VMware AIops

VMware AIops

> Author: Wei Zhou, VMware by Broadcom — wei-wz.zhou@broadcom.com > This is a community-driven project by a VMware engineer, not an official VMware product. > For official VMware developer tools see developer.broadcom.com.

English | [中文](README-CN.md)

AI-powered VMware vCenter/ESXi VM lifecycle and deployment tool — 60 tools.

> Companion skills handle everything else: > > | Skill | Scope | Install | > |-------|-------|---------| > | vmware-monitor | Read-only: inventory, health, alarms, events, metrics | uv tool install vmware-monitor | > | vmware-storage | Datastores, iSCSI, vSAN management | uv tool install vmware-storage | > | vmware-vks | Tanzu Namespaces, TKC cluster lifecycle | uv tool install vmware-vks | > > Need read-only monitoring only? Use VMware-Monitor — zero destructive code in the codebase.

[](https://clawhub.ai/skills/vmware-aiops) [](https://skills.sh/vmware-skills/VMware-AIops) [](https://github.com/vmware-skills/VMware-AIops) [](LICENSE)

⚡ Quick Investigation Reports (read-only)

Triage → investigate → act, all in one conversation. Five opinionated read-only reports aggregate and correlate server-side and hand back a high-signal result (never raw inventory), so you can decide where to look before changing anything. Each renders a self-contained offline HTML snapshot with --html (no external assets; drill-down detail collapses in native ``, zero JavaScript). All delegate to the vmware-monitor library using AIops's own vCenter connection.

| Question | Command | What it correlates | |----------|---------|--------------------| | "What needs attention now?" across all vCenters | vmware-aiops attention | Every vCenter merged into one globally-ranked issue list; unreachable targets degrade gracefully | | "Is anything on fire?" across all clusters | vmware-aiops summary | Every cluster's hosts + VM power + live CPU/mem + alarms → ranked top-N issues + per-cluster status | | "What's happening around this VM?" | vmware-aiops investigate vm | VM state + host + cluster + backing datastores + snapshots + alarms + performance + a merged event timeline | | "What's happening around this host?" | vmware-aiops investigate host | Host state + cluster + the VMs it runs + mounted datastores + alarms + performance + correlated timeline | | "What's happening around this datastore?" | vmware-aiops investigate datastore | Capacity/free + mounting hosts + VMs it backs + alarms + correlated timeline |

vmware-aiops attention                            # what needs attention now, all vCenters
vmware-aiops investigate vm web-01 --hours 72     # everything around a VM, then act on it
vmware-aiops investigate vm web-01 --html         # → offline snapshot in ~/vmware-health/

Via MCP these are the tools cluster_health_summary, cross_vcenter_attention, vm_investigation_bundle, host_investigation_bundle, datastore_investigation_bundle. (Requires vmware-monitor installed.)

Quick Install (Recommended)

Works with Claude Code, Cursor, Codex, Gemini CLI, Trae, and 30+ AI agents:

# Via Skills.sh
npx skills add vmware-skills/VMware-AIops

# Via ClawHub
clawhub install vmware-aiops

PyPI Install (No GitHub Access Required)

# Install via uv (recommended)
uv tool install vmware-aiops

# Or via pip
pip install vmware-aiops

# China mainland mirror (faster)
pip install vmware-aiops -i https://pypi.tuna.tsinghua.edu.cn/simple

Offline / Air-Gapped Install (from source)

This project uses the modern PEP 517 build system (hatchling), so there is no setup.py by design — that is expected, not a missing file. If you cloned the source and hit ERROR: File "setup.py" or "setup.cfg" not found ... editable mode currently requires a setuptools-based build, your pip is older than 21.3 and cannot do an editable (-e) install with a non-setuptools backend. Editable mode is a developer convenience, not needed to run the tool — do one of:

# From the source tree — a normal (non-editable) install builds a wheel:
pip install .              # NOT  pip install -e .

# ...or upgrade pip first, and editable works too:
pip install --upgrade pip && pip install -e .

For a truly air-gapped host, build the wheels on a connected machine and copy them over — the target then needs no network:

# On a connected machine, collect this package + its dependencies as wheels:
pip wheel . -w dist        # → dist/*.whl   (or: uv build, for just this package)

# Copy dist/ to the air-gapped host, then install offline:
pip install --no-index --find-links dist vmware-aiops

---

Why this over other VMware MCP servers

Most open-source VMware MCP servers (e.g. bright8192/esxi-mcp-server, giuliolibrando/vmware-vsphere-mcp-server) are single-vCenter VM wrappers: list/power/snapshot a VM, basic monitoring, a confirm=True flag. They explicitly do not cover networking, storage, Kubernetes, ops analytics, load balancing, or compliance — and "logging is documented" is not an audit trail.

This is one skill in an 11-package family that covers the whole estate and runs every tool through a governed harness:

| | Other VMware MCP servers | This family | |---|:---:|:---:| | VM lifecycle + monitoring | ✅ | ✅ | | NSX networking (segments/gateways/NAT/routing/IPAM) | ❌ | ✅ vmware-nsx | | NSX security (DFW/groups/IDS-IPS/traceflow) | ❌ | ✅ vmware-nsx-security | | Storage (datastore/iSCSI/vSAN) | ❌ | ✅ vmware-storage | | Tanzu Kubernetes (Supervisor/Namespace/TKC) | ❌ | ✅ vmware-vks | | Aria Operations (metrics/alerts/capacity) | ❌ | ✅ vmware-aria | | AVI / NSX ALB load balancing + AKO | ❌ | ✅ vmware-avi | | Compliance baselines + drift (CIS/SCG/等保/PCI) | ❌ | ✅ vmware-harden | | Governed harness (unified audit, policy engine, token budget + runaway breaker, graduated risk tiers, undo-token, prompt-injection sanitize) | ❌ | ✅ vmware-policy on every tool |

If you only ever power-cycle VMs in one vCenter, a single-file server is fine. If you run a real (regulated, NSX-segmented, multi-domain) VMware estate and need an AI operator an auditor can sign off on, that's what this family is for — see [docs/compliance-ready.md](../docs/compliance-ready.md).

Capabilities Overview

What This Skill Does

| Category | Tools | Count | |----------|-------|:-----:| | VM Lifecycle | power on/off, TTL auto-delete, clean slate | 6 | | Deployment | OVA, template, linked clone, batch clone/deploy | 8 | | Guest Ops | exec commands, upload/download files, provision | 5 | | Plan/Apply | multi-step planning with rollback | 4 | | Cluster | create, delete, HA/DRS config, add/remove hosts | 6 | | Datastore | browse files, scan for images | 2 | | Network | dvSwitch portgroup list/create, host VMkernel list/add/remove, DF-bit MTU-path ping | 6 |

CLI vs MCP: Which Mode to Use

| Scenario | Recommended | Why | |----------|:-----------:|-----| | Local/small models (Ollama, Qwen Rule of thumb: Use CLI for cost efficiency and small models. Use MCP for structured automation with large models.

Architecture

User (Natural Language)
  ↓
AI CLI Tool (Claude Code / Gemini / Codex / Aider / Continue / Trae / Kimi)
  ↓ reads SKILL.md / AGENTS.md / rules
  ↓
vmware-aiops CLI
  ↓ pyVmomi (vSphere SOAP API)
  ↓
vCenter Server ──→ ESXi Cluster ──→ VM
    or
ESXi Standalone Host ──→ VM

Version Compatibility

| vSphere / VCF Version | Support | Notes | |----------------|---------|-------| | VCF 9.1 / vSphere 9.1 | ✅ Full | Released 2026-05-12. pyVmomi ` pyVmomi auto-negotiates the API version during SOAP handshake — no manual configuration needed. The same codebase manages 7.0 / 8.0 / 9.0 / 9.1 environments seamlessly.

Official Broadcom References

• SDKs: — VCF Python SDK (recommended for VCF 9+, bundles pyVmomi + vSAN SDK), vSphere Automation SDK for Python (REST APIs)
• REST APIs: — vSphere Automation API, VCF API, SDDC Manager API
• CLI Tools: — PowerCLI 9.1, ESXCLI, OVF Tool

---

Common Workflows

Deploy a Lab Environment

1. Browse datastore for OVA images → vmware-aiops datastore browse --pattern "*.ova"
2. Deploy VM from OVA → vmware-aiops deploy ova ./image.ova --name lab-vm --datastore ds1
3. Install software inside VM → vmware-aiops vm guest-exec lab-vm --cmd /bin/bash --args "-c 'apt-get install -y nginx'" --user root
4. Create baseline snapshot → vmware-aiops vm snapshot-create lab-vm --name baseline
5. Set TTL for auto-cleanup → vmware-aiops vm set-ttl lab-vm --minutes 480

Batch Clone for Testing

1. Create plan: vm_create_plan with multiple clone + reconfigure steps
2. Review plan with user (shows affected VMs, irreversible warnings)
3. Apply: vm_apply_plan executes sequentially, stops on failure
4. If failed: vm_rollback_plan reverses executed steps
5. Set TTL on all clones for auto-cleanup

Migrate VM to Another Host

1. Check VM info via vmware-monitor → verify power state and current host
2. Migrate: vmware-aiops vm migrate my-vm --to-host esxi-02
3. Verify migration completed

---

VM Lifecycle

| Operation | Command | Confirmation | vCenter | ESXi | |-----------|---------|:------------:|:-------:|:----:| | Power On | vm power-on | — | ✅ | ✅ | | Graceful Shutdown | vm power-off | Double | ✅ | ✅ | | Force Power Off | vm power-off --force | Double | ✅ | ✅ | | Reset | vm reset | — | ✅ | ✅ | | Suspend | vm suspend | — | ✅ | ✅ | | Create VM | vm create --cpu --memory --disk | — | ✅ | ✅ | | Delete VM | vm delete | Double | ✅ | ✅ | | Reconfigure | vm reconfigure --cpu --memory | Double | ✅ | ✅ | | Create Snapshot | vm snapshot-create --name | — | ✅ | ✅ | | List Snapshots | vm snapshot-list | — | ✅ | ✅ | | Revert Snapshot | vm snapshot-revert --name | — | ✅ | ✅ | | Delete Snapshot | vm snapshot-delete --name [--no-wait] | — | ✅ | ✅ | | Task Status | vm task-status | — | ✅ | ✅ | | Clone VM | vm clone --new-name | — | ✅ | ✅ | | vMotion | vm migrate --to-host | — | ✅ | ❌ | | Set TTL | vm set-ttl --minutes | — | ✅ | ✅ | | Cancel TTL | vm cancel-ttl | — | ✅ | ✅ | | List TTLs | vm list-ttl | — | ✅ | ✅ | | Clean Slate | vm clean-slate [--snapshot baseline] | Double | ✅ | ✅ | | Guest Exec | vm guest-exec --cmd /bin/bash --args "..." | — | ✅ | ✅ | | Guest Exec (with output) | vm guest-exec-output --cmd "df -h" | — | ✅ | ✅ | | Guest Upload | vm guest-upload --local f.sh --guest /tmp/f.sh | — | ✅ | ✅ | | Guest Download | vm guest-download --guest /var/log/syslog --local ./syslog | — | ✅ | ✅ |

> Guest Operations require VMware Tools running inside the guest OS. guest-exec-output auto-detects Linux/Windows shell and captures stdout/stderr.

Plan → Apply (Multi-step Operations)

For complex operations involving 2+ steps or 2+ VMs, use the plan/apply workflow instead of executing individually:

| Step | What Happens | |------|-------------| | 1. Create Plan | AI calls vm_create_plan — validates actions, checks targets in vSphere, generates plan with rollback info | | 2. Review | AI shows plan to user: steps, affected VMs, irreversible warnings | | 3. Apply | vm_apply_plan executes sequentially; stops on failure | | 4. Rollback (if failed) | Asks user whether to rollback, then vm_rollback_plan reverses executed steps (irreversible steps skipped) |

Plans stored in ~/.vmware-aiops/plans/, auto-deleted on success, auto-cleaned after 24h.

VM Deployment & Provisioning

| Operation | Command | Speed | vCenter | ESXi | |-----------|---------|:-----:|:-------:|:----:| | Deploy from OVA | deploy ova --name | Minutes | ✅ | ✅ | | Deploy from Template | deploy template --name | Minutes | ✅ | ✅ | | Linked Clone | deploy linked-clone --source --snapshot --name | Seconds | ✅ | ✅ | | Attach ISO | deploy iso --iso "[ds] path/to.iso" | Instant | ✅ | ✅ | | Convert to Template | deploy mark-template | Instant | ✅ | ✅ | | Batch Clone | deploy batch-clone --source --count | Minutes | ✅ | ✅ | | Batch Deploy (YAML) | deploy batch spec.yaml | Auto | ✅ | ✅ |

Cluster Management

| Operation | Command | Confirmation | vCenter | ESXi | |-----------|---------|:------------:|:-------:|:----:| | Cluster Info | cluster info | — | ✅ | ❌ | | Create Cluster | cluster create [--ha] [--drs] | — | ✅ | ❌ | | Delete Cluster | cluster delete | Double | ✅ | ❌ | | Add Host | cluster add-host --host | Double | ✅ | ❌ | | Remove Host | cluster remove-host --host | Double | ✅ | ❌ | | Configure HA/DRS | cluster configure [--ha/--no-ha] [--drs/--no-drs] | Double | ✅ | ❌ |

> remove-host requires the host to be in maintenance mode first; the host is moved out of the cluster into the datacenter's host folder as a standalone host.

Alarm Management

| Operation | Command | Confirmation | vCenter | ESXi | |-----------|---------|:------------:|:-------:|:----:| | List Triggered Alarms | alarm list [--target ] | — | ✅ | ❌ | | Acknowledge Alarm | alarm acknowledge | — | ✅ | ❌ | | Clear (Reset) Alarms | alarm reset | Double | ✅ | ❌ |

> Blast radius: vSphere has no per-alarm clear API. alarm reset uses AlarmManager.ClearTriggeredAlarms, which clears all triggered alarms matching the named alarm's entity type (host/VM/all) and current status (red/yellow) — not just the named one. The named alarm is looked up first (typos fail fast), and the output's scope field reports exactly what was cleared. Cleared alarms re-trigger automatically if their underlying condition persists.

Datastore Browser

| Feature | vCenter | ESXi | Details | |---------|:-------:|:----:|---------| | Browse Files | ✅ | ✅ | List files/folders in any datastore path | | Scan Images | ✅ | ✅ | Discover ISO, OVA, OVF, VMDK across all datastores |

Scheduled Scanning & Notifications

| Feature | Details | |---------|---------| | Daemon | APScheduler-based, configurable interval (default 15 min) | | Multi-target Scan | Sequentially scan all configured vCenter/ESXi targets | | Scan Content | Alarms + Events + Host logs (hostd, vmkernel, vpxd) | | Log Analysis | Regex pattern matching: error, fail, critical, panic, timeout, corrupt | | Structured Log | JSONL output to ~/.vmware-aiops/scan.log | | Webhook | Slack, Discord, or any HTTP endpoint | | Daemon Management | daemon start/stop/status, PID file, graceful shutdown |

Safety Features

| Feature | Details | |---------|---------| | Dry-Run Mode | --dry-run on any destructive command prints exact API calls without executing | | Plan → Confirm → Execute → Log | Structured workflow: show current state, confirm changes, execute, audit log | | Double Confirmation | All destructive ops (power-off, delete, reconfigure, snapshot-revert/delete, clone, migrate) require 2 sequential confirmations — no bypass flags | | Rejection Logging | Declined confirmations are recorded in the audit trail | | Audit Trail | All operations logged to ~/.vmware-aiops/audit.log (JSONL) with before/after state | | Input Validation | VM name, CPU (1-128), memory (128-1048576 MB), disk (1-65536 GB) validated | | Password Protection | .env file loading with permission check; never in shell history | | SSL Self-signed Support | disableSslCertValidation — only for ESXi with self-signed certs in isolated labs; production should use CA-signed certificates | | Prompt Injection Protection | vSphere event messages and host logs are truncated, stripped of control characters, and wrapped in boundary markers bef

…

Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: vmware-skills
• Source: vmware-skills/VMware-AIops
• License: MIT
• Homepage: https://skills.sh/zw008/VMware-AIops

Install and usage instructions live in the source repository linked above.