@nightsquawktech/proxmox-mcp-server 0.1.0

package/dist/catalog-pdm/enrichment/get_pbs_remotes_remote_status.json

@@ -0,0 +1,25 @@
+{
+  "operationId": "get_pbs_remotes_remote_status",
+  "usageNotes": "Use this to check the live health of a PBS remote node registered in PDM — including CPU load, memory, root disk usage, uptime, kernel, and boot mode. The remote must be reachable over the network and the caller needs `Resource.Audit` on `/resource/{remote}`; calls to an offline or unreachable remote will fail rather than return cached data. Query this before scheduling backup jobs or troubleshooting a remote that appears degraded.",
+  "examples": [
+    {
+      "summary": "Get status for a remote named 'pbs-hetzner'",
+      "path_params": {
+        "remote": "pbs-hetzner"
+      },
+      "params": {}
+    }
+  ],
+  "tips": [
+    "The `cpu` field is a fractional value (0.0–1.0) representing utilization since the last query — multiply by 100 for a percentage.",
+    "Memory and root disk values are in bytes; divide by 1073741824 for GiB.",
+    "`loadavg` returns a three-element array: 1-minute, 5-minute, and 15-minute averages.",
+    "`kversion` is the legacy string form of the kernel version; prefer `current-kernel` for structured access.",
+    "The `info.fingerprint` field contains the PBS node's SSL fingerprint — useful for verifying identity during initial remote setup."
+  ],
+  "relatedOperations": [
+    "get_pbs_remotes",
+    "get_pbs_remotes_remote",
+    "get_pbs_remotes_remote_datastores"
+  ]
+}

package/dist/catalog-pdm/enrichment/get_pbs_remotes_remote_tasks.json

@@ -0,0 +1,24 @@
+{
+  "operationId": "get_pbs_remotes_remote_tasks",
+  "usageNotes": "Use this to audit or monitor task history on a PBS remote registered in PDM — useful for verifying that backup/sync/verify jobs completed and identifying failures by checking the 'status' field. The caller must hold Resource.Audit on the remote resource path; the remote must already be configured in PDM via its remote ID. Because there are no query filter params, all tasks are returned at once, so callers should filter client-side by worker_type, starttime, or status as needed.",
+  "examples": [
+    {
+      "summary": "List all tasks for a PBS remote named 'hetzner-pbs'",
+      "path_params": {
+        "remote": "hetzner-pbs"
+      },
+      "params": {}
+    }
+  ],
+  "tips": [
+    "The 'upid' field is a Unique Process ID that encodes node, PID, start time, worker type, and auth entity — it can be used with task-log endpoints on the PBS node itself to fetch full task output.",
+    "Tasks still in progress will have no 'endtime' or 'status' field; poll until both appear to confirm completion.",
+    "The 'worker_type' field identifies the job kind (e.g. 'backup', 'verify', 'sync', 'prune') — filter on this to narrow results to a specific operation type.",
+    "Remote IDs must be 2–32 characters matching [A-Za-z0-9_][A-Za-z0-9._-]* — verify the exact remote name with the list-remotes endpoint if unsure."
+  ],
+  "relatedOperations": [
+    "get_pbs_remotes",
+    "get_pbs_remotes_remote",
+    "get_pbs_remotes_remote_datastores"
+  ]
+}

package/dist/catalog-pdm/enrichment/get_pbs_remotes_remote_tasks_upid.json

@@ -0,0 +1,24 @@
+{
+  "operationId": "get_pbs_remotes_remote_tasks_upid",
+  "usageNotes": "Returns the directory index for a specific task UPID on a PBS remote, exposing the sub-resources available under that task node (e.g., log, status). Use this as a discovery step before fetching task log or status details — the null return type means the useful data comes from child endpoints, not from this call directly. The `remote` must already be configured in PDM and the `upid` must correspond to an actual task that exists on that remote.",
+  "examples": [
+    {
+      "summary": "Discover sub-resources for a PBS verify task on the 'pbs-primary' remote",
+      "path_params": {
+        "remote": "pbs-primary",
+        "upid": "UPID:pbs-primary:00001A2B:3C4D5E6F:67890ABC:verificationjob:store1:root@pam:"
+      },
+      "params": {}
+    }
+  ],
+  "tips": [
+    "The return type is null — this is a directory index; traverse to child endpoints (e.g., /log or /status) to get actionable task data.",
+    "The UPID string encodes the node, PID, start time, task type, and user — obtain it from the task list endpoint for the same remote.",
+    "API token auth is supported (allowtoken: true); no special privilege beyond 'user: all' is required, but the remote must be accessible to the authenticated user in PDM."
+  ],
+  "relatedOperations": [
+    "get_pbs_remotes_remote_tasks",
+    "get_pbs_remotes_remote_tasks_upid_log",
+    "get_pbs_remotes_remote_tasks_upid_status"
+  ]
+}

package/dist/catalog-pdm/enrichment/get_pbs_remotes_remote_tasks_upid_log.json

@@ -0,0 +1,29 @@
+{
+  "operationId": "get_pbs_remotes_remote_tasks_upid_log",
+  "usageNotes": "Use this endpoint to retrieve task log output for any async operation (backup, sync, verify, prune, etc.) that ran on a PBS remote. The UPID is returned by the triggering operation and encodes node, PID, and task type — pass it here to poll progress or retrieve the completed log. Set `limit=0` to retrieve the full log at once; use `start` + `limit` for paginated tailing of large logs.",
+  "examples": [
+    {
+      "summary": "Fetch the first 100 lines of a backup task log from PBS remote 'pbs-hetzner'",
+      "path_params": {
+        "remote": "pbs-hetzner",
+        "upid": "UPID:pbs-hetzner:00001A2B:5F3C7E10:67A1B2C3:backup:store1:root@pam:"
+      },
+      "params": {
+        "start": 0,
+        "limit": 100
+      }
+    }
+  ],
+  "tips": [
+    "Each response item has `n` (line number) and `t` (text); use `n` from the last item as the next `start` value to tail a running task.",
+    "Set `limit=0` to retrieve the entire log in one request — useful after a task completes to capture full output for audit or debugging.",
+    "The `download` flag returns the raw log file and cannot be combined with `start` or `limit`; use it only when you need to save or stream the full file outside the API.",
+    "UPIDs are returned by operations such as run-gc, verify, sync, and prune on this remote — always capture the UPID from those responses before polling here.",
+    "Requires `Resource.Audit` privilege on the specific remote resource path, not a global audit role."
+  ],
+  "relatedOperations": [
+    "get_pbs_remotes_remote_tasks_upid_status",
+    "get_pbs_remotes_remote_tasks",
+    "post_pbs_remotes_remote_tasks_upid_stop"
+  ]
+}

package/dist/catalog-pdm/enrichment/get_pbs_remotes_remote_tasks_upid_status.json

@@ -0,0 +1,27 @@
+{
+  "operationId": "get_pbs_remotes_remote_tasks_upid_status",
+  "usageNotes": "Use this endpoint to poll the status of any async task running on a PBS remote, such as a sync job, prune, or garbage collection — you get the UPID from the triggering operation's response. Set `wait=true` to block until the task completes rather than polling repeatedly, which is convenient for short-lived tasks but should be avoided for long-running jobs to prevent timeout issues. Requires `Resource.Audit` privilege on the target remote.",
+  "examples": [
+    {
+      "summary": "Check status of a running PBS garbage-collection task on remote 'pbs-hetzner'",
+      "path_params": {
+        "remote": "pbs-hetzner",
+        "upid": "UPID:pbs-hetzner:00001A2B:5F3C1D00:67A1B200:garbage_collect:local:root@pam:"
+      },
+      "params": {
+        "wait": false
+      }
+    }
+  ],
+  "tips": [
+    "Check `status` field first: 'running' means the task is still active; 'stopped' means it has finished.",
+    "`exitstatus` is only present when `status` is 'stopped' — a value of 'OK' means success; any other string is an error message.",
+    "UPIDs are at least 42 characters; validate length before calling to avoid a 400 error.",
+    "Use `wait=true` only for fast tasks (prune, small syncs); for garbage collection or large syncs, poll on a schedule instead."
+  ],
+  "relatedOperations": [
+    "get_pbs_remotes_remote_tasks_upid_log",
+    "get_pbs_remotes_remote_tasks",
+    "post_pbs_remotes_remote_sync"
+  ]
+}

package/dist/catalog-pdm/enrichment/get_ping.json

@@ -0,0 +1,19 @@
+{
+  "operationId": "get_ping",
+  "usageNotes": "Use this as a lightweight liveness check to verify the PDM API daemon is reachable before issuing heavier requests. It requires no authentication and accepts no parameters, making it safe to call from health monitors or pre-flight checks. Returns the literal string \"pong\" on success.",
+  "examples": [
+    {
+      "summary": "Check PDM API daemon liveness",
+      "path_params": {},
+      "params": {}
+    }
+  ],
+  "tips": [
+    "Because permissions are 'world', API tokens are accepted but not required — useful for unauthenticated health probes.",
+    "A successful 200 response with body \"pong\" confirms the HTTP layer is up, but does not verify backend cluster health or database connectivity.",
+    "Use this before bulk operations to fail fast if the PDM host is unreachable."
+  ],
+  "relatedOperations": [
+    "get_version"
+  ]
+}

package/dist/catalog-pdm/enrichment/get_pve.json

@@ -0,0 +1,20 @@
+{
+  "operationId": "get_pve",
+  "usageNotes": "Returns the top-level PVE directory index for the PDM API, listing the available PVE sub-resources (remotes, realms, firewall). Use this as a discovery call to confirm which PVE sections are exposed on the connected PDM instance before navigating into specific remote, realm, or firewall endpoints. Accessible to all authenticated users with no additional privilege requirements.",
+  "examples": [
+    {
+      "summary": "List available PVE API sub-resources on PDM",
+      "path_params": {},
+      "params": {}
+    }
+  ],
+  "tips": [
+    "The return type is null in the spec — the actual response is an index array of sub-endpoint link objects; use the returned hrefs to discover callable children.",
+    "Use this before calling any specific PVE operation to verify which sub-resources are available on the connected PDM instance."
+  ],
+  "relatedOperations": [
+    "get_pve_remotes",
+    "get_pve_realms",
+    "get_pve_firewall"
+  ]
+}

package/dist/catalog-pdm/enrichment/get_pve_firewall.json

@@ -0,0 +1,17 @@
+{
+  "operationId": "get_pve_firewall",
+  "usageNotes": "Returns the firewall directory index for PVE remotes managed by PDM — use this to discover available firewall sub-resources (e.g., rules, aliases, IPSets) before making targeted sub-resource calls. No parameters are required and no specific privilege beyond a valid PDM API token is needed. The return value is documented as null in the spec, meaning the useful payload is the directory listing embedded in the response envelope.",
+  "examples": [
+    {
+      "summary": "List all available firewall sub-resources on the PDM PVE surface",
+      "path_params": {},
+      "params": {}
+    }
+  ],
+  "tips": [
+    "This is a discovery/index endpoint — use the returned sub-resource paths to construct follow-up calls for firewall rules, aliases, or IPSets.",
+    "Accessible with any valid PDM API token; no elevated privileges required.",
+    "Because the spec marks returns.type as null, the actual directory data arrives in the standard Proxmox API response envelope under the 'data' key."
+  ],
+  "relatedOperations": []
+}

package/dist/catalog-pdm/enrichment/get_pve_firewall_status.json

@@ -0,0 +1,22 @@
+{
+  "operationId": "get_pve_firewall_status",
+  "usageNotes": "Use this to get a fleet-wide snapshot of firewall enablement across all PVE remotes registered in PDM — covering cluster-level, per-node, and per-guest (QEMU/LXC) status in a single call. The `status` field is optional on each object, meaning it may be absent if PDM cannot reach the remote or node at query time; always null-check before acting on enabled/active/all counts. Requires `Resource.Audit` privilege on each remote being queried.",
+  "examples": [
+    {
+      "summary": "Get firewall status across all PVE remotes",
+      "path_params": {},
+      "params": {}
+    }
+  ],
+  "tips": [
+    "A missing `status` field on a remote, node, or guest indicates PDM could not retrieve firewall data for that object — treat it as unknown, not disabled.",
+    "The `active` count reflects rules currently enforced by the kernel; `all` includes disabled rules. A gap between the two means some rules exist but are toggled off.",
+    "Cross-reference guests with `kind` (lxc vs qemu) to distinguish container vs VM firewall posture — they use different iptables chains in Proxmox.",
+    "This endpoint covers the PDM-managed PVE firewall layer only; standalone pfSense/OPNsense perimeter firewalls are out of scope."
+  ],
+  "relatedOperations": [
+    "list_pve_remotes",
+    "get_pve_cluster_status",
+    "list_pve_nodes"
+  ]
+}

package/dist/catalog-pdm/enrichment/get_pve_realms.json

@@ -0,0 +1,25 @@
+{
+  "operationId": "get_pve_realms",
+  "usageNotes": "Use this before adding a PVE remote to PDM to discover which authentication realms the target cluster exposes (e.g. 'pam', 'pve', or an LDAP/AD realm). The hostname must be reachable from PDM at call time; supply the TLS fingerprint when the target uses a self-signed certificate to avoid trust errors. Requires System.Modify on the PDM root — API tokens scoped below that will be rejected.",
+  "examples": [
+    {
+      "summary": "Scan a PVE node by hostname with a self-signed cert fingerprint",
+      "path_params": {},
+      "params": {
+        "hostname": "pve1.example.com:8006",
+        "fingerprint": "AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99:AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99"
+      }
+    }
+  ],
+  "tips": [
+    "The port is optional in hostname; omit it to use the PVE default (8006).",
+    "If fingerprint is omitted, PDM must already trust the target's TLS certificate via a CA in its trust store.",
+    "The returned 'tfa' field is present only when the realm has a legacy TOTP/Yubico provider configured; modern TOTP via webauthn/totp will not appear here.",
+    "Use the returned realm identifiers as the 'realm' value when registering the remote via the PDM UI or API."
+  ],
+  "relatedOperations": [
+    "get_pve_remotes",
+    "create_pve_remote",
+    "get_pve_cluster_info"
+  ]
+}

package/dist/catalog-pdm/enrichment/get_pve_remotes.json

@@ -0,0 +1,21 @@
+{
+  "operationId": "get_pve_remotes",
+  "usageNotes": "Use this to retrieve all PVE remote connections registered in Proxmox Datacenter Manager. The response contains only remote IDs — follow up with a per-remote detail call to get connection parameters (host, port, credentials). No parameters are required; the endpoint returns all remotes the authenticated token has visibility into.",
+  "examples": [
+    {
+      "summary": "List all registered PVE remotes",
+      "path_params": {},
+      "params": {}
+    }
+  ],
+  "tips": [
+    "Remote IDs follow the pattern [A-Za-z0-9_][A-Za-z0-9._-]* (2–32 chars); use the returned IDs as the 'remote' path param in subsequent per-remote endpoints.",
+    "An empty array response means no PVE remotes are registered yet — add one via the PDM UI or the create-remote endpoint before querying cluster or node resources.",
+    "API tokens (allowtoken: true) can be used directly; no interactive session cookie is required."
+  ],
+  "relatedOperations": [
+    "get_pve_remote",
+    "create_pve_remote",
+    "delete_pve_remote"
+  ]
+}

package/dist/catalog-pdm/enrichment/get_pve_remotes_remote.json

@@ -0,0 +1,21 @@
+{
+  "operationId": "get_pve_remotes_remote",
+  "usageNotes": "Use this endpoint to retrieve the directory index for a specific PVE remote registered in Proxmox Datacenter Manager. It serves as a discovery endpoint — confirming the remote exists and is accessible before calling more specific sub-resources under it. No special privilege beyond basic authenticated access is required (permissions: user=all), but the remote name must already be configured in PDM.",
+  "examples": [
+    {
+      "summary": "Fetch the directory index for a PVE remote named 'pve-hetzner'",
+      "path_params": {
+        "remote": "pve-hetzner"
+      },
+      "params": {}
+    }
+  ],
+  "tips": [
+    "The response type is null per the spec — this is a directory index endpoint; its primary value is confirming the remote path is valid and reachable.",
+    "Use list_pve_remotes first to discover valid remote names before calling this endpoint.",
+    "API tokens are allowed (allowtoken: true), so service accounts with limited scopes can call this safely."
+  ],
+  "relatedOperations": [
+    "list_pve_remotes"
+  ]
+}

package/dist/catalog-pdm/enrichment/get_pve_remotes_remote_cluster_nextid.json

@@ -0,0 +1,22 @@
+{
+  "operationId": "get_pve_remotes_remote_cluster_nextid",
+  "usageNotes": "Use this before migrating a VM to a remote PVE cluster to obtain a safe, collision-free VMID on the target. Requires the remote to be reachable and the caller to hold Resource.Audit on that remote resource. The API description notes the return type as null, so consume the raw response body for the integer VMID rather than a typed field.",
+  "examples": [
+    {
+      "summary": "Get next free VMID on remote cluster 'hetzner-pve' before migration",
+      "path_params": {
+        "remote": "hetzner-pve"
+      },
+      "params": {}
+    }
+  ],
+  "tips": [
+    "VMID availability is not reserved — race conditions are possible on busy clusters; re-check immediately before initiating the migration.",
+    "If the target cluster has a non-default endpoint, pass 'target-endpoint' to route the query through the correct PDM endpoint connection.",
+    "The remote name must match the pattern ^[A-Za-z0-9_][A-Za-z0-9._-]* and be 2–32 characters; mismatches return a 400 before reaching the cluster."
+  ],
+  "relatedOperations": [
+    "get_pve_remotes_remote_cluster_resources",
+    "get_pve_remotes"
+  ]
+}

package/dist/catalog-pdm/enrichment/get_pve_remotes_remote_cluster_status.json

@@ -0,0 +1,25 @@
+{
+  "operationId": "get_pve_remotes_remote_cluster_status",
+  "usageNotes": "Use this to check the health and quorum state of all nodes in a remote PVE cluster managed by PDM. The response mixes two record types — one cluster-level record (type: 'cluster') carrying quorate and node count, and one node-level record per member (type: 'node') carrying online status, subscription level, and IP. Requires Resource.Audit on the named remote; the optional target-endpoint parameter can redirect the connection through a specific PDM endpoint when the remote has multiple configured.",
+  "examples": [
+    {
+      "summary": "Check cluster quorum and node online status for a remote named 'hetzner-pve'",
+      "path_params": {
+        "remote": "hetzner-pve"
+      },
+      "params": {}
+    }
+  ],
+  "tips": [
+    "Filter the response by type === 'cluster' to get the single quorum record; filter by type === 'node' for per-node detail.",
+    "The 'local' field on node records marks the node that actually handled the query — useful for confirming which node PDM reached.",
+    "A quorate: false result means the cluster has lost majority; VMs may still be running but HA and config changes are blocked.",
+    "The 'level' field reflects the Proxmox subscription tier (e.g. 'c' = Community, 'b' = Basic, 's' = Standard, 'p' = Premium) and determines access to the enterprise repository."
+  ],
+  "relatedOperations": [
+    "get_pve_remotes",
+    "get_pve_remotes_remote",
+    "get_pve_remotes_remote_nodes",
+    "get_pve_remotes_remote_nodes_node_status"
+  ]
+}

package/dist/catalog-pdm/enrichment/get_pve_remotes_remote_firewall.json

@@ -0,0 +1,22 @@
+{
+  "operationId": "get_pve_remotes_remote_firewall",
+  "usageNotes": "Returns the firewall directory index for a named PVE remote registered in PDM, exposing the sub-resources available under the firewall path (e.g., rules, options, refs). The remote must be added and reachable in PDM before this call succeeds. Because the return type is null in the schema, use this primarily as a discovery endpoint to confirm firewall sub-resource availability before querying specific firewall resources.",
+  "examples": [
+    {
+      "summary": "List firewall sub-resources for the 'pve-prod' remote",
+      "path_params": {
+        "remote": "pve-prod"
+      },
+      "params": {}
+    }
+  ],
+  "tips": [
+    "This is a directory index — it lists available firewall sub-endpoints, not actual rules or settings.",
+    "The 'remote' value must exactly match the remote name as configured in PDM (case-sensitive).",
+    "Accessible to all authenticated users; no elevated privilege is required beyond a valid API token."
+  ],
+  "relatedOperations": [
+    "get_pve_remotes_remote",
+    "get_pve_remotes"
+  ]
+}

package/dist/catalog-pdm/enrichment/get_pve_remotes_remote_firewall_options.json

@@ -0,0 +1,25 @@
+{
+  "operationId": "get_pve_remotes_remote_firewall_options",
+  "usageNotes": "Returns the cluster-wide firewall configuration for a PVE remote registered in PDM, including whether the firewall is enabled, default inbound/outbound/forward policies, ebtables status, and log rate-limiting settings. Use this before modifying firewall rules to understand the current baseline policy, or to audit the security posture of a managed PVE cluster. Requires Resource.Audit on the remote — no write privilege needed.",
+  "examples": [
+    {
+      "summary": "Fetch firewall options for a PVE remote named 'hetzner-pve1'",
+      "path_params": {
+        "remote": "hetzner-pve1"
+      },
+      "params": {}
+    }
+  ],
+  "tips": [
+    "The 'enable' field returns an integer (0 = disabled), not a boolean — check for === 0 rather than falsy.",
+    "If 'policy_in' or 'policy_out' are absent from the response, the cluster has not set an explicit default and falls back to the PVE compiled-in default (ACCEPT).",
+    "log_ratelimit is returned as a formatted string (e.g. '1,burst=5,rate=1/second'); parse it as a key=value list, not JSON.",
+    "ebtables defaults to true cluster-wide; disabling it affects bridge-level filtering for VMs on Linux bridges."
+  ],
+  "relatedOperations": [
+    "get_pve_remotes_remote_firewall_rules",
+    "get_pve_remotes_remote_firewall_groups",
+    "get_pve_remotes_remote_firewall_aliases",
+    "get_pve_remotes_remote_firewall_ipset"
+  ]
+}

package/dist/catalog-pdm/enrichment/get_pve_remotes_remote_firewall_rules.json

@@ -0,0 +1,24 @@
+{
+  "operationId": "get_pve_remotes_remote_firewall_rules",
+  "usageNotes": "Use this to audit or display the ordered cluster-level firewall ruleset for a PVE remote managed by PDM. Rules are returned in positional order (pos field); the effective policy is applied top-down, so position matters when reasoning about overlapping rules. Requires Resource.Audit on the target remote — read-only tokens are sufficient.",
+  "examples": [
+    {
+      "summary": "List all cluster firewall rules for the 'prod-pve' remote",
+      "path_params": {
+        "remote": "prod-pve"
+      },
+      "params": {}
+    }
+  ],
+  "tips": [
+    "The 'pos' field is the rule's index in the ordered ruleset — lower pos values are evaluated first.",
+    "Rules with 'enable' set to 0 (or omitted as falsy) are inactive; check this field before assuming a rule is enforced.",
+    "The 'action' field can be ACCEPT, DROP, REJECT, or a security group name — security group references expand to their member rules at evaluation time.",
+    "Cluster-level rules apply to all nodes in the remote; for per-VM or per-node rules use the appropriate guest/host firewall endpoints instead."
+  ],
+  "relatedOperations": [
+    "get_pve_remotes_remote_firewall_options",
+    "get_pve_remotes_remote_firewall_groups",
+    "get_pve_remotes_remote_firewall_ipset"
+  ]
+}

package/dist/catalog-pdm/enrichment/get_pve_remotes_remote_firewall_status.json

@@ -0,0 +1,25 @@
+{
+  "operationId": "get_pve_remotes_remote_firewall_status",
+  "usageNotes": "Use this endpoint to get a cluster-wide snapshot of firewall enablement and rule counts across all nodes and guests on a PDM-managed PVE remote. The response is hierarchical: top-level cluster status, per-node status, and per-guest (LXC or QEMU) status — each with enabled flag, total rule count (all), and active rule count (active). Requires Resource.Audit on the remote; the remote must already be registered in PDM and reachable.",
+  "examples": [
+    {
+      "summary": "Check firewall status across all nodes and guests on the 'prod-cluster' remote",
+      "path_params": {
+        "remote": "prod-cluster"
+      },
+      "params": {}
+    }
+  ],
+  "tips": [
+    "The 'status' field is optional on nodes and guests — a missing status object typically means the firewall module returned no data for that resource (e.g. node offline or guest stopped).",
+    "Compare 'active' vs 'all' rule counts to identify resources where rules exist but the firewall is disabled (enabled: false) or rules are partially inactive.",
+    "Guest 'kind' distinguishes LXC containers from QEMU VMs — useful when filtering results by workload type.",
+    "This is a read-only audit call; no changes are made to firewall state."
+  ],
+  "relatedOperations": [
+    "get_pve_remotes_remote_firewall_aliases",
+    "get_pve_remotes_remote_firewall_groups",
+    "get_pve_remotes_remote_firewall_ipset",
+    "get_pve_remotes_remote_firewall_refs"
+  ]
+}

package/dist/catalog-pdm/enrichment/get_pve_remotes_remote_lxc.json

@@ -0,0 +1,26 @@
+{
+  "operationId": "get_pve_remotes_remote_lxc",
+  "usageNotes": "Use this to list all LXC containers across a registered PDM remote, optionally scoped to a single node. Omitting the `node` parameter queries every node in the cluster, which is useful for a full inventory but may return a large result set on busy clusters. The caller must hold the `Resource.Audit` privilege on the remote resource path; API tokens are supported.",
+  "examples": [
+    {
+      "summary": "List all LXC containers on a specific node of a remote cluster",
+      "path_params": {
+        "remote": "hetzner-pve"
+      },
+      "params": {
+        "node": "pve1"
+      }
+    }
+  ],
+  "tips": [
+    "All resource metrics (cpu, mem, disk, netin, netout) are live point-in-time snapshots and are absent for stopped containers.",
+    "Containers marked as templates (template: true) are included in the result; filter them out if you only want running or manageable instances.",
+    "The `lock` field being set means the container is mid-operation (backup, migration, snapshot) — avoid actions on locked containers.",
+    "Pressure stall fields (pressurecpusome, pressureiofull, etc.) are only populated on kernels with PSI support (Linux 4.20+)."
+  ],
+  "relatedOperations": [
+    "get_pve_remotes_remote_qemu",
+    "get_pve_remotes_remote_nodes",
+    "get_pve_remotes"
+  ]
+}

package/dist/catalog-pdm/enrichment/get_pve_remotes_remote_lxc_vmid.json

@@ -0,0 +1,24 @@
+{
+  "operationId": "get_pve_remotes_remote_lxc_vmid",
+  "usageNotes": "Returns the directory index for a specific LXC container on a PDM-managed PVE remote, listing the available sub-endpoints for that container. This is a navigation/discovery call — use it to enumerate what operations or sub-resources are available under a given vmid before drilling into config, status, or snapshots. No privileges beyond basic authentication are required, and the call is read-only with no side effects.",
+  "examples": [
+    {
+      "summary": "List available sub-endpoints for LXC container 101 on the remote named 'hetzner-pve1'",
+      "path_params": {
+        "remote": "hetzner-pve1",
+        "vmid": "101"
+      },
+      "params": {}
+    }
+  ],
+  "tips": [
+    "The response type is null in the schema, meaning the actual payload is an array of directory entries — treat the body as a list of available child routes rather than container data.",
+    "Useful as a capability probe: if a sub-endpoint appears in the result, the remote's API version supports it.",
+    "vmid should be a positive integer passed as a string; non-existent vmids will return a 404 from the remote."
+  ],
+  "relatedOperations": [
+    "get_pve_remotes_remote_lxc",
+    "get_pve_remotes_remote_lxc_vmid_config",
+    "get_pve_remotes_remote_lxc_vmid_status"
+  ]
+}

package/dist/catalog-pdm/enrichment/get_pve_remotes_remote_lxc_vmid_config.json

@@ -0,0 +1,27 @@
+{
+  "operationId": "get_pve_remotes_remote_lxc_vmid_config",
+  "usageNotes": "Fetches the full configuration of an LXC container from a remote PVE cluster registered in PDM. Use 'state=active' to see what is currently applied to the running container, or 'state=pending' (default) to see the configuration that will take effect on next start/reboot. Pass 'snapshot' to read config as it existed at a specific snapshot point. If 'node' is omitted, PDM resolves the hosting node automatically.",
+  "examples": [
+    {
+      "summary": "Get current active config for container 101 on remote 'pve-hetzner'",
+      "path_params": {
+        "remote": "pve-hetzner",
+        "vmid": 101
+      },
+      "params": {
+        "state": "active"
+      }
+    }
+  ],
+  "tips": [
+    "Omit 'node' unless you need to target a specific node; PDM auto-discovers the node for the given vmid.",
+    "The default 'state=pending' reflects the on-disk config file; use 'state=active' to see what the live container is actually running with.",
+    "Combine with 'snapshot' to audit what the container's config looked like at a historical restore point.",
+    "The response includes resource limits (cores, memory, swap), network interfaces (net0..netN), mount points (mp0..mpN), and device passthrough — parse selectively based on the field you need."
+  ],
+  "relatedOperations": [
+    "get_pve_remotes_remote_lxc",
+    "get_pve_remotes_remote_lxc_vmid_snapshot",
+    "get_pve_remotes_remote_lxc_vmid_status_current"
+  ]
+}

package/dist/catalog-pdm/enrichment/get_pve_remotes_remote_lxc_vmid_firewall.json

@@ -0,0 +1,27 @@
+{
+  "operationId": "get_pve_remotes_remote_lxc_vmid_firewall",
+  "usageNotes": "Returns the firewall directory index for a specific LXC container on a PDM-managed PVE remote, listing the available firewall sub-resources (rules, ipsets, aliases, options, refs, log). Use this as a discovery call before drilling into a specific firewall sub-resource. The remote must be registered in PDM and the target PVE node must be reachable; vmid must refer to an existing LXC container, not a QEMU VM.",
+  "examples": [
+    {
+      "summary": "List firewall sub-resources for LXC 101 on the prod-hetzner remote",
+      "path_params": {
+        "remote": "prod-hetzner",
+        "vmid": "101"
+      },
+      "params": {}
+    }
+  ],
+  "tips": [
+    "The returned index is a directory listing only — it does not return actual firewall rules or settings; follow up with sub-resource endpoints (rules, options, etc.) for actionable data.",
+    "vmid must be an LXC container ID; using a QEMU VM ID here will return an error — use the equivalent /qemu/{vmid}/firewall path for VMs.",
+    "This endpoint requires no special privilege beyond authenticated access (user: all), so API tokens with minimal scope can enumerate firewall sub-resources."
+  ],
+  "relatedOperations": [
+    "get_pve_remotes_remote_lxc_vmid_firewall_rules",
+    "get_pve_remotes_remote_lxc_vmid_firewall_options",
+    "get_pve_remotes_remote_lxc_vmid_firewall_ipsets",
+    "get_pve_remotes_remote_lxc_vmid_firewall_aliases",
+    "get_pve_remotes_remote_lxc_vmid_firewall_log",
+    "get_pve_remotes_remote_lxc_vmid_firewall_refs"
+  ]
+}

package/dist/catalog-pdm/enrichment/get_pve_remotes_remote_lxc_vmid_firewall_options.json

@@ -0,0 +1,28 @@
+{
+  "operationId": "get_pve_remotes_remote_lxc_vmid_firewall_options",
+  "usageNotes": "Use this to read the firewall configuration for a specific LXC container on a PDM-managed PVE remote, including whether the firewall is enabled, default inbound/outbound policies, and protocol-level options like DHCP, NDP, IP filtering, and MAC filtering. Requires the Resource.Audit privilege on the remote/guest path. The optional 'node' query param is only needed when PDM cannot infer the node automatically from the VMID.",
+  "examples": [
+    {
+      "summary": "Fetch firewall options for LXC 201 on remote 'pve-hetzner'",
+      "path_params": {
+        "remote": "pve-hetzner",
+        "vmid": 201
+      },
+      "params": {
+        "node": "pve1"
+      }
+    }
+  ],
+  "tips": [
+    "All returned fields are optional; missing fields indicate the cluster/host default applies (e.g., macfilter defaults to true, enable defaults to false).",
+    "If 'enable' is false, any firewall rules on the container are defined but inactive — check this field first when debugging unexpected traffic behavior.",
+    "ipfilter being enabled adds implicit IP restrictions per interface; combined with policy_in DROP this is a strong deny-by-default posture for containers.",
+    "log_level_in and log_level_out default to 'nolog'; set to 'info' or 'debug' on PVE directly to capture iptables hits without modifying the policy."
+  ],
+  "relatedOperations": [
+    "get_pve_remotes_remote_lxc_vmid_firewall_rules",
+    "get_pve_remotes_remote_lxc_vmid_firewall_ipsets",
+    "get_pve_remotes_remote_lxc_vmid_firewall_aliases",
+    "get_pve_remotes_remote_lxc_vmid_firewall_log"
+  ]
+}

package/dist/catalog-pdm/enrichment/get_pve_remotes_remote_lxc_vmid_firewall_rules.json

@@ -0,0 +1,29 @@
+{
+  "operationId": "get_pve_remotes_remote_lxc_vmid_firewall_rules",
+  "usageNotes": "Returns the ordered list of firewall rules applied to a specific LXC container on a PDM-managed PVE remote; rules are returned in positional order (pos field) which determines evaluation sequence. Requires Resource.Audit privilege on the remote+vmid path — read-only tokens are sufficient. If the container is managed by a cluster, supply the optional node parameter to target the specific cluster member hosting the container; omitting it lets PDM resolve the node automatically.",
+  "examples": [
+    {
+      "summary": "List all firewall rules for LXC 102 on the 'hetzner-pve' remote",
+      "path_params": {
+        "remote": "hetzner-pve",
+        "vmid": 102
+      },
+      "params": {
+        "node": "pve1"
+      }
+    }
+  ],
+  "tips": [
+    "Rules with enable=0 are present in the list but inactive; check this field before assuming a rule is enforced.",
+    "The action field may contain a security group name instead of ACCEPT/DROP/REJECT when a group reference is used — handle both cases when parsing results.",
+    "pos values are zero-indexed and determine match order; a lower pos value is evaluated first.",
+    "An empty array response means no container-level rules exist; cluster or datacenter-level rules may still apply to traffic."
+  ],
+  "relatedOperations": [
+    "get_pve_remotes_remote_lxc_vmid_firewall_options",
+    "get_pve_remotes_remote_lxc_vmid_firewall_refs",
+    "get_pve_remotes_remote_lxc_vmid_firewall_log",
+    "get_pve_remotes_remote_lxc_vmid_firewall_aliases",
+    "get_pve_remotes_remote_lxc_vmid_firewall_ipset"
+  ]
+}