Home

Proximo

The Proxmox MCP/A2A you can hand the keys. One audited trust core over Proxmox VE, Backup Server, Mail Gateway, and Datacenter Manager — so an AI agent can operate your infrastructure, not just read it, without you holding your breath.

Most Proxmox MCP servers make you choose: a safe read-only inspector, or a loaded gun pointed at a cluster you care about. Proximo refuses the trade. Write access here isn't "trust the AI to do the right thing" — it's the AI proposes a previewed, bounded, reversible, recorded change, inside a scope you granted.

uvx proximo-proxmox doctor      # read-only preflight — see what a token can and can't do

Start here

• Quickstart — install, mint a read-only token, verify your boundary, wire it into your AI client.
• The Trust Spine — PLAN · PROVE · UNDO · DIAGNOSE, and the two layers that don't fail the same way.
• Security Model — the honest version: what protects you, what's opt-in, and what this is not.
• Certificate Pinning — pin any Proxmox box by its certificate (new in 0.15.0).
• Four Surfaces — VE, PBS, PMG, PDM on one control plane, one instance reaching many boxes.
• Configuration — every PROXIMO_* setting, what it does, and its default.
• FAQ — "isn't handing keys to an AI dangerous?" and other fair questions.

The one idea

Trust by construction, not by hope. Every mutation carries a plan you see first, a tamper-evident record, and a rollback where Proxmox allows one — and underneath all of it, a Proxmox RBAC token that Proximo cannot exceed, because Proxmox enforces it server-side, not Proximo's own code. Start read-only. Grant scoped write only when you're ready.

Honest by default

Proximo is pre-1.0 and says so. Risk ratings are an advisory heuristic, not a sandbox. The opt-in controls are inert until you configure them. Where something is unproven or bounded, the docs say it plainly — see Security Model for the full framing. This is defense in depth for AI-driven infrastructure ops, not a magic box.

---

Source & releases: github.com/john-broadway/proximo · PyPI proximo-proxmox · Apache-2.0