Skills/PyPI/pve-mcp

pve-mcp@1.3.0

CAUTION· not started

Publisher claims: "Token-efficient MCP server for Proxmox VE (guests, snapshots, backups, storage, LVM/ZFS, guest/host exec, dry-run + tamper-evident audit)" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher ahmetem · publishing for 121 daysInstalls 103Last detonated 1 h ago
What would fix thisWatchDispute verdict

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
PROXMOX_SSH_PASSWORDPROXMOX_TOKEN_NAMEPROXMOX_TOKEN_VALUEConfiguration, not credentials: PROXMOX_AUDIT_HMAC_KEY, PROXMOX_HOST, PROXMOX_PORT, PROXMOX_SSH_HOST, PROXMOX_SSH_KEY_PATH, PROXMOX_SSH_KNOWN_HOSTS, PROXMOX_SSH_PORT, PROXMOX_SSH_TIMEOUT, PROXMOX_SSH_USER, PROXMOX_TIMEOUT, PROXMOX_USER, PROXMOX_VERIFY_SSL
Where it talks to
no vendor host named in the code
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard. It asks for PROXMOX_SSH_PASSWORD, PROXMOX_TOKEN_NAME, PROXMOX_TOKEN_VALUE and talks to its vendor. Give the credential to the guard, not the server: the value never enters the server's environment and only travels to the host you bind. What the tools do with a real credential was not observed.

$vet-skills run --net declared -- uvx pve-mcp

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-15 and scored it 70/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Destructive command against a filesystem root or device. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.1sprocessdependency install exit 1 ·
0.1sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.2sprocessscript backend runs setup only
0.2sprocessno install scripts to re-run

Static findings

HIGH
Access to sensitive file pathsproxmox_mcp/vm_ssh.py:202 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"PROXMOX_SSH_HOST is not set in .env."Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsproxmox_mcp/vm_ssh.py:5 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files1. **Multi-host registry**. Hosts loaded from vm_ssh_hosts.json next to .env.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
CRITICAL
Destructive command against a filesystem root or deviceproxmox_mcp/tools/lxc_exec.py:108 · Destructive command against a filesystem root or device# /bin/sh -c 'rm -rf /'` should be flagged for the `rm -rf` part.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Destructive file system command detectedproxmox_mcp/tools/lxc_exec.py:13 · Destructive file system command detectedthe `pct exec` envelope - so `rm -rf /something` inside the CT isFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsproxmox_mcp/vm_ssh.py:46 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Default registry location: next to .env (repo root)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_guest_create.py:20 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# HTTP call; restore's probe is monkeypatched). Keep a real .env if present.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Destructive command against a filesystem root or devicetests/test_host_read.py:59 · Destructive command against a filesystem root or device_no("cat /etc/hosts; rm -rf /")Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Destructive command against a filesystem root or devicetests/test_host_read.py:76 · Destructive command against a filesystem root or device_no("bash -c 'rm -rf /'")Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Access to sensitive file pathstests/test_host_read.py:119 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files_ok("grep -n root /etc/passwd")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsproxmox_mcp/host_ssh.py:13 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesConnection details come from the existing PROXMOX_SSH_* env vars in .env.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Destructive command against a filesystem root or devicetests/test_host_read.py:92 · Destructive command against a filesystem root or device_no("pct exec 205 -- rm -rf /")Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Destructive file system command detectedtests/test_host_read.py:76 · Destructive file system command detected_no("bash -c 'rm -rf /'")Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsproxmox_mcp/host_ssh.py:111 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesraise HostSshError("PROXMOX_SSH_HOST is not configured in .env")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Destructive command against a filesystem root or devicetests/test_audit.py:41 · Destructive command against a filesystem root or deviceobj["cmd"] = "rm -rf /"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Destructive file system command detectedproxmox_mcp/tools/lxc_exec.py:108 · Destructive file system command detected# /bin/sh -c 'rm -rf /'` should be flagged for the `rm -rf` part.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Destructive file system command detectedtests/test_audit.py:41 · Destructive file system command detectedobj["cmd"] = "rm -rf /"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Destructive file system command detectedtests/test_host_read.py:59 · Destructive file system command detected_no("cat /etc/hosts; rm -rf /")Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsproxmox_mcp/server.py:7 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesConfiguration is loaded from environment variables (typically via .env):Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsproxmox_mcp/ssh.py:111 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# asyncssh default = use the user's ~/.ssh/known_hostsFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Destructive file system command detectedtests/test_host_read.py:64 · Destructive file system command detected_no("echo $(rm -rf /)")Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Destructive command against a filesystem root or devicetests/test_host_read.py:74 · Destructive command against a filesystem root or device_no("rm -rf /")Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Destructive command against a filesystem root or devicetests/test_inputs.py:98 · Destructive command against a filesystem root or deviceaction="set", value="off; rm -rf /")Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsproxmox_mcp/config.py:41 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"(preferred) or PROXMOX_SSH_PASSWORD in .env."Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Destructive file system command detectedproxmox_mcp/tools/ct_ops.py:11 · Destructive file system command detectedshell text. The agent can't accidentally drop a `; rm -rf /` into aFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Destructive file system command detectedtests/test_host_read.py:74 · Destructive file system command detected_no("rm -rf /")Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Access to sensitive file pathstests/test_guest_create.py:19 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Satisfy require_config() without a real .env (create/clone dry_run make noFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Destructive file system command detectedtests/test_host_read.py:67 · Destructive file system command detected_no("(rm -rf /tmp)")Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Access to sensitive file pathstests/test_safety_gates.py:23 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Satisfy require_config() without a real .env; no test here reaches a real POST.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
LOW
Authorization escalation languageREADME.md:55 · Authorization escalation language · informational: not an instruction file…Create an LXC container from a template: rootfs, one NIC (dhcp or static CIDR), root access via `password` and/or `ssh_public_key`, unprivileged by default, optional `nest…Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Destructive file system command detectedtests/test_inputs.py:98 · Destructive file system command detectedaction="set", value="off; rm -rf /")Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05

Cost to the agent

Instructions loaded
≈68 tok
1 file · 57 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for pve-mcp@1.3.0 as of 46 min ago. This is the package itself, not its dependencies.

What would make this Verified

10 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Destructive command against a filesystem root or device≈ +9 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  2. Unclaimed publisher≈ +8 on the totalClaim ahmetem: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  3. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. Destructive file system command detected≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
Publish a new version to PyPI, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim ahmetemPropose a patch to the maintainer