Proximo — the Proxmox MCP you can hand the keys
PYPI · PROXIMO-PROXMOX · SCANNED SEP 21
The Proxmox MCP you can hand the keys: VE/PBS/PMG/PDM. Plan, prove, undo, diagnose. MCP/A2A/API.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security50
- Malware scan not yet available for this package.Unverified
- No known CVEs affecting this package version or its production dependencies.Pass
- Runs hatchling.build at install time, a recognised native-build step with no shell scripting around it. View diagnostics → Pass
- 1 of 32 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency35
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- License check failed: no license is declared. See how to fix → Fail
- Actively maintained (last published 0 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability80
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 1175 tokens (~167/item across 7 items; 7 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage92
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 71% of tool parameters carry a description.Partial
- Structured output schemas are declared (29% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 7 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 7 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
How do I install the Proximo — the Proxmox MCP you can hand the keys server?
Proximo — the Proxmox MCP you can hand the keys runs locally as a PyPI package, launched with uvx proximo-proxmox. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
pypi · proximo-proxmox
claude mcp add john-broadway-proximo-proxmox -- uvx proximo-proxmox
{
"mcpServers": {
"john-broadway-proximo-proxmox": {
"command": "uvx",
"args": [
"proximo-proxmox"
]
}
}
} {
"servers": {
"john-broadway-proximo-proxmox": {
"command": "uvx",
"args": [
"proximo-proxmox"
]
}
}
} codex mcp add john-broadway-proximo-proxmox -- uvx proximo-proxmox
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"john-broadway-proximo-proxmox": {
"type": "local",
"command": [
"uvx",
"proximo-proxmox"
],
"enabled": true
}
}
} openclaw mcp add john-broadway-proximo-proxmox --command uvx --arg proximo-proxmox
mcp_servers:
john-broadway-proximo-proxmox:
command: "uvx"
args: ["proximo-proxmox"] {
"McpServers": {
"john-broadway-proximo-proxmox": {
"Transport": "stdio",
"Command": "uvx",
"Arguments": [
"proximo-proxmox"
]
}
}
} assistant mcp add john-broadway-proximo-proxmox -t stdio -c uvx -a proximo-proxmox
{
"mcpServers": {
"john-broadway-proximo-proxmox": {
"command": "uvx",
"args": [
"proximo-proxmox"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 21 Sept 26 +1
- Stability: 0.97 → pass security
- Schema quality: excellent → good functional
- Package version: 0.42.0 → 0.44.0 functional
- Package version: 0.42.0 → 0.43.0 functional
- 19 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 18 Sept 26 −2
- Stability: pass → 0.90 functional
- 17 Sept 26 −14
- Malware scan: pass → unverified ▼ security
- Stability: 0.97 → pass security
- Package version: 0.41.1 → 0.42.0 functional
- 16 Sept 26 +15
- Malware scan: unverified → pass ▲ security
- 15 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 13 Sept 26 −17
- Malware scan: pass → unverified ▼ security
- Stability: pass → 0.87 functional
- Package version: 0.40.0 → 0.41.1 functional
- Package version: 0.40.0 → 0.41.0 functional
- 11 Sept 26 +15
- Malware scan: unverified → pass ▲ security
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 21 Sept 2026 · Analysed pypi/proximo-proxmox@0.44.0
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | pypi |
Background: How many MCP packages publish verified provenance →
Install scripts 1 script
| Hook | Tier | Command |
|---|---|---|
| build_backend | allowlisted | hatchling.build |
Background: Why install scripts are a supply-chain risk →
Dependencies 32 packages
| Packages resolved | 32 |
|---|---|
| No linked repository | 1 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
audit_entries ~232
READ-ONLY: WHO changed WHAT and WHEN — guest configuration changes and every other audited action, read back from the PROVE ledger. Newest first. This is how you answer "who changed this guest" or "what has this caller done". `matched` counts entries passing your filters, `total` counts the whole ledger, and `truncated` says so when `limit` cut rows. An entry with no principal returns null plus a note: the ledger not capturing an identity is a fact about the log, never a claim that nobody was responsible. This READS the chain; `audit_verify` PROVES it is intact.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string|null | – | Only this exact tool name, e.g. 'pve_guest_config_set'. |
| limit | integer | – | Newest N entries to return (default 20). |
| mutations_only | boolean | – | Only entries that changed state. |
| principal | string|null | – | Only entries attributed to this caller id. |
| target | string|null | – | Only entries against this exact target, e.g. 'vmid=100'. |
No output schema declared.
No examples provided.
audit_verify ~144
Verify the tamper-evident audit ledger's hash chain — PROVE the log is intact. Pass `expected_head` (the head() value you pinned off-box) to also catch tail truncation, a forged tail-append, or a full file replacement — a forward walk alone can't see those. Falls back to PROXIMO_AUDIT_EXPECTED_HEAD when omitted.
| Name | Type | Req | Description |
|---|---|---|---|
| expected_head | string|null | – | 64-char hex head() value pinned off-box; verifying against it also catches tail truncation, a forged tail-append, or a full ledger replacement. Omit to fall back to PROXIMO_AUDIT_EXPECTED_HEAD. |
No output schema declared.
No examples provided.
proximo_call ~150
Call any Proximo tool by exact name, including ones not in this server's listed tools. Get the argument shape from proximo_tool_schema first. Same gates as calling it directly: dry-run PLAN, ledger entry, token ACL. A smaller doorway, not a looser one.
| Name | Type | Req | Description |
|---|---|---|---|
| arguments | – | – | The tool's arguments as an object, e.g. {'vmid': 100, 'action': 'reboot'}. Get the shape from proximo_tool_schema. Omit/null for a no-arg tool. |
| tool | string | yes | Exact tool name to run, e.g. 'pve_guest_power' (from proximo_find_tools). Non-resident names are fine. |
No output schema declared.
No examples provided.
proximo_find_tools ~168
Search Proximo's full tool catalog by keyword. ESTATE QUESTIONS FIRST: if the question is what exists, how many, what changed, or when something last happened, call proximo_recall instead — it answers from local memory in one call, with no search and no schema lookup, and it stamps how old the answer is. Come here for everything else. The facade is resident; 924 more tools on this server are searchable but not. Search for what you want ("guest power", "ceph pool", "firewall"), then call proximo_tool_schema on a result to get its arguments, then proximo_read (read-only tools) or proximo_call to run it. All terms must match.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | – |
| query | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | – | yes | – |
No examples provided.
proximo_read ~65
READ-ONLY: run a read-only Proximo tool by exact name; refuses anything that can mutate (use proximo_call for those). Same flow: get the shape from proximo_tool_schema first.
| Name | Type | Req | Description |
|---|---|---|---|
| arguments | – | – | – |
| tool | string | yes | – |
No output schema declared.
No examples provided.
proximo_recall ~383
READ-ONLY: the estate map from local Tier-1 memory — NOT a live PVE read. Returns total/by_kind/by_status/guest_summary counts (trust guest_summary for guest-count questions; all counting is server-side) plus lean entity rows, stamped {source:'memory', as_of, age_seconds}: the data is as old as the stamp says. With `since`, also diffs: appeared, status_changed, and not_seen_since (last observed before the window — a fact, not a claim the entity is gone). journal=N adds the newest N diagnosis digests ("when did this last happen") — findings summaries only, never raw diagnostic output. Memory is on by default (PROXIMO_MEMORY=0 opts out), fed opportunistically by list reads and diagnose/doctor runs, derived and rebuildable. For live state use pve_list_guests / pve_cluster_resources.
| Name | Type | Req | Description |
|---|---|---|---|
| detail | string | – | Row depth: `summary` (counts only), `lean` (default: identity + status), `full` (timestamps, prev_status). |
| journal | integer | – | Include the newest N diagnosis-journal entries (pve_diagnose / ct_diagnose / pve_doctor digests over time). 0 (default) omits the journal; `since` also windows it. |
| query | string|null | – | Optional filter, e.g. a guest name like 'gitea': rows narrow to the closest matches, counts still cover the whole estate. Always available; no configuration needed. Omit it to list every entity. |
| since | string|null | – | Optional change window: ISO8601 (`2026-07-29T00:00:00`) or relative (`24h`, `7d`). Adds appeared / status_changed / not_seen_since diffs. |
| Name | Type | Req | Description |
|---|---|---|---|
| result | object | yes | – |
No examples provided.
proximo_tool_schema ~33
Full description + JSON input schema for one tool found via proximo_find_tools.
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | yes | – |
No output schema declared.
No examples provided.
What is the Proximo — the Proxmox MCP you can hand the keys server?
Proximo — the Proxmox MCP you can hand the keys is listed in the public MCP registry as io.github.john-broadway/proximo-proxmox. The Proxmox MCP you can hand the keys: VE/PBS/PMG/PDM. Plan, prove, undo, diagnose. MCP/A2A/API. This page covers its PyPI package (proximo-proxmox).
Is the Proximo — the Proxmox MCP you can hand the keys server safe to use?
Proximo — the Proxmox MCP you can hand the keys scores 68 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 21 September 2026. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Proximo — the Proxmox MCP you can hand the keys server expose?
Proximo — the Proxmox MCP you can hand the keys exposes 7 tools: audit_entries, audit_verify, proximo_call, proximo_recall, proximo_find_tools, and 2 more. Their descriptions and schemas cost roughly 1,175 tokens of context every time the server is loaded.
Is the Proximo — the Proxmox MCP you can hand the keys server still maintained?
Proximo — the Proxmox MCP you can hand the keys is still listed as active in the MCP registry. We last reached this channel on 21 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.