ProxmoxMCP-Plus v0.5.19

Release date: 2026-09-21

Code Mode (#130)

Optional mcp.code_mode: true / MCP_CODE_MODE=true exposes search, schema and
sandbox execution tools. The default full catalog is unchanged. Discovery uses
registered, filtered tools and works in installed distributions. Actual MCP
protocol dispatch blocks direct hidden-tool calls. Sandbox tool results are
serialized as JSON; existing validation, target routing, read-only restrictions
and approval policies remain authoritative. Includes pinned Monty runtime and
real execution/protocol regression tests. Script failure does not roll back tool
side effects; do not blindly retry mutation scripts.

ISO media and guest networking (#131)

• create_vm: optional iso_volume, cdrom_device (default ide3) and
  boot_order. With an ISO, boot defaults to CD-ROM before disk.
• update_vm_config: mount/change/eject ISO media, configure boot order and
  change net0 bridge without losing MAC, VLAN or firewall options. Existing
  disks and cloud-init drives cannot be overwritten. iso_volume="none" ejects.
• create_container: optional static IPv4/IPv6 and gateways; DHCP remains the
  IPv4 default. LXC containers continue to use OS templates rather than ISOs.
• New update_container_network: edit bridge/address/gateway fields on an
  existing net0..net31, preserving unspecified settings and using the Proxmox
  configuration digest to detect concurrent edits. An empty gateway removes it;
  selecting an automatic/manual address mode clears its old gateway.

Media/bridge edits need configuration-read privileges (VM.Audit) in addition
to the relevant write privileges. Existing VM sizing/cloud-init-only updates
retain their previous write-only path. Network changes may interrupt guest
connectivity. Both edit tools obey selected-target read-only and approval policy.
Add update_container_network to custom high-risk lists and explicit allowlists.
The existing audit-only operation-policy default is unchanged.

Native HTTP authentication and release consistency (#132)

Native Streamable HTTP and SSE require MCP_API_KEY by default. Deployments with
external access controls can explicitly allow keyless operation with
MCP_ALLOW_UNAUTHENTICATED_HTTP=true or mcp.allow_unauthenticated_http: true.
A configured key is still enforced even when this option is enabled. The option
does not establish or verify Tailscale/reverse-proxy access controls, alter
OpenAPI authentication, or disable DNS rebinding protection. STDIO is unaffected.
Streamable HTTP startup no longer silently falls back to a different transport.

The v0.5.18 Git tag retained 0.5.17 metadata and did not contain the mandatory-key
change present in the published 0.5.18 source archive. This release commits the
complete implementation, aligns all five metadata surfaces, and checks release
tags and built package versions before publication. Historical tags are unchanged.

Upgrade

Install proxmox-mcp-plus==0.5.19 or pull
ghcr.io/rekklesna/proxmoxmcp-plus:0.5.19, restart, and reconnect MCP clients.
Configure an HTTP key or the explicit externally protected opt-out before starting
native HTTP. No database migration is required. See the README for examples.

Validation and limits

Regression coverage exercises the sandbox, MCP dispatch, target/approval checks,
HTTP startup and authentication, ISO payloads, network preservation, and release
metadata. CI runs Python 3.11 and 3.12, Ruff, Mypy, package checks, dependency audit,
and CodeQL. Guest changes are validated against mocked Proxmox API contracts;
no live VM/container is created or modified during these tests.

Rolling back removes the new options and tool; remove them from configuration
and allowlists first. Guest configuration changes already made are not undone.