Named for Proximo, the lanista ofGladiator.The story is the design, joint for joint.

He armed his fighter with exactly what he needed, never more. He answered for every move in the arena. A lanista, not a jailer. The Spaniard earns his name by conduct, on the record, and the helmet comes off: truth said plainly, at cost. His last act opened the cages, holding the wooden sword of his own freedom.A tool should hope to end that well.

"Win the crowd and you will win your freedom."

The others make you pick: a read-only toy, or full keys and pray. Proximo won't. Every dangerous move isplanned: see the blast radius first. Every move isproven: a tamper-evident record. Andundoable wherever the platform gives us a primitive: a config change hands back the exact prior state, and a risky in-container command can take a snapshot first, and refuses to run if it can't.

Trust built into the substrate, not bolted on after.Hand an AI agent the keys; keep the receipts.

Sovereign and agent-agnostic.Your metal, your token, a ledger you own. No cloud, no phone-home, no standing server unless you opt in.

Ask, in plain English:"why is ct 105 thrashing?"An AI agent pulls node and guest status, tails the logs, and runs a diagnosticinsidethe container to find out.

If there's a fix, it shows you the plan before it touches anything. Takes a snapshot first if you ask it to, and won't run if it can't. Applies. Hands you a signed receipt of exactly what changed.

That's the product:a hypervisor an AI can operate without being able to wreck it.

Read-only by default. No mutation runs on the first call: it returns its blast radius as a plan for you to see first. A tamper-evident receipt for every change.

The comparison isn't Proximo vs. the GUI. It'sProximo vs. handing an LLM your root token and hoping.

# 1. The tool count is real. Ask the server itself, cold (=> 906). # (in a clone of this repo, after uv sync) uv run python -c "import asyncio; from proximo import server; \ print(len(asyncio.run(server.mcp.list_tools())))" # 2. The container image is what the repo built. Sigstore provenance (exit 0 = verified): gh attestation verify oci://ghcr.io/john-broadway/proximo:latest --owner john-broadway # 3. The security posture is graded by a third party, not by us: # https://scorecard.dev/viewer/?uri=github.com/john-broadway/proximo

The Proxmox MCP landscape is split.API-based serversmanage nodes and VMs but structurallycannotrun a command inside an LXC: the REST API has no exec endpoint.SSH-based serverscan, through broad shell access with little scoping.

Proximo builds the principled whole. Both halves, one audited surface, least-privilege.Trust by construction:

(The archetype columns describe the split above, not any specific project. There is no official Proxmox MCP; Proximo is a community project, standing on its own.)

The trust layer: what makes Proximo different

The spine has six pillars. Four stand by default:

Two areyours to raise, by design, off until their state paths exist, because both are only worth having if those paths sit outside the agent's reach. A pillar Proximo raised for you would be a pillar the agent could lower for itself:

Those backends are deliberately boring. Anyone can call them.The product is the trust layer over them.

906 tools is an estate, not a starting point, and you only carry the part you use. Since 0.30 the floor IS the default: a bare install serves the search-and-call facade (~1,449 tokens of context) with every tool this box serves still callable; one domain likepve.guestsruns ~9,123, a whole plane ~97,432,PROXIMO_TOOLSETS=catalogthe classic auto-scoped catalog.The estate is 906. The doorway is yours to size.Coverage and context stopped being the same number.

New in 0.35.0 (the sibling planes, on measured vocabulary).pbs_tasks_list,pmg_tasks_listandpdm_tasks_listreturn the same{returned, by_outcome, tasks}envelope PVE got in 0.34.0, classified server-side from each raw row. Every plane's vocabulary was live-probed first, and they disagree: PBS and PDM name their columnsworker_type/worker_idwhere PVE and PMG saytype/id, so the lean field set is per plane. PMG never produced a failing row across four honest attempts, so its vocabulary is documented as unobserved rather than known. Details in the CHANGELOG.

Recent:0.34.0gavepve_tasks_listthat envelope first, and put one task-outcome classifier repo-wide.

Proximo runson your machine, on demand. No daemon, no open port.

- The whole cluster in one call.pve_cluster_resources: every VM, node, storage pool, SDN object.
- One tamper-evident record across every node."Show me every state-changing action this month, and prove the log wasn't touched"becomes a query you can actually answer. No human at the CLI walks away with that.
- Where the time comes back.On one node a senior at the CLI is faster, and that's fine. Across a dozen nodes and hundreds of guests, abounded, auditedagent earns its keep.

"Are you not entertained?"*Stars, issues, and sparring partners welcome.Strength and honor.⚔️

Navigate your Aiven projects and interact with the PostgreSQL®, Apache Kafka®, ClickHouse® and OpenSearch® services

Yunxiao MCP Server provides AI assistants with the ability to interact with the Yunxiao platform.

Get prescriptive CDK advice, explain CDK Nag rules, check suppressions, generate Bedrock Agent schemas, and discover AWS Solutions Constructs patterns.

This AWS Labs Model Context Protocol (MCP) server for CloudTrail enables your AI agents to query AWS account activity for security investigations, compliance auditing, and operational troubleshooting.

Core AWS MCP server providing prompt understanding and server management capabilities.

Analyze CDK projects to identify AWS services used and get pricing information from AWS pricing webpages and API.

Query and analyze your Axiom logs, traces, and all other event data in natural language

Manage and interact with Microsoft Azure services.

Bastion: External Attack Surface Monitoring

Ask your AI assistant about your attack surface: run scans, catch expiring certificates and domains, triage findings, and generate reports.