A Proxmox MCP server · the lanista's cut

So. You mean to hand an agent the keys to iron you love.

Good. Then it takes what a fighter takes into the arena: every dangerous move planned before it lands, proven on a ledger that catches every edit, undone wherever the platform can snapshot. And not one blade more. Hand it the keys. Keep the receipts.

Take the blade ↓ See it on GitHub

Win the crowd · and you will win your freedom

The kit

Armed with exactly what you need. Never more.

Four pieces come standard: live, on the first call, before you grant a thing. This is what an agent carries into your arena.

Plan

the blade you see before it falls

Every mutation returns its blast radius first: the exact change, the live state, what it touches. Nothing strikes until you say confirm=true.

Prove

the seal that breaks if it's touched

A keyed, hash-chained ledger records every move. Alter one line and the chain breaks at that line. Pin the head off-box and truncation breaks too.

Undo

the way back

Snapshot-first, wherever the platform can snapshot: before risky exec, config-revert, rollback. The retreat is cut before the advance.

Diagnose

eyes on the field

A read-only evidence battery, node health, honest flags. It tells you what it could not see, so silence never reads as a clean bill.

Six more wait in the rack: consent, a kill-switch, a lease, a scope, an envelope, a taint-guard. You strap them on when you're ready; each becomes a real wall only once its state lives beyond the agent's own reach. Read what each one defends →

The oath · the helmet comes off

A lanista who lies to his fighters buries them.

So here is what this weapon does not do. Read it before you trust it. It's the same page the agents get, sharp edges first.

  • Risk ratings are advice, not armor. LOW means "no state change," never "safe." The absence of a HIGH flag is not a safety signal.

  • UNDO covers the snapshottable surface. Firewall, SDN, ACL and token planes have no rollback primitive, so Proximo claims none rather than pretend one.

  • The opt-in controls are a discipline until you place their state outside the agent's reach. Inside one trust domain they're a habit, not a wall. Said plainly.

  • The floor is the token you mint. Proxmox's own RBAC holds even if Proximo is wholly compromised. A stronger promise than anything Proximo's code makes. Scope it to exactly what you mean to grant.

Don't take the word for any of it. Run proximo doctor to see what a token can and can't do before an agent is wired in, or verify it yourself, three receipts, no trust required.

Step into the arena

Arm yourself.

Start read-only. Proximo earns its reach long before you grant it write.

Preflight

See exactly what a token can and cannot do: cold, before any AI touches it.

$ uvx proximo-proxmox doctor
Token-first setup →

Arm

Wire it into your MCP client. The secret is passed by file path, never inlined.

$ uvx proximo-proxmox
Quickstart →

Judge it first

Ten questions to ask before you hand any agent real infrastructure. Proximo's own scorecard published, partials included.

The Keys Test →

He won his freedom in the arena, then opened the cages with the wooden sword in his hand. Your metal, your token, a ledger you own. No cloud, no phone-home, no toll booth, no standing server unless you ask for one. Win the crowd. Win your freedom.