Proxmox VE

Use an API token, not a password.

1. In the Proxmox web UI go to Datacenter → Permissions → API Tokens and add a token for a user — e.g. readonly@pve with token id amcp. Proxmox shows the secret once.
2. Leave Privilege Separation ticked and grant the token the PVEAuditor role at path /. PVEAuditor is read-everything, change-nothing, which is exactly what this adapter needs and all it can do.
3. Set PROXMOX_URL to https://your-host:8006, PROXMOX_TOKEN_ID to the full user@realm!tokenid string, and PROXMOX_TOKEN_SECRET to the secret.

The Authorization header is PVEAPIToken=user@realm!tokenid=secret — Proxmox's own scheme, with the whole triple in one header value. The adapter assembles it; a space in the wrong place is the usual cause of a 401.

Valid TLS is required, and a fresh Proxmox does not have it. Proxmox ships a self-signed certificate on port 8006, and this connector will refuse it — there is no trust-anything switch. Put a real certificate on the host (Proxmox has built-in ACME support under Node → Certificates) or put it behind a reverse proxy that has one.

Node names scope almost everything. /nodes/{node}/qemu lists the VMs on one node. proxmox_list_cluster_resources is the exception and the better starting point: it returns every VM, container and storage across the whole cluster in one call.

VM vs container. qemu is a full virtual machine, lxc is a container. They are separate collections with the same shape, and a question about 'all the machines' needs both — or proxmox_list_cluster_resources, which covers both.

Read-only by design: no start, no stop, no snapshot, no delete. Restarting production from a chat window should be a decision, not an autocomplete.

Self-hosted, which is the thing to plan for.

• On AnythingMCP Cloud the instance must be reachable from the public internet on a real hostname with a valid TLS certificate. A self-signed certificate will fail: the connector offers no trust-anything switch, and a homelab's default certificate is exactly the case that breaks.
• On an internal host (pve.intern, 10.0.0.x), self-host AnythingMCP on the same network and add that host to SSRF_ALLOWED_HOSTS, or the outbound guard refuses the call before it is made.