Proxmox Mcps MCP Server
proxmox-mcps
npm
v0.2.1
Published by ngocdd — no publish provenance, so origin is unverified, but the source is public: the repository link below is self-declared yet readable, so you can inspect the code before adopting it.
MCP server for Proxmox VE — AI-driven QEMU VM and LXC container management
The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.
1. Threat score — 100 − 0 = 100. What the published surface and source actually contain:
The deterministic scan raised no scored threat in the surface it inspected — the threat score stayed at 100. Capability observations and advisory notes are recorded but never lower it.
2. Client adoption risk — 100 − 7 = 93. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:
| Points | Adoption-risk factor |
|---|---|
| −6 | capability blast radius (high) — client exposure if the model is manipulated |
| −1 | publisher verification (public source) — no provenance, but the source is public and inspectable |
Capability observations and info notes are shown under Findings but never scored.
Open any row's finding below for the file, line and evidence behind a deduction.
Findings 9
high Tool "vm_agent_exec" exposes command/code executionMTC-CAP-001
Tool "vm_agent_exec" appears to run shell commands or evaluate code (keyword "exec" in tool name). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.
Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.
Location: tool vm_agent_exec
high Tool "vm_agent_exec_status" exposes command/code executionMTC-CAP-001
Tool "vm_agent_exec_status" appears to run shell commands or evaluate code (keyword "exec" in tool name). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.
Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.
Location: tool vm_agent_exec_status
medium Untrusted input can drive an external actionMTC-FLOW-005
Untrusted-input tools ([download_iso, get_job]) co-exist with external-action tools ([vm_agent_exec, vm_agent_exec_status]). A prompt injection could cause unwanted external actions, though no direct sensitive-data leak path was found.
Evidence: untrusted [download_iso, get_job] → sinks [vm_agent_exec, vm_agent_exec_status]
Fix: Require confirmation for state-changing/egress actions triggered after processing untrusted content.
Location: flow download_iso → vm_agent_exec
medium Tool "unlink_container_disk" can modify the filesystemMTC-CAP-002
Tool "unlink_container_disk" can write, overwrite or delete files (keyword "unlink" in tool name). Verify it is scoped to a safe directory.
Fix: Constrain file operations to an explicit, non-sensitive root; reject path traversal.
Location: tool unlink_container_disk
medium Tool "unlink_vm_disk" can modify the filesystemMTC-CAP-002
Tool "unlink_vm_disk" can write, overwrite or delete files (keyword "unlink" in tool name). Verify it is scoped to a safe directory.
Fix: Constrain file operations to an explicit, non-sensitive root; reject path traversal.
Location: tool unlink_vm_disk
low Mutating tool "unlink_container_disk" declares no destructiveHintMTC-CAP-005
Tool "unlink_container_disk" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.
Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.
Location: tool unlink_container_disk
low Mutating tool "vm_agent_exec" declares no destructiveHintMTC-CAP-005
Tool "vm_agent_exec" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.
Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.
Location: tool vm_agent_exec
low Mutating tool "vm_agent_exec_status" declares no destructiveHintMTC-CAP-005
Tool "vm_agent_exec_status" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.
Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.
Location: tool vm_agent_exec_status
low Mutating tool "unlink_vm_disk" declares no destructiveHintMTC-CAP-005
Tool "unlink_vm_disk" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.
Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.
Location: tool unlink_vm_disk
Tools 181
Each tool and what it can reach — statically extracted from the published source.
download_isoingests untrusted inputget_jobingests untrusted inputunlink_container_diskwrites filesunlink_vm_diskwrites filesvm_agent_execruns code / shellvm_agent_exec_statusruns code / shelladd_ha_resourceno sensitive capabilityapply_sdnno sensitive capabilitycancel_jobno sensitive capabilityclone_containerno sensitive capability
Show 171 more tools ↓
clone_vmno sensitive capabilitycontainer_firewall_optionsno sensitive capabilitycontainer_firewall_rulesno sensitive capabilitycontainer_spiceproxyno sensitive capabilitycontainer_termproxyno sensitive capabilitycontainer_vncproxyno sensitive capabilityconvert_container_to_templateno sensitive capabilityconvert_vm_to_templateno sensitive capabilitycreate_backupno sensitive capabilitycreate_backup_jobno sensitive capabilitycreate_containerno sensitive capabilitycreate_ha_groupno sensitive capabilitycreate_node_networkno sensitive capabilitycreate_node_zfsno sensitive capabilitycreate_poolno sensitive capabilitycreate_replication_jobno sensitive capabilitycreate_sdn_controllerno sensitive capabilitycreate_sdn_subnetno sensitive capabilitycreate_sdn_vnetno sensitive capabilitycreate_sdn_zoneno sensitive capabilitycreate_snapshotno sensitive capabilitycreate_storageno sensitive capabilitycreate_vmno sensitive capabilitydelete_backupno sensitive capabilitydelete_backup_jobno sensitive capabilitydelete_containerno sensitive capabilitydelete_ha_groupno sensitive capabilitydelete_isono sensitive capabilitydelete_node_certificateno sensitive capabilitydelete_node_networkno sensitive capabilitydelete_node_subscriptionno sensitive capabilitydelete_poolno sensitive capabilitydelete_replication_jobno sensitive capabilitydelete_sdn_controllerno sensitive capabilitydelete_sdn_subnetno sensitive capabilitydelete_sdn_vnetno sensitive capabilitydelete_sdn_zoneno sensitive capabilitydelete_snapshotno sensitive capabilitydelete_storageno sensitive capabilitydelete_vmno sensitive capabilityexecute_container_commandno sensitive capabilityget_backup_jobno sensitive capabilityget_backup_job_includedno sensitive capabilityget_cluster_statusno sensitive capabilityget_container_configno sensitive capabilityget_container_ipno sensitive capabilityget_container_rrdno sensitive capabilityget_container_rrddatano sensitive capabilityget_container_statusno sensitive capabilityget_containersno sensitive capabilityget_ha_groupno sensitive capabilityget_ha_resource_statusno sensitive capabilityget_ha_statusno sensitive capabilityget_node_configno sensitive capabilityget_node_dnsno sensitive capabilityget_node_hostsno sensitive capabilityget_node_journalno sensitive capabilityget_node_reportno sensitive capabilityget_node_statusno sensitive capabilityget_node_subscriptionno sensitive capabilityget_node_syslogno sensitive capabilityget_node_timeno sensitive capabilityget_node_timezoneno sensitive capabilityget_nodesno sensitive capabilityget_poolno sensitive capabilityget_replication_jobno sensitive capabilityget_replication_statusno sensitive capabilityget_sdn_controllerno sensitive capabilityget_sdn_subnetno sensitive capabilityget_sdn_vnetno sensitive capabilityget_sdn_zoneno sensitive capabilityget_storageno sensitive capabilityget_taskno sensitive capabilityget_task_logno sensitive capabilityget_vm_configno sensitive capabilityget_vm_pendingno sensitive capabilityget_vm_rrdno sensitive capabilityget_vm_rrddatano sensitive capabilityget_vm_statusno sensitive capabilityget_vmsno sensitive capabilityinit_node_diskno sensitive capabilitylist_backup_jobsno sensitive capabilitylist_backupsno sensitive capabilitylist_ha_groupsno sensitive capabilitylist_ha_resourcesno sensitive capabilitylist_isosno sensitive capabilitylist_jobsno sensitive capabilitylist_node_certificatesno sensitive capabilitylist_node_disksno sensitive capabilitylist_node_disks_detailedno sensitive capabilitylist_node_networkno sensitive capabilitylist_node_replicationno sensitive capabilitylist_node_servicesno sensitive capabilitylist_poolsno sensitive capabilitylist_replication_jobsno sensitive capabilitylist_sdn_controllersno sensitive capabilitylist_sdn_subnetsno sensitive capabilitylist_sdn_vnetsno sensitive capabilitylist_sdn_zonesno sensitive capabilitylist_snapshotsno sensitive capabilitylist_storagesno sensitive capabilitylist_tasksno sensitive capabilitylist_templatesno sensitive capabilitymigrate_containerno sensitive capabilitymigrate_ha_resourceno sensitive capabilitymigrate_vmno sensitive capabilitymove_container_diskno sensitive capabilitymove_container_volumeno sensitive capabilitymove_vm_diskno sensitive capabilitynode_apt_repos_changeno sensitive capabilitynode_apt_repos_listno sensitive capabilitynode_apt_updateno sensitive capabilitynode_apt_versionsno sensitive capabilitynode_migrate_allno sensitive capabilitynode_start_allno sensitive capabilitynode_stop_allno sensitive capabilitynode_wake_on_lanno sensitive capabilitypoll_jobno sensitive capabilityprune_backupsno sensitive capabilityreboot_vmno sensitive capabilityregenerate_vm_configno sensitive capabilityreload_node_networkno sensitive capabilityremove_ha_resourceno sensitive capabilityreset_vmno sensitive capabilityresize_container_diskno sensitive capabilityresize_vm_diskno sensitive capabilityrestart_containerno sensitive capabilityrestore_backupno sensitive capabilityretry_jobno sensitive capabilityrollback_snapshotno sensitive capabilityrun_backup_jobno sensitive capabilityset_node_dnsno sensitive capabilityset_node_hostsno sensitive capabilityset_node_subscriptionno sensitive capabilityset_node_timeno sensitive capabilityset_node_timezoneno sensitive capabilityset_vm_cloudinitno sensitive capabilityshutdown_containerno sensitive capabilityshutdown_vmno sensitive capabilitystart_containerno sensitive capabilitystart_vmno sensitive capabilitystop_containerno sensitive capabilitystop_vmno sensitive capabilityupdate_backup_jobno sensitive capabilityupdate_container_configno sensitive capabilityupdate_container_resourcesno sensitive capabilityupdate_ha_groupno sensitive capabilityupdate_node_configno sensitive capabilityupdate_node_networkno sensitive capabilityupdate_node_subscriptionno sensitive capabilityupdate_poolno sensitive capabilityupdate_replication_jobno sensitive capabilityupdate_sdn_controllerno sensitive capabilityupdate_sdn_subnetno sensitive capabilityupdate_sdn_vnetno sensitive capabilityupdate_sdn_zoneno sensitive capabilityupdate_storageno sensitive capabilityupdate_vm_configno sensitive capabilityvm_agent_fstrimno sensitive capabilityvm_agent_set_user_passwordno sensitive capabilityvm_featureno sensitive capabilityvm_firewall_optionsno sensitive capabilityvm_firewall_rulesno sensitive capabilityvm_monitorno sensitive capabilityvm_mtunnelno sensitive capabilityvm_mtunnelwebsocketno sensitive capabilityvm_sendkeyno sensitive capabilityvm_spiceproxyno sensitive capabilityvm_termproxyno sensitive capabilityvm_vncproxyno sensitive capabilitywipe_node_diskno sensitive capability
Toxic flows 1
Cross-tool combinations that form a data-exfiltration primitive (untrusted input → sensitive source → external sink).
What this scan could not see
- Tools were statically extracted from the published source (181 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
Versions 1
Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.
| Version | Score | Findings | Engine | Scanned |
|---|---|---|---|---|
v0.2.1 latest |
A 93/100 | 9 | 1.13.0 | 2026-09-07 |
Embed this score
Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.
Verify this score yourself
The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.
npx mcptrustchecker scan proxmox-mcps --onlineMore in Cloud & DevOps
Operator control CLI for AdGuard Home with an MCP adapter
interacting with Aliyun (Alibaba Cloud) services through This MCP server provides tools.
MCP server for the Aspro.Cloud REST API
MCP server for Atlassian Confluence and Jira Cloud APIs
AuroraCloud-first MCP server that exposes AuroraDocs workspace data to Claude Desktop and other AI agents
The official AWS Knowledge Base retrieval server using Bedrock Agent Runtime.