ProxmoxMCP-Plus v0.5.15

Release date: 2026-09-04

Named Proxmox targets

Configure multiple Proxmox environments in a targets map and select the destination
with the target tool argument. list_targets provides credential-free discovery.
Each target has its own API/SSH configuration, job database, read-only setting, and
command policy. Requests must select a target when the configuration is ambiguous.

Named targets work in stdio, native MCP HTTP, and OpenAPI, including the default Docker
runtime. Direct OpenAPI /jobs routes accept target as a query parameter and enforce
the selected target's read-only and retry-approval policies. The MCP subprocess owns
managed API tunnels; the OpenAPI process reuses the endpoint without taking ownership.

Optional tool filtering — #102

Use JSON configuration:

{
  "mcp": {
    "tool_allowlist": ["list_targets", "get_nodes", "get_vms", "get_storage"]
  }
}

Or set a comma-separated environment variable:

MCP_TOOL_ALLOWLIST=list_targets,get_nodes,get_vms,get_storage

tool_denylist and MCP_TOOL_DENYLIST are supported as the alternative mode. Do not
configure both modes. An environment filter replaces the file-level filter mode.
Explicitly empty allowlists expose no tools; empty denylists hide none. Unknown names,
malformed names, and empty CSV entries such as , or get_nodes, stop startup.

Filtering happens before registration: hidden schemas do not appear in MCP tools/list
or generated OpenAPI tool routes, and hidden MCP tools cannot be invoked. The full
catalog contains 50 tools; capability checks still apply. Filtering does not disable
direct operational OpenAPI routes or replace authentication and Proxmox RBAC.

Safety and compatibility

• Legacy single-target configuration and unfiltered tool schemas are preserved.
• Existing untargeted jobs remain accessible when using legacy configuration.
• Named targets do not inherit another target's jobs, SSH connection, or command policy.
• Ambiguous global/target settings and conflicting tunnel endpoints are rejected.
• External tunnels are never started or stopped by the server, including when their listener is unavailable.
• Credential redaction handles quoted values, whitespace, and escaped quotes without the earlier pathological regular-expression slowdown.
• Named-target SQLite databases and their WAL/SHM files are excluded from Git and Docker build contexts.
• Persisted retry recipes remain credential-free; retries needing secrets may require a new invocation after a restart.

Documentation — #120

The Integrations Guide includes a maintainer-reviewed fork of the Jetson Orin Nano,
Ollama, and Open WebUI community guide. The guide preserves nroam's attribution and
MIT License and documents its tested versions, credential boundaries, read-only RBAC,
TLS verification, and loopback network bindings. It remains a version-specific
community resource rather than a claim of new live deployment validation.

Upgrade and validation

Upgrade with pip install --upgrade proxmox-mcp-plus==0.5.15 or the GHCR 0.5.15 image.
Back up configuration and job databases, then restart the server and reconnect clients
to refresh cached schemas. Keep authentication, TLS, ingress restrictions, and Proxmox
permissions in place when narrowing the exposed tool set.

Validation covers Python 3.11/3.12 CI, the unchanged 75% coverage gate, Ruff, mypy,
CodeQL, dependency auditing, build/metadata checks, real stdio tool discovery, and local
OpenAPI-to-MCP subprocess checks with target selection and read-only enforcement.
The local protocol checks use non-live targets and do not mutate Proxmox infrastructure.
Publication additionally verifies PyPI, the MCP Registry, multi-architecture GHCR images,
and native ARM64 application health.

To roll back to 0.5.14, restore a legacy single-target configuration: that version
does not understand named targets or tool filters. Preserve database backups and retain
external access restrictions before removing these application-level controls.