60
/ 100
1 month ago
glama

homelab-mcp

MCP server giving AI assistants full control of a Proxmox homelab, enabling management of VMs, containers, Docker projects, media stack, and monitoring via natural language.

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
🚨
Secret credentials may flow to a network call
1 flow detected: TELEGRAM_BOT_TOKEN. We can’t prove the destination matches the brand the credential belongs to.
⚠️
Known vulnerabilities in dependencies: 17 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
🔐
You'll be asked for 19 credentials: ADGUARD_PASSWORD, BAZARR_API_KEY, DEVBOX_PASSWORD, GRAFANA_TOKEN, LIDARR_API_KEY, OVERSEERR_API_KEY, PBS_TOKEN_SECRET, PLEX_TOKEN, PROWLARR_API_KEY, PROXMOX_PASSWORD, QNAP_PASSWORD, RADARR_API_KEY, READARR_API_KEY, SABNZBD_API_KEY, SONARR_API_KEY, SSH_STRICT_HOST_KEY, TAUTULLI_API_KEY, TELEGRAM_BOT_TOKEN, UPTIME_KUMA_PASSWORD
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// known CVEs in dependencies17 high12 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.0.0GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.0.0GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

highaxios@1.7.0GHSA-35jp-ww65-95wh

axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

highaxios@1.7.0GHSA-3g43-6gmg-66jw

axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

highaxios@1.7.0GHSA-43fc-jf86-j433

Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
🔐 secretADGUARD_PASSWORDADGUARD_URL, ADGUARD_USER, AdGuard Home
configADGUARD_URL, ADGUARD_USER, ADGUARD_PASSWORD AdGuard Home
configADGUARD_USERADGUARD_URL, , ADGUARD_PASSWORD AdGuard Home
🔐 secretBAZARR_API_KEYBAZARR_URL, Bazarr subtitles
configBAZARR_URL, BAZARR_API_KEY Bazarr subtitles
configDASHBOARD_DISK_PATHS
configDEVBOX_HOST, DEVBOX_USER Devbox SSH access
configDEVBOX_KEY_PATHDEVBOX_PASSWORD or Devbox SSH auth
🔐 secretDEVBOX_PASSWORDor DEVBOX_KEY_PATH Devbox SSH auth
configDEVBOX_PORT
configDEVBOX_PROJECTS_DIR
configDEVBOX_USERDEVBOX_HOST, Devbox SSH access
🔐 secretGRAFANA_TOKENGRAFANA_URL, Grafana API
configGRAFANA_URL, GRAFANA_TOKEN Grafana API
configHTTP_RETRIES
🔐 secretLIDARR_API_KEYLIDARR_URL, Lidarr music
configLIDARR_ROOT_FOLDER
configLIDARR_URL, LIDARR_API_KEY Lidarr music
configMEDIA_CONTAINERS
🔐 secretOVERSEERR_API_KEYOVERSEERR_URL, Overseerr API
configOVERSEERR_URL, OVERSEERR_API_KEY Overseerr API
configPBS_NODE
configPBS_TLS_VERIFYfalse Set to true to validate PBS TLS certificates
configPBS_TOKEN_IDPBS_URL, , PBS_TOKEN_SECRET Proxmox Backup Server
🔐 secretPBS_TOKEN_SECRETPBS_URL, PBS_TOKEN_ID, Proxmox Backup Server
configPBS_URL, PBS_TOKEN_ID, PBS_TOKEN_SECRET Proxmox Backup Server
🔐 secretPLEX_TOKENPLEX_URL, Plex
configPLEX_URL, PLEX_TOKEN Plex
configPROMETHEUS_URLPrometheus API
🔐 secretPROWLARR_API_KEYPROWLARR_URL, Prowlarr API
configPROWLARR_URL, PROWLARR_API_KEY Prowlarr API
configPROXMOX_CT_BRIDGE
configPROXMOX_CT_STORAGE
configPROXMOX_CT_TEMPLATE
configPROXMOX_GATEWAY
configPROXMOX_HOST, PROXMOX_PORT, PROXMOX_USER, PROXMOX_NODE Proxmox API access
configPROXMOX_KEY_PATHPROXMOX_PASSWORD or Proxmox auth
configPROXMOX_NODEPROXMOX_HOST, PROXMOX_PORT, PROXMOX_USER, Proxmox API access
🔐 secretPROXMOX_PASSWORDor PROXMOX_KEY_PATH Proxmox auth
configPROXMOX_PORTPROXMOX_HOST, , PROXMOX_USER, PROXMOX_NODE Proxmox API access
configPROXMOX_TLS_VERIFYfalse Set to true to validate Proxmox TLS certificates
configPROXMOX_USERPROXMOX_HOST, PROXMOX_PORT, , PROXMOX_NODE Proxmox API access
configQNAP_DRIVE_DEVICES
configQNAP_HOST, QNAP_USER, QNAP_PASSWORD or QNAP_KEY_PATH QNAP NAS
configQNAP_KEY_PATHQNAP_HOST, QNAP_USER, QNAP_PASSWORD or QNAP NAS
🔐 secretQNAP_PASSWORDQNAP_HOST, QNAP_USER, or QNAP_KEY_PATH QNAP NAS
configQNAP_PORT
configQNAP_STORAGE_SHARES
configQNAP_USERQNAP_HOST, , QNAP_PASSWORD or QNAP_KEY_PATH QNAP NAS
🔐 secretRADARR_API_KEYRADARR_URL, Radarr API
configRADARR_ROOT_FOLDER
configRADARR_URL, RADARR_API_KEY Radarr API
🔐 secretREADARR_API_KEYREADARR_URL, Readarr books
configREADARR_ROOT_FOLDER
configREADARR_URL, READARR_API_KEY Readarr books
🔐 secretSABNZBD_API_KEYSABNZBD_URL, SABnzbd API
configSABNZBD_URL, SABNZBD_API_KEY SABnzbd API
🔐 secretSONARR_API_KEYSONARR_URL, Sonarr API
configSONARR_ROOT_FOLDER
configSONARR_URL, SONARR_API_KEY Sonarr API
🔐 secretSSH_STRICT_HOST_KEYfalse Set to true to enable known_hosts verification
🔐 secretTAUTULLI_API_KEYTAUTULLI_URL, Tautulli analytics
configTAUTULLI_URL, TAUTULLI_API_KEY Tautulli analytics
🔐 secretTELEGRAM_BOT_TOKEN, TELEGRAM_CHAT_ID Telegram notifications
configTELEGRAM_CHAT_IDTELEGRAM_BOT_TOKEN, Telegram notifications
🔐 secretUPTIME_KUMA_PASSWORDUPTIME_KUMA_URL, UPTIME_KUMA_USER, Uptime Kuma
configUPTIME_KUMA_URL, UPTIME_KUMA_USER, UPTIME_KUMA_PASSWORD Uptime Kuma
configUPTIME_KUMA_USERUPTIME_KUMA_URL, , UPTIME_KUMA_PASSWORD Uptime Kuma
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 2 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/nainounen-homelab-mcp-16bwgv)](https://m8ven.ai/mcp/nainounen-homelab-mcp-16bwgv)
commit: 34fd5089958a75bc1f96c164ceda3bbd97cb6279
code hash: c44f677fd9a8977c12dfe3f3396d66809d6caff51f82bd9fe6e0e20084c46415
verified: 6/10/2026, 10:27:36 AM
view raw JSON →