// SCAN REPORT

Proxmox MCP Server

286 tools. 129 can modify or destroy data without limits.

28 destructive tools with no built-in limits. Policy required.

Last updated: 20 Jul 2026

129 can modify or destroy data

157 read-only

286 tools total

Community server · catalogue entry checked 20/07/2026

How to control Proxmox MCP Server ↓

TOOL MAP

What Proxmox MCP Server exposes to your agents

Read (157) Write / Execute (100) Destructive / Financial (28)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS

Critical Risk

The most dangerous Proxmox MCP Server tools

Destructive · High convert_container_to_template This tool converts a running or stopped container into a read-only template, destroying its ability to function as an independent operational unit. Destructive · High convert_vm_to_template Converting a VM to a template is an irreversible transformation that fundamentally changes the nature of the resource and prevents it from being used as an active VM. Destructive · High delete_backup_job Deleting a backup job is a destructive action that irreversibly removes automated data protection. Destructive · High delete_cluster_firewall_rule Deleting cluster firewall rules cannot be undone and directly impacts security posture across the entire Proxmox cluster.

129 of Proxmox MCP Server's 286 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control Proxmox MCP Server

PolicyLayer is an MCP gateway — it sits between your AI agents and Proxmox MCP Server, and nothing reaches the server without passing your rules. These are the rules we recommend:

Deny destructive operations

{
  "convert_container_to_template": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Blocked by default. Requires approval."
      }
    ]
  }
}

Destructive tools should never be available to autonomous agents without human approval.

Rate limit write operations

{
  "add_firewall_ipset_entry": {
    "limits": [
      {
        "counter": "add_firewall_ipset_entry_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations

{
  "download_file_restore": {
    "limits": [
      {
        "counter": "download_file_restore_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

Create a free account and register Proxmox MCP Server — nothing to install.
Add these rules — paste them, or build them visually. Tune the limits to your setup.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

ENFORCE POLICY ON PROXMOX →

Instant setup, no code required.

FULL CATALOGUE

All 286 Proxmox MCP Server tools

DESTRUCTIVE 28 tools

EXECUTE 37 tools

Execute apply_sdn_changes Apply pending SDN configuration changes to all nodes. Execute bulk_migrate_guests Bulk migrate guests to a target node. Execute bulk_shutdown_guests Bulk shutdown guests across the cluster. Execute bulk_start_guests Bulk start guests across the cluster. Execute create_vzdump create_vzdump Execute get_vm_spiceproxy Create a SPICE proxy connection for a VM console. Execute get_vm_vncproxy Create a VNC proxy connection ticket for a VM (for console access). Execute join_cluster join_cluster Execute manage_node_service Start, stop, restart, or reload a system service on a node. Execute migrate_container migrate_container Execute migrate_ha_resource Request migration of an HA resource to a different node. Execute migrate_vm migrate_vm Execute order_node_certificate Order/renew ACME certificate for a node. Execute proxmox_api_raw Make an arbitrary Proxmox API call for any endpoint not covered by specific tools. Execute reboot_container Reboot a container. Execute reboot_vm Reboot a VM via ACPI. Execute relocate_ha_resource Request relocation of an HA resource to a different node. Execute reset_vm Hard reset a VM (like pressing the reset button). Execute resume_container Resume a suspended container. Execute resume_vm Resume a suspended/paused VM. Execute run_apt_update Refresh the package index on a node (apt update). Execute send_vm_key Send a key event to a VM (e.g. ctrl-alt-del). Execute send_vm_monitor_command Send a QEMU monitor command to a VM (advanced/low-level). Execute set_ceph_flags Set a Ceph global flag. Execute shutdown_container Gracefully shut down a container. Execute start_container Start a container. Execute start_vm Start a VM. Execute startall_node Start all VMs and containers on a node (respecting boot order). Execute stop_container Hard-stop a container (immediate, like power off). Execute stop_task Stop (abort) a running task. Execute stop_vm Hard-stop a VM (like pulling the power plug). Prefer shutdown_vm for graceful stop. Execute suspend_container Suspend (freeze) a container. Execute suspend_vm Suspend a VM (pause execution or hibernate to disk). Execute test_notification_target Send a test notification to a target. Execute vm_agent_exec Execute a command inside a VM via the QEMU Guest Agent. Execute vm_agent_set_password Set a user password inside a VM via the guest agent. Execute wakeonlan_node Send a Wake-on-LAN magic packet to a node.

WRITE 63 tools

Write add_firewall_ipset_entry Add an IP/CIDR to an IP set. Write allocate_storage_volume allocate_storage_volume Write change_password Change a user's password. Write clone_container clone_container Write clone_vm clone_vm Write create_backup_job create_backup_job Write create_ceph_osd Create a new Ceph OSD on a device. Write create_ceph_pool create_ceph_pool Write create_cluster_firewall_rule create_cluster_firewall_rule Write create_container create_container Write create_container_firewall_rule create_container_firewall_rule Write create_container_snapshot Create a snapshot of a container. Write create_directory_storage Create a directory-based storage mount from a device. Write create_firewall_alias Create a firewall alias (named IP address or CIDR). Write create_firewall_group Create a new firewall security group. Write create_firewall_group_rule create_firewall_group_rule Write create_firewall_ipset Create a new firewall IP set. Write create_group Create a new group. Write create_ha_group create_ha_group Write create_ha_resource create_ha_resource Write create_lvm Create a new LVM volume group on a device. Write create_lvmthin Create a new LVM thin pool. Write create_node_network_interface create_node_network_interface Write create_pool Create a resource pool. Write create_replication_job create_replication_job Write create_role Create a new role with specific privileges. Write create_sdn_subnet Create a subnet for an SDN VNet. Write create_sdn_vnet Create an SDN VNet. Write create_sdn_zone create_sdn_zone Write create_storage create_storage Write create_user create_user Write create_user_token create_user_token Write create_vm create_vm Write create_vm_firewall_rule create_vm_firewall_rule Write create_vm_snapshot Create a snapshot of a VM. Write create_zfs_pool create_zfs_pool Write download_appliance_template Download an appliance template to local storage. Write download_url_to_storage download_url_to_storage Write move_container_volume move_container_volume Write move_vm_disk move_vm_disk Write register_acme_account Register a new ACME account. Write resize_container_disk Resize a container disk/volume. Write resize_vm_disk Resize a VM disk. Can only grow, not shrink. Write set_cluster_firewall_options set_cluster_firewall_options Write set_node_firewall_options set_node_firewall_options Write set_vm_firewall_options set_vm_firewall_options Write update_acl update_acl Write update_backup_job update_backup_job Write update_cluster_firewall_rule update_cluster_firewall_rule Write update_cluster_options update_cluster_options Write update_container_config update_container_config Write update_group Update a group. Write update_ha_group update_ha_group Write update_ha_resource update_ha_resource Write update_pool update_pool Write update_role Update role privileges. Write update_sdn_vnet Update an SDN VNet. Write update_storage update_storage Write update_user update_user Write update_vm_cloudinit update_vm_cloudinit Write update_vm_config update_vm_config Write upload_to_storage upload_to_storage Write vm_agent_file_write Write content to a file inside a VM via the guest agent.

READ 157 tools

OTHER 1 tools

Other sync_auth_domain sync_auth_domain

EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

FAQ

Questions about Proxmox MCP Server

Can an AI agent delete data through the Proxmox MCP Server MCP server? +

Yes. The Proxmox MCP Server server exposes 28 destructive tools including convert_container_to_template, convert_vm_to_template, delete_backup_job. These permanently remove resources with no undo. PolicyLayer blocks destructive tools by default so they never reach the upstream server.

How do I prevent bulk modifications through Proxmox MCP Server? +

The Proxmox MCP Server server has 63 write tools including add_firewall_ipset_entry, allocate_storage_volume, change_password. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach Proxmox MCP Server.

How many tools does the Proxmox MCP Server MCP server expose? +

286 tools across 4 categories: Destructive, Execute, Read, Write. 157 are read-only. 129 can modify, create, or delete data.

How do I enforce a policy on Proxmox MCP Server? +

Register the Proxmox MCP Server MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every Proxmox MCP Server tool call.

Deterministic rules across all 286 Proxmox MCP Server tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON PROXMOX →

Instant setup, no code required.

286 Proxmox MCP Server tools catalogued and risk-classified — across an index of 46,500+ MCP servers.

// WHERE THIS COMES FROM

These policies come from Proxmox MCP Server's registry record.

The record behind this page: verified identity, auth posture, risk grade, every tool classified, recommended policy — re-checked continuously.

Teams ship this data inside their own products. See what a licence covers →