# Vmware Monitor

> >

- **Type:** Skill
- **Install:** `agentstack add skill-zw008-vmware-monitor-vmware-monitor`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [zw008](https://agentstack.voostack.com/s/zw008)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [zw008](https://github.com/zw008)
- **Source:** https://github.com/zw008/VMware-Monitor/tree/main/skills/vmware-monitor

## Install

```sh
agentstack add skill-zw008-vmware-monitor-vmware-monitor
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# VMware Monitor (Read-Only)

> **Disclaimer**: This is a community-maintained open-source project and is **not affiliated with, endorsed by, or sponsored by VMware, Inc. or Broadcom Inc.** "VMware" and "vSphere" are trademarks of Broadcom. Source code is publicly auditable at [github.com/zw008/VMware-Monitor](https://github.com/zw008/VMware-Monitor) under the MIT license.

Read-only VMware vCenter/ESXi monitoring — 21 MCP tools, zero destructive code.

> **Code-level safety**: This skill contains NO power, create, delete, snapshot, or modify operations. Not disabled — they don't exist in the codebase.
> **Companion skills**: [vmware-aiops](https://github.com/zw008/VMware-AIops) (VM lifecycle), [vmware-storage](https://github.com/zw008/VMware-Storage) (iSCSI/vSAN), [vmware-vks](https://github.com/zw008/VMware-VKS) (Tanzu Kubernetes), [vmware-nsx](https://github.com/zw008/VMware-NSX) (NSX networking), [vmware-nsx-security](https://github.com/zw008/VMware-NSX-Security) (DFW/firewall), [vmware-aria](https://github.com/zw008/VMware-Aria) (metrics/alerts/capacity), [vmware-avi](https://github.com/zw008/VMware-AVI) (AVI/ALB/AKO), [vmware-harden](https://github.com/zw008/VMware-Harden) (compliance baselines).
> | [vmware-pilot](../vmware-pilot/SKILL.md) (workflow orchestration) | [vmware-policy](../vmware-policy/SKILL.md) (audit/policy)

## What This Skill Does

All 21 tools are **read-only**.

| Category | Capabilities |
|----------|-------------|
| **Inventory** | List VMs, ESXi hosts, datastores, clusters, networks |
| **Health** | Active alarms, recent events (filter by severity/time), hardware sensors, host services |
| **Performance** | Real-time host & VM CPU/memory/disk/network utilisation (PerfManager) |
| **Capacity** | Datastore thin-provisioning over-commit, resource-pool reservation/usage |
| **Infra Health** | ESXi certificate expiry, license usage/expiry, NTP configuration health |
| **Snapshots** | Inventory-wide snapshot aging & sprawl (flag old snapshots) |
| **Activity** | In-flight tasks, active login sessions |
| **VM Details** | CPU, memory, disks, NICs, snapshots, guest OS, IP |
| **Scanning** | Scheduled alarm/log scanning with Slack/Discord webhooks |

## Quick Install

```bash
uv tool install vmware-monitor
vmware-monitor doctor
```

## When to Use This Skill

- List or search VMs, hosts, datastores, clusters
- Check active alarms or recent events
- Get detailed info about a specific VM
- Set up scheduled monitoring with webhook alerts
- Any read-only VMware query where safety is paramount

### Alarm/Event Output: `suggested_actions` Field

`get_alarms` and `get_events` results include a `suggested_actions` list.
Each item is a ready-to-use hint pointing to the correct companion skill and tool:

```json
{
  "alarm_name": "VM CPU Ready High",
  "entity_name": "prod-db-01",
  "suggested_actions": [
    "vmware-aiops: acknowledge_vcenter_alarm(entity_name='prod-db-01', alarm_name='VM CPU Ready High')",
    "vmware-aiops: reset_vcenter_alarm(entity_name='prod-db-01', alarm_name='VM CPU Ready High')"
  ]
}
```

AI agents (especially smaller local models) can read these hints directly to determine which skill and tool to call next, without needing to reason about skill routing themselves.

**Use companion skills for**:
- Power on/off, deploy, clone, migrate --> `vmware-aiops`
- iSCSI, vSAN, datastore management --> `vmware-storage`
- Tanzu Kubernetes clusters --> `vmware-vks`
- Load balancing, AVI/ALB, AKO, Ingress --> `vmware-avi`

## Related Skills — Skill Routing

| User Intent | Recommended Skill |
|-------------|------------------|
| Read-only vSphere monitoring, zero risk | **vmware-monitor** ← this skill |
| Storage: iSCSI, vSAN, datastores | **vmware-storage** |
| VM lifecycle, deployment, guest ops | **vmware-aiops** |
| Tanzu Kubernetes (vSphere 8.x+) | **vmware-vks** |
| NSX networking: segments, gateways, NAT | **vmware-nsx** |
| NSX security: DFW rules, security groups | **vmware-nsx-security** |
| Aria Ops: metrics, alerts, capacity planning | **vmware-aria** |
| Multi-step workflows with approval | **vmware-pilot** |
| Compliance baselines (CIS / 等保 / PCI-DSS), drift detection, LLM remediation advisor | **vmware-harden** (`uv tool install vmware-harden`) |
| Load balancer, AVI, ALB, AKO, Ingress | **vmware-avi** (`uv tool install vmware-avi`) |
| Audit log query | **vmware-policy** (`vmware-audit` CLI) |

## Common Workflows

> **Diagnostic investigations**: Before running any "why is X failing / down / abnormal" workflow, follow [`references/investigation-protocol.md`](references/investigation-protocol.md). It enforces the four root-cause completeness criteria (falsifiability / sufficiency / necessity / mechanism) and the up-to-three-rounds deepening loop. Since vmware-monitor is read-only, it serves as the data source — actuation belongs to companion skills like vmware-aiops.

### Daily Health Check

**Judgment**: alarms tell you what vCenter has decided is wrong, events tell you what happened. They diverge — an event burst with no alarms often signals a metric threshold miscalibration, not "everything is fine." Read both.

1. Check alarms --> `vmware-monitor health alarms --target prod-vcenter` — focus on Red severity AND alarms older than 1 hour (transient ones self-clear)
2. Review recent events --> `vmware-monitor health events --hours 24 --severity warning` — look for repeated events from the same entity (a single event is noise; 50 events in an hour is a pattern)
3. List hosts --> `vmware-monitor inventory hosts` — flag hosts disconnected, in maintenance mode unexpectedly, or memory > 90%
4. **If connection fails** --> run `vmware-monitor doctor` to diagnose config/network issues

### Investigate a Specific VM
1. Find the VM --> `vmware-monitor inventory vms --power-state poweredOff`
2. Get details --> `vmware-monitor vm info problem-vm`
3. Check related events --> `vmware-monitor health events --hours 48`
4. **If VM not found** --> verify VM name with `vmware-monitor inventory vms --limit 100` or check target with `--target `

### Performance Triage ("the cluster feels slow")
**Judgment**: inventory shows *configured* capacity (cores, GB); it cannot tell you what is actually hot. Use the real-time perf tools, then narrow.
1. Rank hosts --> `vmware-monitor perf hosts` — the busiest host floats to the top (sorted by CPU%)
2. Rank VMs on the suspect --> `vmware-monitor perf vms --limit 25` — find the noisy neighbour
3. Check for hidden storage pressure --> `vmware-monitor capacity datastores` — over-commit % > 100 means a thin datastore can fill mid-run even with "free" space showing
4. Rule out snapshot drag --> `vmware-monitor snapshots aging --only-old` — old snapshots silently degrade I/O
5. **If perf tools return empty** --> the host/VM may be disconnected or powered off (no real-time provider); confirm with `inventory hosts` / `inventory vms`

### Scheduled-Outage Pre-flight (certs, licenses, time)
1. Cert expiry --> `vmware-monitor infra certs --warn-days 60` — an expired ESXi cert drops host management
2. License headroom --> `vmware-monitor infra licenses` — catch over-allocation before it disables features
3. Time sync --> `vmware-monitor infra ntp` — `healthy: no` breaks SSO/Kerberos/log correlation (note: live offset is not exposed by the SOAP API, only config health)

### Set Up Continuous Monitoring
1. Configure webhook in `~/.vmware-monitor/config.yaml`
2. Start daemon --> `vmware-monitor daemon start`
3. Daemon scans every 15 min, sends alerts to Slack/Discord

## Usage Mode

| Scenario | Recommended | Why |
|----------|:-----------:|-----|
| Local/small models (Ollama, Qwen) | **CLI** | ~2K tokens vs ~8K for MCP |
| Cloud models (Claude, GPT-4o) | Either | MCP gives structured JSON I/O |
| Automated pipelines | **MCP** | Type-safe parameters, structured output |

## MCP Tools (21 — all read-only)

| Tool | Description |
|------|------------|
| `list_virtual_machines` | List VMs with filtering (power state, sort, limit, `folder_filter` for case-insensitive folder-tree search); each VM includes `folder_path` |
| `list_esxi_hosts` | ESXi hosts with CPU, memory, version, uptime |
| `list_all_datastores` | Datastores with capacity, free space, type |
| `list_all_clusters` | Clusters with host count, DRS/HA status |
| `list_all_networks` | Networks with attached VM count and accessibility |
| `get_alarms` | All active/triggered alarms — includes `suggested_actions` remediation hints |
| `get_events` | Recent events filtered by severity and time — includes `suggested_actions` hints |
| `get_host_sensors` | Hardware sensor status (temperature/voltage/fan) per host with green/yellow/red health |
| `get_host_services` | Host service status (running state and startup policy), optionally filtered by host |
| `vm_info` | Detailed VM info (CPU, memory, disks, NICs, snapshots) |
| `vm_list_snapshots` | Snapshot list for one VM with nesting hierarchy (read-only) |
| `host_performance` | **Real-time** host CPU/mem/disk/net utilisation (PerfManager); busiest first |
| `vm_performance` | **Real-time** VM CPU/mem/disk/net utilisation (top 25 by default); powered-on only |
| `snapshot_aging` | Inventory-wide snapshot sweep with age + sprawl; flags snapshots older than N days |
| `certificate_status` | Per-host ESXi management certificate expiry (days until expiry, expiring flag) |
| `license_status` | vCenter/ESXi license inventory with used/total and expiration |
| `ntp_status` | Per-host NTP config health (servers + ntpd state); live offset not in SOAP API |
| `datastore_capacity` | Datastore over-commit (provisioned vs capacity); thin-provisioning risk |
| `resource_pool_usage` | Resource-pool CPU/memory reservation, limit, and current usage |
| `active_tasks` | In-flight (and recently completed) vCenter tasks with progress/errors |
| `active_sessions` | Currently authenticated vCenter/ESXi sessions (who is logged in) |

All tools are **read-only**. No tool can modify, create, or delete any resource.
Performance/capacity readings are point-in-time samples — this skill retains no
history, so it never reports a fabricated "trend" or runway date.

## CLI Quick Reference

```bash
vmware-monitor inventory vms [--target ] [--limit 20] [--power-state poweredOn]
vmware-monitor inventory hosts [--target ]
vmware-monitor inventory datastores [--target ]
vmware-monitor inventory clusters [--target ]
vmware-monitor inventory networks [--target ]
vmware-monitor health alarms [--target ]
vmware-monitor health events [--hours 24] [--severity warning]
vmware-monitor health sensors [--target ]
vmware-monitor health services [--host ] [--target ]
vmware-monitor perf hosts [--host ] [--target ]
vmware-monitor perf vms [--vm ] [--limit 25] [--target ]
vmware-monitor capacity datastores [--target ]
vmware-monitor capacity pools [--target ]
vmware-monitor infra certs [--warn-days 30] [--target ]
vmware-monitor infra licenses [--target ]
vmware-monitor infra ntp [--host ] [--target ]
vmware-monitor snapshots aging [--threshold 30] [--only-old] [--target ]
vmware-monitor activity tasks [--active-only] [--target ]
vmware-monitor activity sessions [--target ]
vmware-monitor vm info  [--target ]
vmware-monitor scan now [--target ]
vmware-monitor daemon start|stop|status
vmware-monitor doctor [--skip-auth]
```

> Full CLI reference: see `references/cli-reference.md`

## Troubleshooting

### Alarms returns empty but vCenter shows alarms
The `get_alarms` tool queries triggered alarms at the root folder level. Some alarms are entity-specific — try checking events instead: `get_events --hours 1 --severity info`.

### "Connection refused" error
1. Run `vmware-monitor doctor` to diagnose
2. Verify target hostname/IP and port (443) in config.yaml
3. For self-signed certs: set `disableSslCertValidation: true`

### Events returns too many results
Use severity filter: `--severity warning` (default) filters out info-level events. Use `--hours 4` to narrow time range.

### VM info shows "guest_os: unknown"
VMware Tools not installed or not running in the guest. Install/start VMware Tools for guest OS detection, IP address, and guest family info.

### Doctor passes but commands fail with timeout
vCenter may be under heavy load. Try targeting a specific ESXi host directly instead of vCenter, or increase connection timeout in config.yaml.

## Setup

```bash
uv tool install vmware-monitor
vmware-monitor init      # guided: prompts for host/user/password, writes config + .env (chmod 600), then verifies
```

`init` stores the password grep-safe (obfuscated `b64:`, never plaintext) and
locks `.env` to 0600. Prefer it over hand-editing. Manual alternative:

```bash
mkdir -p ~/.vmware-monitor
cp config.example.yaml ~/.vmware-monitor/config.yaml
cp .env.example ~/.vmware-monitor/.env && chmod 600 ~/.vmware-monitor/.env
# Edit config.yaml (targets) and .env (passwords), then: vmware-monitor doctor
```

> All tools are automatically audited via vmware-policy. Audit logs: `vmware-audit log --last 20`

> Full setup guide, security details, and AI platform compatibility: see `references/setup-guide.md`

## Audit & Safety

All operations are automatically audited via vmware-policy (`@vmware_tool` decorator):
- Every tool call logged to `~/.vmware/audit.db` (SQLite, framework-agnostic)
- Policy rules enforced via `~/.vmware/rules.yaml` (deny rules, maintenance windows, risk levels)
- Risk classification: each tool tagged as low/medium/high/critical
- View recent operations: `vmware-audit log --last 20`
- View denied operations: `vmware-audit log --status denied`

vmware-policy is automatically installed as a dependency — no manual setup needed.

## License

MIT — [github.com/zw008/VMware-Monitor](https://github.com/zw008/VMware-Monitor)

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [zw008](https://github.com/zw008)
- **Source:** [zw008/VMware-Monitor](https://github.com/zw008/VMware-Monitor)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** yes
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-zw008-vmware-monitor-vmware-monitor
- Seller: https://agentstack.voostack.com/s/zw008
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.