PlugWiki

Proxmox MCP servers: which one to use

We found no official Proxmox MCP server. Use ProxmoxMCP-Plus for the most used, or akmalovaa or Proximo if you want read-only by default.

Servers
21
active
Local
17
runs on your machine

We found no MCP server published by Proxmox, so every option is a community project that logs in with a Proxmox API token. An AI with a broad token can stop, roll back or delete VMs. Pick a server with a read-only switch and give it a token limited to what you need. ProxmoxMCP-Plus has the most stars, and akmalovaa and Proximo start read-only until you say otherwise.

Good for

  • Homelab owners who want Claude or Cursor to list VMs, check status and read logs
  • Admins who want snapshots, backups and VM changes from chat, with approval before anything destructive
  • Teams that want the whole Proxmox API, with tools trimmed to what they use
  • Anyone who wants an AI to look but not touch

Which Proxmox MCP server to use

Use ProxmoxMCP-Plus for the most stars and a wide tool set. Pick akmalovaa, Proximo, samik081 or ry-ops when you want the AI limited to reading first.

ServerRead-only by defaultRead-only optionToolsSign-inGitHub stars
ProxmoxMCP-Plus–Approval gates–API token630
gethosthewalrusNoEnv setting–API token226
ProximoYesDefault6API token64
ry-ops–Env setting341Token or password50
samik081NoAccess tier122API token26
lidless-labs–Write gates96API token11
akmalovaaYesDefault50Token or password5

All Proxmox MCP servers

21 active · official first, then by GitHub stars

Show all 21

Questions

Is there an official Proxmox MCP server?

We found none. Proxmox does not list one that we could find, and all seven servers here are community projects that talk to the Proxmox VE API.

Which Proxmox MCP server is read-only by default?

akmalovaa/proxmox-mcp and Proximo. akmalovaa gates destructive actions behind PROXMOX_RISK_LEVEL, and Proximo shows a plan first and runs no change on the first call.

How do I stop an AI from deleting my VMs?

Turn on the server's read-only option and use a Proxmox API token with a read-only role. ry-ops and gethosthewalrus use PROXMOX_READ_ONLY=true, samik081 uses PVE_ACCESS_TIER=read-only, and ry-ops also lists a PVEAuditor role for monitoring.

Can it delete or roll back VMs?

Yes, some can. akmalovaa's highest risk level adds delete-snapshot and rollback-snapshot tools. lidless-labs lists 8 destructive tools, such as destroying a resource or rolling back a snapshot, that need three separate confirmations. ry-ops can hide the 73 tools that delete, stop, wipe or roll back with PROXMOX_NO_DESTRUCTIVE=true.

What do I need to sign in?

A Proxmox API token, made in the Proxmox web interface. akmalovaa and ry-ops also accept a username and password, but their READMEs recommend a token. Give the token only the permissions you need.

Which one has the most tools?

ry-ops lists 341 tools across 14 areas, and PROXMOX_TOOLSETS trims that to what you use. samik081 has 122 and lidless-labs has 96. Proximo goes the other way with six tools.

Does it work with Claude Desktop, Cursor and Claude Code?

Yes. samik081 names Cursor, Claude Code and Claude Desktop, and ProxmoxMCP-Plus names Claude Desktop, Cursor, VS Code and Codex. lidless-labs shows a Claude Desktop config.

Can I run it in Docker?

Yes. akmalovaa, samik081 and ry-ops publish Docker images on GHCR, and gethosthewalrus is listed as mcp/proxmox on Docker Hub.

Does it work with a self-signed certificate?

Yes, with a setting. samik081 uses PVE_VERIFY_SSL=false, and gethosthewalrus has PROXMOX_VERIFY_SSL. Only do this on a network you trust.

Server facts from the official MCP registry, GitHub, npm, PyPI and the Docker catalog. Archived servers are not listed.