ProxmoxMCP-Plus v0.6.8

Changes

• Advertise MCP readOnlyHint, destructiveHint, idempotentHint and
  openWorldHint annotations for all 65 built-in tools. Read-only queries can be
  distinguished from mutations by clients that support these hints.
• Correct classifications from #194:
  container resource updates are non-idempotent because repeated disk_gb calls
  keep growing the disk; backup creation is potentially destructive because
  mode=stop or mode=suspend interrupts guests. Guest starts are conservatively
  destructive because they change power state and launch workloads.
• Annotate Code Mode's three public tools: local search and schema lookup are
  read-only and closed-world; execution is potentially destructive,
  non-idempotent and open-world because it can invoke mutating domain tools.
• Keep explicit plugin annotations and leave unknown extensions unclassified.
  Target discovery and job listing are local; job observation tools may update
  local tracking/audit data but do not submit Proxmox mutations.

Annotations are advisory metadata, not authorization or automatic retry
permission. Existing read-only target enforcement, client permissions, command
policy and approval checks remain in effect. Clients must establish trust in a
server before relying on its annotations.

Upgrade

Install proxmox-mcp-plus==0.6.8 or pull
ghcr.io/rekklesna/proxmoxmcp-plus:0.6.8. Restart workers, recreate containers
using the new image and reconnect MCP clients to refresh tools/list.

No database migration or new configuration is required. Keep existing
configuration, credentials and job volumes. Downgrading to 0.6.7 removes the new
annotations; it does not reverse guest or storage operations already performed.

Validation

Regression tests demonstrate repeated disk growth and backup stop/suspend
forwarding with a mocked Proxmox API. Tests cover all registered annotations,
explicit overrides, unknown extensions, stdio discovery and Code Mode protocol
discovery. Release gates also check Python 3.11/3.12, complete runtime statement
coverage and critical-module branch coverage, Windows contracts, container
health/authentication, static analysis, dependency audits and built packages.
No live Proxmox guest operations are used for release validation.