Show HN: pvewarden – let an AI agent patch Proxmox VMs without giving it a shell

pvewarden is an MCP server that lets an AI agent such as Claude Code check pending updates, take snapshots, install updates, reboot and verify services on Proxmox VE guests without receiving a shell or root. Safety comes from a pool-scoped Proxmox token, per-guest SSH keys bound to a forced command, required Proxmox tags for updates and reboots, automatic snapshots before installs, and confirmation dialogs the agent cannot answer. It is at version 0.1.x, tested on Proxmox VE 9 with Debian 12/13 and Ubuntu 22.04/24.04/26.04 containers and VMs, and is licensed Apache-2.0.