@nightsquawktech/proxmox-mcp-server 0.1.0

package/dist/catalog-pdm/endpoints/put_pve_remotes_remote_nodes_node_firewall_options.json

@@ -0,0 +1,276 @@
+{
+  "operationId": "put_pve_remotes_remote_nodes_node_firewall_options",
+  "surface": "pdm",
+  "resource": "pve",
+  "category": "PVE Remotes",
+  "name": "options",
+  "method": "PUT",
+  "path": "/pve/remotes/{remote}/nodes/{node}/firewall/options",
+  "description": "Update a nodes firewall configuration",
+  "writeOperation": true,
+  "destructive": false,
+  "protected": false,
+  "allowtoken": true,
+  "paramLocation": "body",
+  "pathParams": [
+    {
+      "name": "remote",
+      "type": "string",
+      "required": true,
+      "description": "Remote ID.",
+      "minLength": 2,
+      "maxLength": 32,
+      "pattern": "/^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$/"
+    },
+    {
+      "name": "node",
+      "type": "string",
+      "required": true,
+      "description": "Node name (or 'localhost')",
+      "pattern": "/^(?:[a-zA-Z0-9](?:[a-zA-Z0-9\\-]*[a-zA-Z0-9])?)$/"
+    }
+  ],
+  "params": [
+    {
+      "name": "delete",
+      "type": "array",
+      "required": false,
+      "description": "A list of settings you want to delete."
+    },
+    {
+      "name": "digest",
+      "type": "string",
+      "required": false,
+      "description": "Prevent changes if current configuration file has a different digest.\nThis can be used to prevent concurrent modifications.",
+      "maxLength": 64
+    },
+    {
+      "name": "enable",
+      "type": "boolean",
+      "required": false,
+      "description": "Enable host firewall rules.",
+      "default": true
+    },
+    {
+      "name": "log_level_forward",
+      "type": "string",
+      "required": false,
+      "description": "Firewall log levels.",
+      "enum": [
+        "emerg",
+        "alert",
+        "crit",
+        "err",
+        "warning",
+        "notice",
+        "info",
+        "debug",
+        "nolog"
+      ],
+      "default": "nolog"
+    },
+    {
+      "name": "log_level_in",
+      "type": "string",
+      "required": false,
+      "description": "Firewall log levels.",
+      "enum": [
+        "emerg",
+        "alert",
+        "crit",
+        "err",
+        "warning",
+        "notice",
+        "info",
+        "debug",
+        "nolog"
+      ],
+      "default": "nolog"
+    },
+    {
+      "name": "log_level_out",
+      "type": "string",
+      "required": false,
+      "description": "Firewall log levels.",
+      "enum": [
+        "emerg",
+        "alert",
+        "crit",
+        "err",
+        "warning",
+        "notice",
+        "info",
+        "debug",
+        "nolog"
+      ],
+      "default": "nolog"
+    },
+    {
+      "name": "log_nf_conntrack",
+      "type": "boolean",
+      "required": false,
+      "description": "Enable logging of conntrack information.",
+      "default": false
+    },
+    {
+      "name": "ndp",
+      "type": "boolean",
+      "required": false,
+      "description": "Enable NDP (Neighbor Discovery Protocol).",
+      "default": true
+    },
+    {
+      "name": "nf_conntrack_allow_invalid",
+      "type": "boolean",
+      "required": false,
+      "description": "Allow invalid packets on connection tracking.",
+      "default": false
+    },
+    {
+      "name": "nf_conntrack_helpers",
+      "type": "string",
+      "required": false,
+      "description": "Enable conntrack helpers for specific protocols. Supported protocols:\namanda, ftp, irc, netbios-ns, pptp, sane, sip, snmp, tftp",
+      "format": {
+        "description": "list",
+        "items": {
+          "description": "Firewall conntrack helper.",
+          "enum": [
+            "amanda",
+            "ftp",
+            "irc",
+            "netbios-ns",
+            "pptp",
+            "sane",
+            "sip",
+            "snmp",
+            "tftp"
+          ],
+          "type": "string"
+        },
+        "type": "array"
+      },
+      "default": "",
+      "typetext": "[<enum>, ...]"
+    },
+    {
+      "name": "nf_conntrack_max",
+      "type": "integer",
+      "required": false,
+      "description": "Maximum number of tracked connections.",
+      "default": 262144,
+      "minimum": 32768
+    },
+    {
+      "name": "nf_conntrack_tcp_timeout_established",
+      "type": "integer",
+      "required": false,
+      "description": "Conntrack established timeout.",
+      "default": 432000,
+      "minimum": 7875
+    },
+    {
+      "name": "nf_conntrack_tcp_timeout_syn_recv",
+      "type": "integer",
+      "required": false,
+      "description": "Conntrack syn recv timeout.",
+      "default": 60,
+      "minimum": 30,
+      "maximum": 60
+    },
+    {
+      "name": "nftables",
+      "type": "boolean",
+      "required": false,
+      "description": "Enable nftables based firewall (tech preview)",
+      "default": false
+    },
+    {
+      "name": "nosmurfs",
+      "type": "boolean",
+      "required": false,
+      "description": "Enable SMURFS filter.",
+      "default": false
+    },
+    {
+      "name": "protection_synflood",
+      "type": "boolean",
+      "required": false,
+      "description": "Enable synflood protection",
+      "default": false
+    },
+    {
+      "name": "protection_synflood_burst",
+      "type": "integer",
+      "required": false,
+      "description": "Synflood protection rate burst by ip src.",
+      "default": 1000
+    },
+    {
+      "name": "protection_synflood_rate",
+      "type": "integer",
+      "required": false,
+      "description": "Synflood protection rate syn/sec by ip src.",
+      "default": 200
+    },
+    {
+      "name": "smurf_log_level",
+      "type": "string",
+      "required": false,
+      "description": "Firewall log levels.",
+      "enum": [
+        "emerg",
+        "alert",
+        "crit",
+        "err",
+        "warning",
+        "notice",
+        "info",
+        "debug",
+        "nolog"
+      ],
+      "default": "nolog"
+    },
+    {
+      "name": "tcp_flags_log_level",
+      "type": "string",
+      "required": false,
+      "description": "Firewall log levels.",
+      "enum": [
+        "emerg",
+        "alert",
+        "crit",
+        "err",
+        "warning",
+        "notice",
+        "info",
+        "debug",
+        "nolog"
+      ],
+      "default": "nolog"
+    },
+    {
+      "name": "tcpflags",
+      "type": "boolean",
+      "required": false,
+      "description": "Filter illegal combinations of TCP flags.",
+      "default": false
+    }
+  ],
+  "returns": {
+    "type": "null"
+  },
+  "permissions": {
+    "check": {
+      "partial": false,
+      "path": [
+        "resource",
+        "{remote}"
+      ],
+      "privs": [
+        "Resource.Modify"
+      ]
+    }
+  },
+  "requestSample": "curl -k -X PUT -H 'Authorization: PDMAPIToken=USER@REALM!TOKENID=SECRET' -H 'Content-Type: application/json' \\\n  -d '{}' 'https://PDM_HOST:8443/api2/json/pve/remotes/<remote>/nodes/<node>/firewall/options'"
+}

package/dist/catalog-pdm/endpoints/put_pve_remotes_remote_qemu_vmid_firewall_options.json

@@ -0,0 +1,173 @@
+{
+  "operationId": "put_pve_remotes_remote_qemu_vmid_firewall_options",
+  "surface": "pdm",
+  "resource": "pve",
+  "category": "PVE Remotes",
+  "name": "options",
+  "method": "PUT",
+  "path": "/pve/remotes/{remote}/qemu/{vmid}/firewall/options",
+  "description": "Update QEMU firewall options",
+  "writeOperation": true,
+  "destructive": false,
+  "protected": false,
+  "allowtoken": true,
+  "paramLocation": "body",
+  "pathParams": [
+    {
+      "name": "remote",
+      "type": "string",
+      "required": true,
+      "description": "Remote ID.",
+      "minLength": 2,
+      "maxLength": 32,
+      "pattern": "/^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$/"
+    },
+    {
+      "name": "vmid",
+      "type": "integer",
+      "required": true,
+      "description": "A guest ID",
+      "minimum": 1
+    }
+  ],
+  "params": [
+    {
+      "name": "delete",
+      "type": "array",
+      "required": false,
+      "description": "A list of settings you want to delete."
+    },
+    {
+      "name": "dhcp",
+      "type": "boolean",
+      "required": false,
+      "description": "Enable DHCP.",
+      "default": false
+    },
+    {
+      "name": "digest",
+      "type": "string",
+      "required": false,
+      "description": "Prevent changes if current configuration file has a different digest.\nThis can be used to prevent concurrent modifications.",
+      "maxLength": 64
+    },
+    {
+      "name": "enable",
+      "type": "boolean",
+      "required": false,
+      "description": "Enable/disable firewall rules.",
+      "default": false
+    },
+    {
+      "name": "ipfilter",
+      "type": "boolean",
+      "required": false,
+      "description": "Enable default IP filters. This is equivalent to adding an empty\nipfilter-net<id> ipset for every interface. Such ipsets implicitly\ncontain sane default restrictions such as restricting IPv6 link local\naddresses to the one derived from the interface's MAC address. For\ncontainers the configured IP addresses will be implicitly added.",
+      "default": false
+    },
+    {
+      "name": "log_level_in",
+      "type": "string",
+      "required": false,
+      "description": "Firewall log levels.",
+      "enum": [
+        "emerg",
+        "alert",
+        "crit",
+        "err",
+        "warning",
+        "notice",
+        "info",
+        "debug",
+        "nolog"
+      ],
+      "default": "nolog"
+    },
+    {
+      "name": "log_level_out",
+      "type": "string",
+      "required": false,
+      "description": "Firewall log levels.",
+      "enum": [
+        "emerg",
+        "alert",
+        "crit",
+        "err",
+        "warning",
+        "notice",
+        "info",
+        "debug",
+        "nolog"
+      ],
+      "default": "nolog"
+    },
+    {
+      "name": "macfilter",
+      "type": "boolean",
+      "required": false,
+      "description": "Enable/disable MAC address filter.",
+      "default": true
+    },
+    {
+      "name": "ndp",
+      "type": "boolean",
+      "required": false,
+      "description": "Enable NDP (Neighbor Discovery Protocol).",
+      "default": true
+    },
+    {
+      "name": "node",
+      "type": "string",
+      "required": false,
+      "description": "Node name (or 'localhost')",
+      "pattern": "/^(?:[a-zA-Z0-9](?:[a-zA-Z0-9\\-]*[a-zA-Z0-9])?)$/"
+    },
+    {
+      "name": "policy_in",
+      "type": "string",
+      "required": false,
+      "description": "Firewall IO policies.",
+      "enum": [
+        "ACCEPT",
+        "DROP",
+        "REJECT"
+      ]
+    },
+    {
+      "name": "policy_out",
+      "type": "string",
+      "required": false,
+      "description": "Firewall IO policies.",
+      "enum": [
+        "ACCEPT",
+        "DROP",
+        "REJECT"
+      ]
+    },
+    {
+      "name": "radv",
+      "type": "boolean",
+      "required": false,
+      "description": "Allow sending Router Advertisement.",
+      "default": false
+    }
+  ],
+  "returns": {
+    "type": "null"
+  },
+  "permissions": {
+    "check": {
+      "partial": false,
+      "path": [
+        "resource",
+        "{remote}",
+        "guest",
+        "{vmid}"
+      ],
+      "privs": [
+        "Resource.Modify"
+      ]
+    }
+  },
+  "requestSample": "curl -k -X PUT -H 'Authorization: PDMAPIToken=USER@REALM!TOKENID=SECRET' -H 'Content-Type: application/json' \\\n  -d '{}' 'https://PDM_HOST:8443/api2/json/pve/remotes/<remote>/qemu/0/firewall/options'"
+}

package/dist/catalog-pdm/endpoints/put_pve_remotes_remote_qemu_vmid_snapshot_snapname_config.json

@@ -0,0 +1,74 @@
+{
+  "operationId": "put_pve_remotes_remote_qemu_vmid_snapshot_snapname_config",
+  "surface": "pdm",
+  "resource": "pve",
+  "category": "PVE Remotes",
+  "name": "config",
+  "method": "PUT",
+  "path": "/pve/remotes/{remote}/qemu/{vmid}/snapshot/{snapname}/config",
+  "description": "Update a remote qemu vm snapshot's description. This is synchronous (no worker task).",
+  "writeOperation": true,
+  "destructive": false,
+  "protected": false,
+  "allowtoken": true,
+  "paramLocation": "body",
+  "pathParams": [
+    {
+      "name": "remote",
+      "type": "string",
+      "required": true,
+      "description": "Remote ID.",
+      "minLength": 2,
+      "maxLength": 32,
+      "pattern": "/^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$/"
+    },
+    {
+      "name": "vmid",
+      "type": "integer",
+      "required": true,
+      "description": "A guest ID",
+      "minimum": 1
+    },
+    {
+      "name": "snapname",
+      "type": "string",
+      "required": true,
+      "description": "The name of the snapshot",
+      "maxLength": 40,
+      "pattern": "/^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$/"
+    }
+  ],
+  "params": [
+    {
+      "name": "description",
+      "type": "string",
+      "required": false,
+      "description": "A textual description or comment."
+    },
+    {
+      "name": "node",
+      "type": "string",
+      "required": false,
+      "description": "Node name (or 'localhost')",
+      "pattern": "/^(?:[a-zA-Z0-9](?:[a-zA-Z0-9\\-]*[a-zA-Z0-9])?)$/"
+    }
+  ],
+  "returns": {
+    "type": "null"
+  },
+  "permissions": {
+    "check": {
+      "partial": false,
+      "path": [
+        "resource",
+        "{remote}",
+        "guest",
+        "{vmid}"
+      ],
+      "privs": [
+        "Resource.Manage"
+      ]
+    }
+  },
+  "requestSample": "curl -k -X PUT -H 'Authorization: PDMAPIToken=USER@REALM!TOKENID=SECRET' -H 'Content-Type: application/json' \\\n  -d '{}' 'https://PDM_HOST:8443/api2/json/pve/remotes/<remote>/qemu/0/snapshot/<snapname>/config'"
+}

package/dist/catalog-pdm/endpoints/put_remotes_remote_id.json

@@ -0,0 +1,84 @@
+{
+  "operationId": "put_remotes_remote_id",
+  "surface": "pdm",
+  "resource": "remotes",
+  "category": "Remotes",
+  "name": "{id}",
+  "method": "PUT",
+  "path": "/remotes/remote/{id}",
+  "description": "List all the remotes this instance is managing.",
+  "writeOperation": true,
+  "destructive": false,
+  "protected": false,
+  "allowtoken": true,
+  "paramLocation": "body",
+  "pathParams": [
+    {
+      "name": "id",
+      "type": "string",
+      "required": true,
+      "description": "Remote ID.",
+      "minLength": 2,
+      "maxLength": 32,
+      "pattern": "/^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$/"
+    }
+  ],
+  "params": [
+    {
+      "name": "authid",
+      "type": "string",
+      "required": false,
+      "description": "Authentication ID",
+      "minLength": 3,
+      "maxLength": 64,
+      "pattern": "/^(?:(?:[^\\s:/[:cntrl:]]+)@(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)|(?:[^\\s:/[:cntrl:]]+)@(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)!(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*))$/"
+    },
+    {
+      "name": "delete",
+      "type": "array",
+      "required": false,
+      "description": "List of properties to delete."
+    },
+    {
+      "name": "digest",
+      "type": "string",
+      "required": false,
+      "description": "Prevent changes if current configuration file has different SHA256 digest. This can be used to prevent concurrent modifications.",
+      "pattern": "/^[a-f0-9]{64}$/"
+    },
+    {
+      "name": "nodes",
+      "type": "array",
+      "required": false,
+      "description": "A list of cluster node addresses."
+    },
+    {
+      "name": "token",
+      "type": "string",
+      "required": false,
+      "description": "The access token's secret."
+    },
+    {
+      "name": "web-url",
+      "type": "string",
+      "required": false,
+      "description": "Configuration for the Web UI URL link generation."
+    }
+  ],
+  "returns": {
+    "type": "null"
+  },
+  "permissions": {
+    "check": {
+      "partial": false,
+      "path": [
+        "resource",
+        "{id}"
+      ],
+      "privs": [
+        "Resource.Modify"
+      ]
+    }
+  },
+  "requestSample": "curl -k -X PUT -H 'Authorization: PDMAPIToken=USER@REALM!TOKENID=SECRET' -H 'Content-Type: application/json' \\\n  -d '{}' 'https://PDM_HOST:8443/api2/json/remotes/remote/<id>'"
+}

package/dist/catalog-pdm/enrichment/delete_access_tfa_userid_id.json

@@ -0,0 +1,28 @@
+{
+  "operationId": "delete_access_tfa_userid_id",
+  "usageNotes": "Use this to permanently remove a specific TFA entry (TOTP, WebAuthn, recovery key, etc.) from a user account. Either an admin with Access.Modify privilege or the user themselves can call this — the optional password parameter is required by the server when the caller is self-managing and root@pam is not the requestor (server-side enforcement varies by realm). Obtain the entry id first via the corresponding GET /access/tfa/{userid} list call.",
+  "examples": [
+    {
+      "summary": "Remove a TOTP entry from a domain user's account",
+      "path_params": {
+        "userid": "jsmith@pve",
+        "id": "totp-abc12345"
+      },
+      "params": {
+        "password": "hunter2"
+      }
+    }
+  ],
+  "destructiveReason": "Permanently deletes the TFA entry; the user will lose access to that second factor immediately and cannot recover it.",
+  "tips": [
+    "Retrieve the full list of a user's TFA entries with GET /access/tfa/{userid} before deleting to confirm the correct id.",
+    "If the user has only one TFA entry and the realm enforces MFA, removing it may lock the user out — verify realm policy first.",
+    "API tokens (allowtoken: true) are permitted to make this call, so automation scripts can remove stale keys during offboarding."
+  ],
+  "relatedOperations": [
+    "get_access_tfa_userid",
+    "post_access_tfa_userid",
+    "put_access_tfa_userid_id",
+    "get_access_tfa_userid_id"
+  ]
+}

package/dist/catalog-pdm/enrichment/delete_access_ticket.json

@@ -0,0 +1,21 @@
+{
+  "operationId": "delete_access_ticket",
+  "usageNotes": "Invalidates the current session ticket, effectively logging out the authenticated user. No parameters are required — the session is identified by the Authorization header or cookie present in the request. Call this when a management session is complete to avoid leaving active credentials on the server.",
+  "examples": [
+    {
+      "summary": "Logout the current PDM session",
+      "path_params": {},
+      "params": {}
+    }
+  ],
+  "destructiveReason": "Permanently invalidates the active session ticket, requiring re-authentication for any further API access.",
+  "tips": [
+    "Returns null on success — a 200 with an empty/null body is expected and correct.",
+    "API token-based callers are not affected by session expiry, but calling this endpoint with a token still succeeds (no-op on the token itself).",
+    "If the ticket is already expired or invalid, the endpoint may still return 200 — do not rely on an error response to detect double-logout."
+  ],
+  "relatedOperations": [
+    "post_access_ticket",
+    "get_access_ticket"
+  ]
+}

package/dist/catalog-pdm/enrichment/delete_access_users_userid.json

@@ -0,0 +1,27 @@
+{
+  "operationId": "delete_access_users_userid",
+  "usageNotes": "Use this to permanently remove a user account from the PDM configuration. Requires the `Access.Modify` privilege on `/access/users`, or the user may self-delete. Pass the `digest` parameter (obtained from the corresponding GET) to guard against concurrent modifications overwriting an unseen change.",
+  "examples": [
+    {
+      "summary": "Delete a local PDM user account",
+      "path_params": {
+        "userid": "jsmith@pdc"
+      },
+      "params": {
+        "digest": "a3f1c2e4b5d6a7f8e9c0b1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2"
+      }
+    }
+  ],
+  "destructiveReason": "Permanently removes the user account from the PDM configuration; all associated tokens and permissions granted to that user are also lost.",
+  "tips": [
+    "The userid format must match `<name>@<realm>` (e.g., `admin@pdc`); the pattern enforces this.",
+    "Supplying `digest` prevents silent overwrites when another operator modifies the user list concurrently — always fetch it from a prior GET /access/users/{userid} call.",
+    "This operation returns null on success; any non-2xx response indicates failure."
+  ],
+  "relatedOperations": [
+    "get_access_users_userid",
+    "post_access_users",
+    "put_access_users_userid",
+    "get_access_users"
+  ]
+}