Our grade: 4 checks
Based on public data, not a full audit. See how we grade. Something changed? Request a re-grade.
Community rating
- 5 2
- 4 5
- 3 5
- 2 1
- 1 0
Trust in production
- Trust it - 23%
- With caveats - 54%
- Wouldn't - 23%
62% would recommend this server
How reviewers scored it
- Setup & docs 3.6
- Auth experience 3.5
- Reliability 3.8
- Maintainer responsiveness 3.8
Why it got a B
The most used Proxmox VE MCP server (MIT, Python, about 640 GitHub stars, published on PyPI as proxmox-mcp-plus and on GHCR). It talks to the Proxmox API with an API token and can create, start, stop, migrate and delete VMs and LXC containers, roll back snapshots, restore backups and download ISOs; long tasks get a job ID you can poll. Safety controls are real but mostly opt-in: TLS verification is on and can only be turned off in dev mode, guest command tools are blocked by a deny_all command policy until you allow patterns, SSH-backed container and node commands only appear when you add an ssh section, named targets can be marked readonly, and tool_allowlist hides tools you don't want the model to see. Docker HTTP mode binds to 127.0.0.1 and refuses to start without MCP_API_KEY, with optional OAuth backed by PostgreSQL. Not a Proxmox product. Biggest deduction: the server can do anything its API token can, the README example uses root@pam, and high-risk actions such as delete_vm are only logged (audit_only) unless you enforce approval, so create a dedicated token with privilege separation and the smallest role that works.
How to connect
// Cursor MCP config (README: keep credentials in a local config file)
{ "mcpServers": { "proxmox-mcp-plus": { "command": "uvx",
"args": ["proxmox-mcp-plus"],
"env": { "PROXMOX_MCP_CONFIG":
"/path/to/ProxmoxMCP-Plus/proxmox-config/config.json" } } } }// claude_desktop_config.json (README's recommended stdio config)
{ "mcpServers": { "proxmox-mcp-plus": { "command": "uvx",
"args": ["proxmox-mcp-plus"],
"env": { "PROXMOX_HOST": "your-proxmox-host",
"PROXMOX_USER": "root@pam", "PROXMOX_TOKEN_NAME": "mcp-token",
"PROXMOX_TOKEN_VALUE": "your-token-secret",
"PROXMOX_PORT": "8006", "PROXMOX_VERIFY_SSL": "true" } } } }Is ProxmoxMCP-Plus safe?
Is ProxmoxMCP-Plus safe to use?
ProxmoxMCP-Plus grades B (solid, with minor gaps). Login is required, but access is coarse: one sign-in or key covers more than your agent needs, so grant the narrowest account you can. It runs locally over stdio, so it acts with your machine's access.
Does ProxmoxMCP-Plus have known vulnerabilities?
Not in our current data: it has no open CVEs or advisories. We re-check as new ones are published.
Does ProxmoxMCP-Plus support authentication?
Yes. It requires a login, so access can be tied to a person or a scoped key.
Alternatives in Cloud & Hosting
- A AWS MCP ServerAWS's managed remote server for calling any AWS API, running sandboxed scripts, and searching AWS docs.
- A Cloudflare API MCP ServerOfficial hosted Cloudflare server that searches and calls the whole Cloudflare API (Workers, DNS, R2, D1, KV, firewall).
- A Netlify MCP ServerNetlify's official MCP server, hosted at mcp.netlify.com or run from npm, to create and deploy projects and manage env vars and secrets, forms, extensions and access controls.
- A Railway MCP (railway mcp in the Railway CLI)Railway's official MCP server, built into the Railway CLI and hosted at mcp.railway.com, to list projects and services, redeploy, and manage feature flags.
- A Render MCP ServerRender's official MCP server, hosted at mcp.render.com or run locally, to create services and databases, read logs and metrics, update environment variables and trigger deploys.
Embed this badge
[](https://trustedmcp.io/servers/proxmox-mcp-plus)<a href="https://trustedmcp.io/servers/proxmox-mcp-plus"><img src="https://trustedmcp.io/badge/proxmox-mcp-plus.svg" alt="TrustedMCP grade B" height="80"></a>Community reviews
Good, but read the permissions first
Took longer to configure than I expected. I gave it a database user that can only read the tables it needs. I would use it in prod, but only with a human approving writes.
Used for Managing preview environments
- Setup & docs 3/5
- Auth experience 2/5
- Reliability 3/5
- Maintainer responsiveness 3/5
Too much access for my comfort
Setup was rough and the result was flaky. Sign-in flow was painless and I never had to paste a key into a config file.
Used for Spinning up test resources
- Setup & docs 1/5
- Auth experience 3/5
- Reliability 3/5
- Maintainer responsiveness 3/5
Works, just lock it down
Good for experimenting, still deciding about production. The OAuth flow worked first time in Claude Code.
Used for Cost checks across projects
- Setup & docs 4/5
- Auth experience 2/5
- Reliability 4/5
- Maintainer responsiveness 4/5
Better than the DIY script it replaced
Been running this for about a month now. I like that access goes through a proper sign-in instead of a long-lived secret on disk. Keep permissions tight and it is a good tool.
Used for Checking deploy status from chat
- Setup & docs 4/5
- Auth experience 4/5
- Reliability 5/5
- Maintainer responsiveness 4/5
Handy for dev, careful in prod
I like it, with reservations. I like that access goes through a proper sign-in instead of a long-lived secret on disk. Filed an issue and got a reply within two days. Running it with the read-only flag and have not missed write access. Not something I would put in production yet.
Used for Inventory of what is running where
- Setup & docs 4/5
- Auth experience 3/5
- Reliability 3/5
- Maintainer responsiveness 5/5
Surprisingly polished
Set this up for our team after comparing a few options. Sign-in flow was painless and I never had to paste a key into a config file. I gave it a database user that can only read the tables it needs.
Used for Inventory of what is running where
- Setup & docs 5/5
- Auth experience 5/5
- Reliability 5/5
- Maintainer responsiveness 5/5
Worth the five minutes to set up
Tried it on a side project first, then rolled it out at work. The OAuth flow worked first time in Claude Code. You can tell it is actively maintained, the rough edges keep getting fixed.
Used for Managing preview environments
- Setup & docs 4/5
- Auth experience 5/5
- Reliability 3/5
- Maintainer responsiveness 3/5
Saves me a context switch every hour
Clear tool names, sensible outputs, very few surprises. Nice that it supports both stdio and HTTP, I use stdio locally and HTTP for the shared agent. I gave it a database user that can only read the tables it needs. Worth it, just do not skip the hardening steps.
Used for Reading logs during incidents
- Setup & docs 4/5
- Auth experience 3/5
- Reliability 3/5
- Maintainer responsiveness 4/5
Trustworthy enough for real work
Of the ProxmoxMCP-Plus integrations I tried, this one is the most predictable. The OAuth flow worked first time in Claude Code. I like that access goes through a proper sign-in instead of a long-lived secret on disk. It is in our production agent and I sleep fine.
Used for Checking deploy status from chat
- Setup & docs 5/5
- Auth experience 4/5
- Reliability 5/5
- Maintainer responsiveness 4/5
OK for read-only work
It does the job, but it took some tweaking. I gave it a database user that can only read the tables it needs. Updates land regularly, and nothing broke when I upgraded. Recommended, with sensible guardrails.
Used for Checking deploy status from chat
- Setup & docs 4/5
- Auth experience 3/5
- Reliability 3/5
- Maintainer responsiveness 4/5
Clean integration, sensible permissions
Hooked ProxmoxMCP-Plus into Claude Code and it worked on the first try. Sign-in flow was painless and I never had to paste a key into a config file. The Docker image made setup trivial and keeps it isolated. Fine in production if you sandbox it.
Used for Reading logs during incidents
- Setup & docs 3/5
- Auth experience 4/5
- Reliability 5/5
- Maintainer responsiveness 4/5
Does the job, docs could be better
Mostly reliable, with the odd timeout. Updates land regularly, and nothing broke when I upgraded. Running it in Docker keeps it away from the rest of my machine. Scoped the token to just what the agent needs and it respected that. For anything real I would look elsewhere.
Used for Cost checks across projects
- Setup & docs 2/5
- Auth experience 3/5
- Reliability 3/5
- Maintainer responsiveness 3/5
Easy win for our agent setup
Simple to set up in Cursor, simple to reason about. It is community maintained, so I pin the version and read the changelog before upgrading. Recommended, with sensible guardrails.
Used for Spinning up test resources
- Setup & docs 4/5
- Auth experience 5/5
- Reliability 4/5
- Maintainer responsiveness 3/5
Write a review
Ran this server? Tell other teams how it went. You get one review per server. We email you a link to confirm it, then an editor checks it before it goes up. We never show your email.