_servicesno sensitive capabilitylist_node_tasksno sensitive capabilitylist_nodesno sensitive capabilitylist_notification_endpointsno sensitive capabilitylist_notification_matchersno sensitive capabilitylist_notification_targetsno sensitive capabilitylist_pci_mappingsno sensitive capabilitylist_poolsno sensitive capabilitylist_realm_sync_jobsno sensitive capabilitylist_replication_jobsno sensitive capabilitylist_rolesno sensitive capabilitylist_scheduled_jobsno sensitive capabilitylist_tfano sensitive capabilitylist_usb_mappingsno sensitive capabilitylist_user_tokensno sensitive capabilitylist_usersno sensitive capabilitylist_vm_firewall_rulesno sensitive capabilitymanage_node_serviceno sensitive capabilitymigrate_containerno sensitive capabilitymigrate_ha_resourceno sensitive capabilitymove_container_volumeno sensitive capabilityproxmox_api_rawno sensitive capabilityreboot_containerno sensitive capabilityregister_acme_accountno sensitive capabilityrelocate_ha_resourceno sensitive capabilityresize_container_diskno sensitive capabilityresume_containerno sensitive capabilityrollback_container_snapshotno sensitive capabilityrun_apt_updateno sensitive capabilityset_ceph_flagsno sensitive capabilityset_cluster_firewall_optionsno sensitive capabilityset_node_firewall_optionsno sensitive capabilityset_vm_firewall_optionsno sensitive capabilityshutdown_containerno sensitive capabilitystart_containerno sensitive capabilitystartall_nodeno sensitive capabilitystop_containerno sensitive capabilitystop_taskno sensitive capabilitystopall_nodeno sensitive capabilitysuspend_containerno sensitive capabilitysync_auth_domainno sensitive capabilitytest_notification_targetno sensitive capabilityupdate_aclno sensitive capabilityupdate_backup_jobno sensitive capabilityupdate_cluster_firewall_ruleno sensitive capabilityupdate_cluster_optionsno sensitive capabilityupdate_container_configno sensitive capabilityupdate_groupno sensitive capabilityupdate_ha_groupno sensitive capabilityupdate_ha_resourceno sensitive capabilityupdate_poolno sensitive capabilityupdate_roleno sensitive capabilityupdate_userno sensitive capabilitywakeonlan_nodeno sensitive capability
What this scan could not see
- Tools were statically extracted from the published source (200 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
Versions 2
Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.
| Version | Score | Findings | Engine | Scanned |
|---|---|---|---|---|
v1.4.1 latest |
A 96/100 | 2 | 1.13.0 | 2026-08-25 |
v1.3.0 |
A 96/100 | 1 | 1.12.1 | 2026-07-27 |
Embed this score
Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.
Verify this score yourself
The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.
npx mcptrustchecker scan proxmox-mcp-server --online --registry pypiOther implementations of Proxmox 8
Independent packages implementing the same tool, scanned with the same engine. Compare all 9 side by side →
MCP server exposing Proxmox VE management as tools over stdio
MCP server for Proxmox VE — read-only monitoring via PVE REST API
MCP server for Proxmox VE and Proxmox Datacenter Manager — every API endpoint behind catalog-backed list/describe/call tools, reads live, writes ENV-gated.
MCP server for managing Proxmox VE infrastructure
Proxmox VE operator CLI with a gated MCP adapter
Proxmox MCP Server - TypeScript rewrite
More in Cloud & DevOps
Operator control CLI for AdGuard Home with an MCP adapter
interacting with Aliyun (Alibaba Cloud) services through This MCP server provides tools.
MCP server for the Aspro.Cloud REST API
MCP server for Atlassian Confluence and Jira Cloud APIs
AuroraCloud-first MCP server that exposes AuroraDocs workspace data to Claude Desktop and other AI agents
The official AWS Knowledge Base retrieval server using Bedrock Agent Runtime.