# Virtualization Mcp > MCP Server and Webapp for VirtualBox, Hyper-V and Windows sandbox. VM operations, networking, storage, snapshots, and security features. - **Type:** MCP server - **Install:** `agentstack add mcp-sandraschi-virtualization-mcp` - **Verified:** Pending review - **Seller:** [sandraschi](https://agentstack.voostack.com/s/sandraschi) - **Installs:** 0 - **Category:** [Integrations](https://agentstack.voostack.com/c/integrations) - **Latest version:** 0.1.0 - **License:** MIT - **Upstream author:** [sandraschi](https://github.com/sandraschi) - **Source:** https://github.com/sandraschi/virtualization-mcp ## Install ```sh agentstack add mcp-sandraschi-virtualization-mcp ``` Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent. ## About # virtualization-mcp Spin up VMs, sandboxes, and dev environments from Claude Desktop, Cursor, or the fleet webapp. ## Features - **VirtualBox & Hyper-V** — create, start, stop, snapshot, clone VMs - **Windows Sandbox** — consumer (nearly naked) and dev-infra bringups for fleet install testing - **ISO pipeline** — download Ubuntu, Debian, Windows ISOs into `assets/vbox` - **noVNC console** — browser VM console from the webapp - **Unattended Win11** — autoinstall with optional dev tools (dev VMs only) - **Fleet dashboard** — health-check and launch registered MCP webapps ## A Brief History of Virtual Machines Virtual machines are older than you think. The concept dates to the **1960s**, driven by a problem that still sounds familiar: expensive hardware that was mostly idle. ### Mainframe era (1960s–1970s) IBM pioneered virtualization on the **IBM System/360-67** (1966) and later the **System/370** (1972). The CP/CMS operating system (precursor to VM/370) introduced the idea of a **hypervisor** — a thin layer that partitions physical hardware into isolated "virtual machines," each running its own OS. This was pure pragmatism: a mainframe cost millions and ran batch jobs at night. Virtualization let multiple research teams share the machine concurrently without stepping on each other. IBM's **VM/370** became the production version, and its design — a privileged "control program" managing guest operating systems — is the direct ancestor of every Type-1 hypervisor today. The term "virtual machine" itself comes from this era. ### The x86 dark ages (1980s–1990s) When computing moved from mainframes to x86 workstations and servers, virtualization was essentially lost. The x86 architecture had no concept of privilege rings that could trap and emulate guest OS instructions efficiently. The few attempts (like **VMware Workstation 1.0 in 1999**) used **binary translation** — dynamically rewriting guest instructions on the fly — which was slow and fragile but proved it could be done. Intel and AMD eventually added hardware virtualization extensions: **Intel VT-x** (2005) and **AMD-V** (2006). These introduced a new "root mode" that lets the CPU natively execute guest instructions without binary translation. This was the unlock that made x86 virtualization performant enough for production. ### The golden age (2005–2015) With hardware assist in place, virtualization exploded: - **VMware** dominated the enterprise with ESX/vSphere, building a multi-billion-dollar business on server consolidation (replacing 10 underutilized physical servers with 1 host running 10 VMs). - **Xen** (2003, Cambridge University) became the open-source standard, powering early AWS (EC2 ran on Xen until 2017). Amazon chose Xen because it was free and could be customized for multi-tenant isolation at scale. - **KVM** (2007, Avi Kivity/Qumranet) turned Linux itself into a Type-1 hypervisor by adding the `kvm` kernel module. Red Hat acquired Qumranet in 2008 and made KVM the default for RHEV and OpenStack. KVM is now the most widely deployed hypervisor on the planet by sheer host count (every Android phone runs a KVM-based protected VM for Trusty/AVB, every Chromebook runs KVM for Linux containers, every major public cloud uses KVM or a derivative). - **VirtualBox** (2007, Sun Microsystems, later Oracle) targeted the desktop and developer market — free, cross-platform, easy to use. It never aimed at the datacenter but became the de-facto standard for "I need a VM on my laptop." - **Hyper-V** (2008, Microsoft) was Microsoft's response, a Type-1 hypervisor built into Windows Server and later Windows Pro/Enterprise. It competed with VMware on Windows workloads and came free with the OS. - **Parallels** started as a Windows/Linux desktop hypervisor (Parallels Workstation, 2005) but pivoted hard to macOS after acquiring the Mac code in 2006. **Parallels Desktop for Mac** became the dominant solution for running Windows VMs on Apple hardware — first on Intel Macs via full virtualization, then on Apple Silicon via a custom hypervisor that translates x86 to ARM on the fly (Rosetta-like). There is also **Parallels RAS** (Remote Application Server), an enterprise product for virtual app delivery on Windows Server, but it is a much smaller business than the desktop Mac product. The Linux/Windows Workstation versions were discontinued in the early 2010s. Effectively: **Parallels is macOS-only today**, and its sole market is "run Windows on a Mac." ### The cloud and container correction (2015–present) The rise of AWS, Azure, and GCP changed the question from "which hypervisor do I install?" to "which API do I call?" Nobody cared whether EC2 ran on Xen or KVM (it's KVM now) — they cared about the `RunInstances` API. Containers (Docker, 2013) then questioned whether full VMs were needed at all. Why run a whole OS when a process-level sandbox with cgroups and namespaces was faster and lighter? Kubernetes (2014) orchestrated containers at scale, and for a while it seemed like VMs were legacy. But containers don't actually replace VMs — they run on top of them. Every Kubernetes node is a VM (or bare metal, but mostly VMs in the cloud). The two technologies are complementary, not competing. The industry settled on: **containers for application packaging, VMs for isolation and infrastructure.** ### The present (2026) Today's landscape is stratified: - **Public cloud** — AWS Nitro (KVM-based with custom silicon), Azure (Hyper-V), GCP (KVM). Customers consume VMs through APIs, never touching a hypervisor. - **Enterprise on-prem** — VMware (declining post-Broadcom), Hyper-V, Nutanix AHV, Proxmox VE (rising). The Broadcom VMware disaster accelerated a migration wave that will take years to play out. - **Developer laptops** — VirtualBox, Hyper-V (via Docker Desktop/WSL2), Parallels (macOS), UTM (Apple Silicon QEMU), and Multipass (Canonical's lightweight Ubuntu VMs). The trend is toward lightweight, API-driven VMs that can be provisioned in seconds and discarded just as fast. - **Edge / IoT** — k3s (Kubernetes on VMs or bare metal), KVM-on-arm (Raspberry Pi 5 can run VMs now), and embedded hypervisors like Jailhouse and ACRN. This project sits in the developer laptop and edge segment — managing VirtualBox and Hyper-V VMs, Windows Sandbox ephemeral environments, and Docker sandbox containers, all from a unified MCP tool surface. It's a pragmatic snapshot of the 2026 virtualization landscape: free tools, local execution, API-driven, AI-friendly. ## Virtualization Landscape This project integrates with a deliberately curated set of virtualization backends. Here is the full landscape and why each technology was chosen or rejected. ### VirtualBox 7+ (Oracle, GPLv2) **Status: ✅ Supported as primary VM backend** Oracle VM VirtualBox is the default hypervisor for this project. It is free, open-source (GPLv2), runs on Windows/Linux/macOS, and exposes a mature CLI (`VBoxManage`) that covers VM lifecycle, snapshots, networking, storage, VRDP, unattended installs, and more. The `pyvbox` Python API provides direct bindings for Python 3.12. VirtualBox's strength is its zero-cost entry and broad OS compatibility — any developer can install it without a license server or subscription. | Feature | Via VBoxManage | |---------|---------------| | VM lifecycle | `list`, `createvm`, `startvm`, `controlvm`, `unregistervm` | | Snapshots | `snapshot take/restore/delete` | | Networking | `hostonlyif`, `natnetwork`, `modifyvm --nic` | | Storage | `storagectl`, `storageattach` | | VRDP/remote | `modifyvm --vrde on`, `showvminfo --machinereadable` | | Unattended install | `unattended install` (VBox 7+) | ### Hyper-V (Microsoft, Windows-only) **Status: ✅ Supported as secondary VM backend** Microsoft Hyper-V is a Type-1 hypervisor built into Windows Pro/Enterprise/Education. It is managed via PowerShell (`Get-VM`, `New-VM`, `Start-VM`, etc.) and provides native Windows VM performance with no additional install. Hyper-V is used for Gen2 VMs with UEFI boot and TPM support (required for Windows 11 guest VMs without workarounds). | Feature | Via PowerShell | |---------|---------------| | VM lifecycle | `Get-VM`, `New-VM`, `Start-VM`, `Stop-VM`, `Remove-VM` | | Generation | Gen1 (BIOS) or Gen2 (UEFI) | | Limitations | No snapshot API via PowerShell, no VRDP passthrough | Hyper-V is **not** available on Windows Home edition — the app detects this and degrades gracefully. ### Windows Sandbox (Microsoft, Windows-only) **Status: ✅ Supported for ephemeral sandbox environments** Windows Sandbox is a lightweight VM built on Hyper-V technology that provides a disposable, isolated Windows environment. Each launch creates a fresh image from the host's base Windows installation. Changes are discarded when the sandbox closes. The project supports three sandbox modes: - **Consumer** — completely naked Windows, no pre-installed tooling. Used for testing install walkthroughs on a simulated "naked PC." - **Dev Infra** — includes winget, uv, git, and network access. Used for testing fleet deployment scripts and MCP server installs. - **Full Dev** — user-selectable tooling (Python, Node, VS Code, Cursor, etc.) installed automatically at first boot. ### Docker (Docker Inc.) **Status: ✅ Partially supported for container execution** Docker is supported for ephemeral sandbox-style container execution (run isolated commands, compile code, execute scripts) via the `sandbox_management` portmanteau tools. This is not a full Docker Compose or Kubernetes replacement — it is a lightweight "run a command in a throwaway container" feature for development workflows. ### VMware / vSphere (Broadcom, formerly VMware Inc.) **Status: ❌ Not supported — see below** VMware was **not selected** for this project. The reasons are both technical and ethical: **The Broadcom takeover (Nov 2023):** Broadcom completed its $69B acquisition of VMware in November 2023. Within months, Broadcom: - Terminated all perpetual license sales — customers are forced into subscription-only pricing. - Bundled products into massive "VMware Cloud Foundation" suites with 2–5× price increases. - Killed free versions (vSphere Hypervisor, VMware Player for commercial use lost functionality, Workstation Pro was made free only after public backlash in May 2024 — and then Workstation Pro/Fusion Pro were open-sourced in Nov 2024, likely to offload maintenance). - Laid off thousands of VMware engineers, gutting product teams. - Imposed punitive audit terms on existing enterprise customers, with some reporting 300–500% renewal cost increases. **The customer rip-off pattern:** Broadcom's playbook is consistent across acquisitions (CA Technologies, Symantec, VMware): 1. Acquire a critical infrastructure vendor 2. Eliminate perpetual licenses → force subscriptions 3. Bundle products into expensive suites 4. Ratchet prices after lock-in 5. Cut R&D to the bone For a virtualization management tool like this one, depending on VMware would mean: - Requiring users to have a paid vSphere/vCenter license (most individual developers don't) - Being at the mercy of Broadcom's licensing terms and price changes - Supporting a shrinking ecosystem as customers migrate away **The post-Broadcom landscape (2024–2026):** The VMware exodus is real. Enterprises are migrating to: - **Microsoft Hyper-V** (already supported here) - **Proxmox VE** (open-source KVM-based, growing rapidly) - **Nutanix AHV** (proprietary but Broadcom-free) - **Oracle VirtualBox** (already supported here) - **KVM/libvirt** (Linux-native, open-source) We may add **Proxmox VE** support in a future release, as it is the most natural open-source replacement for vSphere in the small-to-mid datacenter segment. ### Proxmox VE (Proxmox Server Solutions GmbH) **Status: ✅ Supported via REST API** Proxmox VE is an open-source (GNU AGPLv3) virtualization platform based on KVM and LXC. It provides a web UI, REST API, clustering, and live migration — similar to vSphere but without the licensing cost. **It is already supported as a remote backend in this project.** If you have a Proxmox host (even a single node), set three environment variables and the MCP server will discover and manage Proxmox VMs alongside VirtualBox and Hyper-V: ```bash # In your shell or start.ps1 export PROXMOX_HOST=192.168.1.100 export PROXMOX_USER=root@pam export PROXMOX_PASSWORD=your-password # Optional: # export PROXMOX_NODE=pve1 # autodetected if not set # export PROXMOX_VERIFY_SSL=0 # default: 0 (self-signed certs) ``` That's it. No Proxmox-specific plugins, no agent installs, no separate service. The client authenticates via the Proxmox ticket API and supports: | Operation | Endpoint | |-----------|----------| | List VMs | `GET /api/v1/vms` (merged with VirtualBox + Hyper-V) | | Start/Stop/Shutdown | `POST .../status/start\|stop\|shutdown` | | Create VM | Configurable CPU, RAM, disk, ISO, network bridge | | Delete VM | `DELETE .../qemu/{vmid}` | | Snapshots | Create, list, delete via `/snapshot` API | | Node status | CPU, memory, disk via `/nodes/{node}/status` | | Cluster resources | `GET /cluster/resources` cross-node | **Proxmox is not harder than VirtualBox to set up from the MCP side** — the hard part was always the Proxmox installation itself (Debian ISO, install, configure storage). But once Proxmox is running, plugging it into this MCP server is just those three env vars. We did the complicated part (the REST API client) so you don't have to. ### KVM / libvirt (Red Hat / community) **Status: 🔍 Under investigation** KVM (Kernel-based Virtual Machine) is the Linux-native Type-1 hypervisor. It is managed via `libvirt` and `virsh`. Linux-native support would be added if cross-platform parity becomes a priority. ### Nutanix AHV (Nutanix) **Status: ❌ Not supported — enterprise scope** Nutanix AHV is a Type-1 hypervisor built into the Nutanix Acropolis hyperconverged infrastructure (HCI) platform. It is proprietary, licensed per-node as part of the Nutanix AOS/Prism bundle. AHV is KVM-based under the hood but managed exclusively through Nutanix Prism (UI and REST API). It competes with VMware vSphere in the enterprise HCI space and has been a major beneficiary of the Broadcom VMware exodus. Reasons not currently supported: - Requires a Nutanix cluster — not available to individual developers or small shops - The Prism REST API is complex and targets infrastructure teams, not ad-hoc VM management - Licensing is per-node subscription, typically $5k–$20k/node/year depending on bundle - The open-source KVM layer underneath is not directly accessible when managed by Acropolis AHV support would make sense for a future "fleet datacenter" tier that targets enterprise Nutanix customers, but it is out of scope for the current single-machine developer workflow. ### OpenStack (OpenInfra Foundation / community) **Status: ❌ Not supported — DIY complexity** OpenStack is a set of open-source (Apache 2.0) projects that together provide infrastructure-as-a-service (Compute via Nova, Storage via Cinder/Swift, Networking via Neutron, Identity via Keystone, etc.). It is the de-facto open-source cloud platform, used by massive deployments (OVH, Rackspace, CERN, Walmart) and telcos. Reasons not currently supported: - **DIY infrastructure cost:** OpenStack is free software, but operating it requires a cluster of bare-metal hosts, shared storage (Ceph/CEPH or SAN), and at least 3 controller nodes for HA. A minimal production deployment starts at 6–10 physical servers. There is no "OpenStack on a laptop" — even dev environments (DevStack, MicroStack, Kolla) need significant RAM and multiple VMs. - **Operational complexity:** OpenStack has 30+ core services. Upgrades are painful, networking (Neutron + OVS/OVN) is notoriously brittle, and troubleshooting requires deep knowledge of RabbitMQ, MySQL/Galera, and distributed system internals. - **Wrong abstraction layer:** This project manages indiv … ## Source & license This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code. - **Author:** [sandraschi](https://github.com/sandraschi) - **Source:** [sandraschi/virtualization-mcp](https://github.com/sandraschi/virtualization-mcp) - **License:** MIT Install and usage instructions live in the source repository linked above. ## Pricing - **Free** — Free ## Security capabilities Automated source analysis of v0.1.0 — what this tool can access: - **Network access:** yes - **Filesystem access:** no - **Shell / process execution:** no - **Environment & secrets:** no - **Dynamic code execution:** no *"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.* ## Versions - **0.1.0** — security scan: flagged — Imported from the upstream source. ## Links - Listing page: https://agentstack.voostack.com/l/mcp-sandraschi-virtualization-mcp - Seller: https://agentstack.voostack.com/s/sandraschi - Browse the marketplace: https://agentstack.voostack.com/browse --- Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.