Proximo - The Proxmox MCP/A2A you can hand the keys — VE + Backup Server + Mail Gateway + Datacenter Manager on one audited trust core

B

broadway

Member
Jun 20, 2026
31
0
6
john-broadway.github.io
I'd like to thank everyone that played around with the previous version of Proximo. I'd also like to PRE-THANK all of you that are going to play with Proximo. The biggest thing I'd like from this community is not at face buyin -- Im asking you to BEAT IT UP AT ITS FACE. I want to bring something that is a value and SAFE. I believe AI needs governance and we all have to acknowledge its here to stay. My bet is on the governance by construction and the TRUST PILLARS I've designed. My thesis is this.. https://github.com/john-broadway/proximo

So again, thank you all for being a part of this time in my life. Almost thought it was over until I found a way to get my ideas out of this old head.

Service Connected Disabled Veteran. Systems Thinker. Builder of Proximo - The Proxmox MCP you can hand the keys — VE + Backup Server + Mail Gateway + Datacenter Manager on one audited trust core (plan · prove · undo · diagnose). MCP + A2
 
Why did you open a new thread and why didn't you link the old one with it's critism?

I still think that handing the keys to a vibecoded ai agent is a bad idea

B

Thread '[Community project] Proximo — an open-source, least-privilege MCP/API layer for managing PVE with an AI agent (feedback wanted)'

Hi all — sharing an open-source side project for feedback from people who actually run Proxmox in anger. It's a community project, not affiliated with Proxmox, and this isn't a support request — I'm after criticism of the approach.

What it is: Proximo is a small server that lets an AI agent (or any MCP/A2A client) manage a PVE cluster through the REST API with a scoped API token. It does not touch the hypervisor directly and is API-only by default. Safety was the design priority, because handing an LLM access to a hypervisor is obviously risky.

What that looks like in practice:

-...
 
Last edited:
  • Like
Reactions: gurubert and uzumo
Johannes S said:
Why did you open a new thread and why didn't you link the old one with it's critism?

I still think that handing the keys to a vibecoded ai agent is a bad idea

B

Thread '[Community project] Proximo — an open-source, least-privilege MCP/API layer for managing PVE with an AI agent (feedback wanted)'

Hi all — sharing an open-source side project for feedback from people who actually run Proxmox in anger. It's a community project, not affiliated with Proxmox, and this isn't a support request — I'm after criticism of the approach.

What it is: Proximo is a small server that lets an AI agent (or any MCP/A2A client) manage a PVE cluster through the REST API with a scoped API token. It does not touch the hypervisor directly and is API-only by default. Safety was the design priority, because handing an LLM access to a hypervisor is obviously risky.

What that looks like in practice:

-...
Click to expand...

The thread: you want the criticism?

Here's the whole thing, all 46 replies, nothing trimmed: [PROXIMO COMMUNITY PROJECT]

I didn't start fresh to hide from it — that thread was the old version and an API-only pitch, this is a different animal across four surfaces, but you're right that I should've linked it myself, so there it is, read it, bring the best hits back here so you and I can still banter.

"Handing the keys to a vibecoded AI agent is a bad idea." No #&$) Sherlock. It IS a bad idea. That's the whole reason Proximo exists. I don't trust the agent. I don't trust mine. I built the thing assuming the agent is careless, hijacked, or dead wrong — and then I put the floor somewhere it can't touch: your Proxmox RBAC token. Enforced by Proxmox, server-side, not by one line of my code. Point it at a read-only token and it physically cannot mutate a thing, no matter how badly the model behaves or who's driving it.

Above that floor: nothing changes without a plan you see first, a tamper-evident record, and a rollback where Proxmox allows one. Not because the AI earned trust. Because it never gets any.

So quit telling me it's a bad idea — I know, I designed around it. Go prove it. Read-only token, a node you don't care about, and try to make Proximo do one thing that token forbids. You can't. If you can, that's a bug and I'll fix it in the open with your name on it. That's the review I want. Not applause — the beating.

And yeah — I build with AI, out loud, no shame in it. That's exactly why I made damn sure the safety doesn't ride on trusting it.

I didn't crawl back to this out of an old head to be liked. I came back to be tested. You've been swinging at the thread, now Swing at the code.


Builder of Proximo - The Proxmox MCP you can hand the keys — VE + Backup Server + Mail Gateway + Datacenter Manager on one audited trust core (plan · prove · undo · diagnose). MCP + A2A
 
You must log in or register to reply here.
Top Bottom
Back