# VMware AIops

> VMware vCenter/ESXi AI-powered monitoring and operations. Two skills: vmware-monitor (read-only, safe) and vmware-aiops (full operations) | Claude Code Skill

- **Type:** MCP server
- **Install:** `agentstack add mcp-vmware-skills-vmware-aiops`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [vmware-skills](https://agentstack.voostack.com/s/vmware-skills)
- **Installs:** 0
- **Category:** [Cloud & Infrastructure](https://agentstack.voostack.com/c/cloud-infrastructure)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [vmware-skills](https://github.com/vmware-skills)
- **Source:** https://github.com/vmware-skills/VMware-AIops
- **Website:** https://skills.sh/zw008/VMware-AIops

## Install

```sh
agentstack add mcp-vmware-skills-vmware-aiops
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# VMware AIops

> **Author**: Wei Zhou, VMware by Broadcom — wei-wz.zhou@broadcom.com
> This is a community-driven project by a VMware engineer, not an official VMware product.
> For official VMware developer tools see [developer.broadcom.com](https://developer.broadcom.com).

English | [中文](README-CN.md)

AI-powered VMware vCenter/ESXi VM lifecycle and deployment tool — 60 tools.

> **Companion skills** handle everything else:
>
> | Skill | Scope | Install |
> |-------|-------|---------|
> | **[vmware-monitor](https://github.com/vmware-skills/VMware-Monitor)** | Read-only: inventory, health, alarms, events, metrics | `uv tool install vmware-monitor` |
> | **[vmware-storage](https://github.com/vmware-skills/VMware-Storage)** | Datastores, iSCSI, vSAN management | `uv tool install vmware-storage` |
> | **[vmware-vks](https://github.com/vmware-skills/VMware-VKS)** | Tanzu Namespaces, TKC cluster lifecycle | `uv tool install vmware-vks` |
>
> **Need read-only monitoring only?** Use [VMware-Monitor](https://github.com/vmware-skills/VMware-Monitor) — zero destructive code in the codebase.

[](https://clawhub.ai/skills/vmware-aiops)
[](https://skills.sh/vmware-skills/VMware-AIops)
[](https://github.com/vmware-skills/VMware-AIops)
[](LICENSE)

## ⚡ Quick Investigation Reports (read-only)

Triage → investigate → act, all in one conversation. Five opinionated read-only reports **aggregate and correlate server-side** and hand back a high-signal result (never raw inventory), so you can decide *where to look* before changing anything. Each renders a **self-contained offline HTML snapshot** with `--html` (no external assets; drill-down detail collapses in native ``, zero JavaScript). All delegate to the [vmware-monitor](https://github.com/vmware-skills/VMware-Monitor) library using AIops's own vCenter connection.

| Question | Command | What it correlates |
|----------|---------|--------------------|
| **"What needs attention now?"** across all vCenters | `vmware-aiops attention` | Every vCenter merged into one globally-ranked issue list; unreachable targets degrade gracefully |
| **"Is anything on fire?"** across all clusters | `vmware-aiops summary` | Every cluster's hosts + VM power + live CPU/mem + alarms → ranked top-N issues + per-cluster status |
| **"What's happening around this VM?"** | `vmware-aiops investigate vm ` | VM state + host + cluster + backing datastores + snapshots + alarms + performance + a merged event timeline |
| **"What's happening around this host?"** | `vmware-aiops investigate host ` | Host state + cluster + the VMs it runs + mounted datastores + alarms + performance + correlated timeline |
| **"What's happening around this datastore?"** | `vmware-aiops investigate datastore ` | Capacity/free + mounting hosts + VMs it backs + alarms + correlated timeline |

```bash
vmware-aiops attention                            # what needs attention now, all vCenters
vmware-aiops investigate vm web-01 --hours 72     # everything around a VM, then act on it
vmware-aiops investigate vm web-01 --html         # → offline snapshot in ~/vmware-health/
```

Via MCP these are the tools `cluster_health_summary`, `cross_vcenter_attention`, `vm_investigation_bundle`, `host_investigation_bundle`, `datastore_investigation_bundle`. (Requires `vmware-monitor` installed.)

### Quick Install (Recommended)

Works with Claude Code, Cursor, Codex, Gemini CLI, Trae, and 30+ AI agents:

```bash
# Via Skills.sh
npx skills add vmware-skills/VMware-AIops

# Via ClawHub
clawhub install vmware-aiops
```

### PyPI Install (No GitHub Access Required)

```bash
# Install via uv (recommended)
uv tool install vmware-aiops

# Or via pip
pip install vmware-aiops

# China mainland mirror (faster)
pip install vmware-aiops -i https://pypi.tuna.tsinghua.edu.cn/simple
```

### Offline / Air-Gapped Install (from source)

This project uses the modern PEP 517 build system (hatchling), so there is **no
`setup.py`** by design — that is expected, not a missing file. If you cloned the
source and hit `ERROR: File "setup.py" or "setup.cfg" not found ... editable mode
currently requires a setuptools-based build`, your `pip` is older than 21.3 and
cannot do an *editable* (`-e`) install with a non-setuptools backend. Editable
mode is a developer convenience, not needed to run the tool — do one of:

```bash
# From the source tree — a normal (non-editable) install builds a wheel:
pip install .              # NOT  pip install -e .

# ...or upgrade pip first, and editable works too:
pip install --upgrade pip && pip install -e .
```

For a **truly air-gapped host**, build the wheels on a connected machine and copy
them over — the target then needs no network:

```bash
# On a connected machine, collect this package + its dependencies as wheels:
pip wheel . -w dist        # → dist/*.whl   (or: uv build, for just this package)

# Copy dist/ to the air-gapped host, then install offline:
pip install --no-index --find-links dist vmware-aiops
```

---

## Why this over other VMware MCP servers

Most open-source VMware MCP servers (e.g. `bright8192/esxi-mcp-server`,
`giuliolibrando/vmware-vsphere-mcp-server`) are **single-vCenter VM wrappers**:
list/power/snapshot a VM, basic monitoring, a `confirm=True` flag. They explicitly
do not cover networking, storage, Kubernetes, ops analytics, load balancing, or
compliance — and "logging is documented" is not an audit trail.

This is one skill in an **11-package family** that covers the whole estate and runs
every tool through a governed harness:

| | Other VMware MCP servers | This family |
|---|:---:|:---:|
| VM lifecycle + monitoring | ✅ | ✅ |
| NSX networking (segments/gateways/NAT/routing/IPAM) | ❌ | ✅ vmware-nsx |
| NSX security (DFW/groups/IDS-IPS/traceflow) | ❌ | ✅ vmware-nsx-security |
| Storage (datastore/iSCSI/vSAN) | ❌ | ✅ vmware-storage |
| Tanzu Kubernetes (Supervisor/Namespace/TKC) | ❌ | ✅ vmware-vks |
| Aria Operations (metrics/alerts/capacity) | ❌ | ✅ vmware-aria |
| AVI / NSX ALB load balancing + AKO | ❌ | ✅ vmware-avi |
| Compliance baselines + drift (CIS/SCG/等保/PCI) | ❌ | ✅ vmware-harden |
| **Governed harness** (unified audit, policy engine, token budget + runaway breaker, graduated risk tiers, undo-token, prompt-injection sanitize) | ❌ | ✅ vmware-policy on every tool |

If you only ever power-cycle VMs in one vCenter, a single-file server is fine. If you
run a real (regulated, NSX-segmented, multi-domain) VMware estate and need an AI
operator an auditor can sign off on, that's what this family is for — see
[docs/compliance-ready.md](../docs/compliance-ready.md).

## Capabilities Overview

### What This Skill Does

| Category | Tools | Count |
|----------|-------|:-----:|
| **VM Lifecycle** | power on/off, TTL auto-delete, clean slate | 6 |
| **Deployment** | OVA, template, linked clone, batch clone/deploy | 8 |
| **Guest Ops** | exec commands, upload/download files, provision | 5 |
| **Plan/Apply** | multi-step planning with rollback | 4 |
| **Cluster** | create, delete, HA/DRS config, add/remove hosts | 6 |
| **Datastore** | browse files, scan for images | 2 |
| **Network** | dvSwitch portgroup list/create, host VMkernel list/add/remove, DF-bit MTU-path ping | 6 |

### CLI vs MCP: Which Mode to Use

| Scenario | Recommended | Why |
|----------|:-----------:|-----|
| **Local/small models** (Ollama, Qwen  **Rule of thumb**: Use CLI for cost efficiency and small models. Use MCP for structured automation with large models.

### Architecture

```
User (Natural Language)
  ↓
AI CLI Tool (Claude Code / Gemini / Codex / Aider / Continue / Trae / Kimi)
  ↓ reads SKILL.md / AGENTS.md / rules
  ↓
vmware-aiops CLI
  ↓ pyVmomi (vSphere SOAP API)
  ↓
vCenter Server ──→ ESXi Cluster ──→ VM
    or
ESXi Standalone Host ──→ VM
```

### Version Compatibility

| vSphere / VCF Version | Support | Notes |
|----------------|---------|-------|
| VCF 9.1 / vSphere 9.1 | ✅ Full | Released 2026-05-12. pyVmomi ` pyVmomi auto-negotiates the API version during SOAP handshake — no manual configuration needed. The same codebase manages 7.0 / 8.0 / 9.0 / 9.1 environments seamlessly.

#### Official Broadcom References

- **SDKs**:  — VCF Python SDK (recommended for VCF 9+, bundles pyVmomi + vSAN SDK), vSphere Automation SDK for Python (REST APIs)
- **REST APIs**:  — vSphere Automation API, VCF API, SDDC Manager API
- **CLI Tools**:  — PowerCLI 9.1, ESXCLI, OVF Tool

---

## Common Workflows

### Deploy a Lab Environment

1. Browse datastore for OVA images → `vmware-aiops datastore browse  --pattern "*.ova"`
2. Deploy VM from OVA → `vmware-aiops deploy ova ./image.ova --name lab-vm --datastore ds1`
3. Install software inside VM → `vmware-aiops vm guest-exec lab-vm --cmd /bin/bash --args "-c 'apt-get install -y nginx'" --user root`
4. Create baseline snapshot → `vmware-aiops vm snapshot-create lab-vm --name baseline`
5. Set TTL for auto-cleanup → `vmware-aiops vm set-ttl lab-vm --minutes 480`

### Batch Clone for Testing

1. Create plan: `vm_create_plan` with multiple clone + reconfigure steps
2. Review plan with user (shows affected VMs, irreversible warnings)
3. Apply: `vm_apply_plan` executes sequentially, stops on failure
4. If failed: `vm_rollback_plan` reverses executed steps
5. Set TTL on all clones for auto-cleanup

### Migrate VM to Another Host

1. Check VM info via `vmware-monitor` → verify power state and current host
2. Migrate: `vmware-aiops vm migrate my-vm --to-host esxi-02`
3. Verify migration completed

---

## VM Lifecycle

| Operation | Command | Confirmation | vCenter | ESXi |
|-----------|---------|:------------:|:-------:|:----:|
| Power On | `vm power-on ` | — | ✅ | ✅ |
| Graceful Shutdown | `vm power-off ` | Double | ✅ | ✅ |
| Force Power Off | `vm power-off  --force` | Double | ✅ | ✅ |
| Reset | `vm reset ` | — | ✅ | ✅ |
| Suspend | `vm suspend ` | — | ✅ | ✅ |
| Create VM | `vm create  --cpu --memory --disk` | — | ✅ | ✅ |
| Delete VM | `vm delete ` | Double | ✅ | ✅ |
| Reconfigure | `vm reconfigure  --cpu --memory` | Double | ✅ | ✅ |
| Create Snapshot | `vm snapshot-create  --name ` | — | ✅ | ✅ |
| List Snapshots | `vm snapshot-list ` | — | ✅ | ✅ |
| Revert Snapshot | `vm snapshot-revert  --name ` | — | ✅ | ✅ |
| Delete Snapshot | `vm snapshot-delete  --name  [--no-wait]` | — | ✅ | ✅ |
| Task Status | `vm task-status ` | — | ✅ | ✅ |
| Clone VM | `vm clone  --new-name ` | — | ✅ | ✅ |
| vMotion | `vm migrate  --to-host ` | — | ✅ | ❌ |
| **Set TTL** | `vm set-ttl  --minutes ` | — | ✅ | ✅ |
| **Cancel TTL** | `vm cancel-ttl ` | — | ✅ | ✅ |
| **List TTLs** | `vm list-ttl` | — | ✅ | ✅ |
| **Clean Slate** | `vm clean-slate  [--snapshot baseline]` | Double | ✅ | ✅ |
| **Guest Exec** | `vm guest-exec  --cmd /bin/bash --args "..."` | — | ✅ | ✅ |
| **Guest Exec (with output)** | `vm guest-exec-output  --cmd "df -h"` | — | ✅ | ✅ |
| **Guest Upload** | `vm guest-upload  --local f.sh --guest /tmp/f.sh` | — | ✅ | ✅ |
| **Guest Download** | `vm guest-download  --guest /var/log/syslog --local ./syslog` | — | ✅ | ✅ |

> Guest Operations require VMware Tools running inside the guest OS. `guest-exec-output` auto-detects Linux/Windows shell and captures stdout/stderr.

### Plan → Apply (Multi-step Operations)

For complex operations involving 2+ steps or 2+ VMs, use the plan/apply workflow instead of executing individually:

| Step | What Happens |
|------|-------------|
| 1. **Create Plan** | AI calls `vm_create_plan` — validates actions, checks targets in vSphere, generates plan with rollback info |
| 2. **Review** | AI shows plan to user: steps, affected VMs, irreversible warnings |
| 3. **Apply** | `vm_apply_plan` executes sequentially; stops on failure |
| 4. **Rollback** (if failed) | Asks user whether to rollback, then `vm_rollback_plan` reverses executed steps (irreversible steps skipped) |

Plans stored in `~/.vmware-aiops/plans/`, auto-deleted on success, auto-cleaned after 24h.

## VM Deployment & Provisioning

| Operation | Command | Speed | vCenter | ESXi |
|-----------|---------|:-----:|:-------:|:----:|
| Deploy from OVA | `deploy ova  --name ` | Minutes | ✅ | ✅ |
| Deploy from Template | `deploy template  --name ` | Minutes | ✅ | ✅ |
| Linked Clone | `deploy linked-clone --source  --snapshot  --name ` | Seconds | ✅ | ✅ |
| Attach ISO | `deploy iso  --iso "[ds] path/to.iso"` | Instant | ✅ | ✅ |
| Convert to Template | `deploy mark-template ` | Instant | ✅ | ✅ |
| Batch Clone | `deploy batch-clone --source  --count ` | Minutes | ✅ | ✅ |
| Batch Deploy (YAML) | `deploy batch spec.yaml` | Auto | ✅ | ✅ |

## Cluster Management

| Operation | Command | Confirmation | vCenter | ESXi |
|-----------|---------|:------------:|:-------:|:----:|
| Cluster Info | `cluster info ` | — | ✅ | ❌ |
| Create Cluster | `cluster create  [--ha] [--drs]` | — | ✅ | ❌ |
| Delete Cluster | `cluster delete ` | Double | ✅ | ❌ |
| Add Host | `cluster add-host  --host ` | Double | ✅ | ❌ |
| Remove Host | `cluster remove-host  --host ` | Double | ✅ | ❌ |
| Configure HA/DRS | `cluster configure  [--ha/--no-ha] [--drs/--no-drs]` | Double | ✅ | ❌ |

> `remove-host` requires the host to be in **maintenance mode** first; the host is moved out of the cluster into the datacenter's host folder as a standalone host.

## Alarm Management

| Operation | Command | Confirmation | vCenter | ESXi |
|-----------|---------|:------------:|:-------:|:----:|
| List Triggered Alarms | `alarm list [--target ]` | — | ✅ | ❌ |
| Acknowledge Alarm | `alarm acknowledge  ` | — | ✅ | ❌ |
| Clear (Reset) Alarms | `alarm reset  ` | Double | ✅ | ❌ |

> **Blast radius**: vSphere has no per-alarm clear API. `alarm reset` uses `AlarmManager.ClearTriggeredAlarms`, which clears **all** triggered alarms matching the named alarm's entity type (host/VM/all) and current status (red/yellow) — not just the named one. The named alarm is looked up first (typos fail fast), and the output's `scope` field reports exactly what was cleared. Cleared alarms re-trigger automatically if their underlying condition persists.

## Datastore Browser

| Feature | vCenter | ESXi | Details |
|---------|:-------:|:----:|---------|
| Browse Files | ✅ | ✅ | List files/folders in any datastore path |
| Scan Images | ✅ | ✅ | Discover ISO, OVA, OVF, VMDK across all datastores |

## Scheduled Scanning & Notifications

| Feature | Details |
|---------|---------|
| Daemon | APScheduler-based, configurable interval (default 15 min) |
| Multi-target Scan | Sequentially scan all configured vCenter/ESXi targets |
| Scan Content | Alarms + Events + Host logs (hostd, vmkernel, vpxd) |
| Log Analysis | Regex pattern matching: error, fail, critical, panic, timeout, corrupt |
| Structured Log | JSONL output to `~/.vmware-aiops/scan.log` |
| Webhook | Slack, Discord, or any HTTP endpoint |
| Daemon Management | `daemon start/stop/status`, PID file, graceful shutdown |

## Safety Features

| Feature | Details |
|---------|---------|
| **Dry-Run Mode** | `--dry-run` on any destructive command prints exact API calls without executing |
| **Plan → Confirm → Execute → Log** | Structured workflow: show current state, confirm changes, execute, audit log |
| **Double Confirmation** | All destructive ops (power-off, delete, reconfigure, snapshot-revert/delete, clone, migrate) require 2 sequential confirmations — no bypass flags |
| **Rejection Logging** | Declined confirmations are recorded in the audit trail |
| **Audit Trail** | All operations logged to `~/.vmware-aiops/audit.log` (JSONL) with before/after state |
| **Input Validation** | VM name, CPU (1-128), memory (128-1048576 MB), disk (1-65536 GB) validated |
| **Password Protection** | `.env` file loading with permission check; never in shell history |
| **SSL Self-signed Support** | `disableSslCertValidation` — only for ESXi with self-signed certs in isolated labs; production should use CA-signed certificates |
| **Prompt Injection Protection** | vSphere event messages and host logs are truncated, stripped of control characters, and wrapped in boundary markers bef

…

## Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [vmware-skills](https://github.com/vmware-skills)
- **Source:** [vmware-skills/VMware-AIops](https://github.com/vmware-skills/VMware-AIops)
- **License:** MIT
- **Homepage:** https://skills.sh/zw008/VMware-AIops

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** yes
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/mcp-vmware-skills-vmware-aiops
- Seller: https://agentstack.voostack.com/s/vmware-skills
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.