A Proxmox MCP server · the lanista's cut

So — you mean to hand a machine the keys to iron you love.

Good. Then it takes what a fighter takes into the arena — every dangerous move planned before it lands, proven on a ledger that catches every edit, undone wherever the platform can snapshot. And not one blade more. Hand it the keys. Keep the receipts.

Take the blade ↓ See it on GitHub

Win the crowd · and you will win your freedom

The kit

Armed with exactly what you need. Never more.

Four pieces come standard — live, on the first call, before you grant a thing. This is what a machine carries into your arena.

Plan

the blade you see before it falls

Every mutation returns its blast radius first — the exact change, the live state, what it touches. Nothing strikes until you say confirm=true.

Prove

the seal that breaks if it's touched

A keyed, hash-chained ledger records every move. Alter one line and the chain breaks at that line. Pin the head off-box and truncation breaks too.

Undo

the way back

Snapshot-first, wherever the platform can snapshot: before risky exec, config-revert, rollback. The retreat is cut before the advance.

Diagnose

eyes on the field

A read-only evidence battery, node health, honest flags — it tells you what it could not see, so silence never reads as a clean bill.

Six more wait in the rack — consent, a kill-switch, a lease, a scope, an envelope, a taint-guard. You strap them on when you're ready; each becomes a real wall only once its state lives beyond the agent's own reach. Read what each one defends →

The oath — the helmet comes off

A lanista who lies to his fighters buries them.

So here is what this weapon does not do. Read it before you trust it — it's the same page the agents get, sharp edges first.

  • Risk ratings are advice, not armor. LOW means "no state change" — never "safe." The absence of a HIGH flag is not a safety signal.

  • UNDO covers the snapshottable surface. Firewall, SDN, ACL and token planes have no rollback primitive — so Proximo claims none, rather than pretend one.

  • The opt-in controls are a discipline until you place their state outside the agent's reach. Inside one trust domain they're a habit, not a wall — said plainly.

  • The floor is the token you mint. Proxmox's own RBAC holds even if Proximo is wholly compromised — a stronger promise than anything Proximo's code makes. Scope it to exactly what you mean to grant.

Don't take the word for any of it. Run proximo doctor to see what a token can and can't do before an agent is wired in — or verify it yourself, three receipts, no trust required.

Step into the arena

Arm yourself.

Start read-only. Proximo earns its reach long before you grant it write.

Preflight

See exactly what a token can and cannot do — cold, before any AI touches it.

$ uvx proximo-proxmox doctor
Token-first setup →

Arm

Wire it into your MCP client. The secret is passed by file path — never inlined.

$ uvx proximo-proxmox
Quickstart →

Judge it first

Ten questions to ask before you hand any agent real infrastructure. Proximo's own scorecard published — partials included.

The Keys Test →

He won his freedom in the arena, then opened the cages with the wooden sword in his hand. Your metal, your token, a ledger you own — no cloud, no phone-home, no toll booth, no standing server unless you ask for one. Win the crowd. Win your freedom.