Skip to main content
Glama
CyberKnightLabs

vmware-knight

VMware Knight

VMware Knight is an MCP-powered VMware operations toolkit for managing vCenter Server and standalone ESXi hosts through AI-assisted and command-line workflows.

It is designed for environments where operators need to work across multiple VMware targets without constantly remembering long FQDNs, IP addresses, or editing configuration files by hand.

Two VMware Knight features are especially important:

  • Friendly target tags — assign a simple alias such as lab-vcenter, prod-vcenter, or esxi-lab-01 to each VMware target and use that alias directly from Claude, Codex, the MCP server, or the CLI.

  • Interactive management wizard — add, edit, remove, tag, test, and configure VMware targets through a guided terminal interface.

VMware Knight also includes VMware lifecycle, deployment, guest operations, cluster management, datastore browsing, alarm operations, investigation workflows, scheduled scanning, plan/apply workflows, and an MCP server for AI-assisted operations.

VMware Knight is a community project and is not an official VMware product.


About the Author

Ehsan Emad

Technology Lead | Principal Solutions Architect | Strategic Advisory | Enterprise Networking | Cybersecurity | Data Center | Agentic AI Enthusiast | MBA | CCDE #20210029 | 4× CCIE #28551 | CISSP | 2× NSE 7 | OpenShift Certified | Cisco Champion | Cisco Fire Jumper Elite

Ehsan Emad is a technology leader and principal solutions architect with extensive experience across enterprise networking, cybersecurity, data center architecture, infrastructure automation, and technical advisory.

He is the creator of VMware Knight, Cisco Knight Multi-Device MCP, Networking With Ehsan, and the TechLoungeCast podcast.

VMware Knight was created to make VMware infrastructure easier to operate through modern AI and MCP workflows while keeping target selection explicit, understandable, and manageable across environments containing multiple vCenter Servers and standalone ESXi hosts.


1. Friendly Target Tags

Managing several vCenter Servers and standalone ESXi hosts can become difficult when every operation depends on remembering IP addresses, FQDNs, or long infrastructure names.

VMware Knight adds an optional friendly tag/alias to every VMware target.

Instead of asking an AI assistant to operate against:

vc.networkingwithehsan.local

you can assign:

lab-vcenter

and then simply ask:

Using VMware Knight, list all VMs on lab-vcenter.

The same idea works for standalone ESXi hosts:

esxi-lab-01
esxi-lab-02
esxi-edge-01

Related MCP server: VMware-AIops

How target resolution works

A configured VMware target can be referenced by:

  1. Friendly tag

  2. Configured target name

  3. Hostname or IP address

Example:

targets:
  - name: vcenter
    tag: lab-vcenter
    host: vc.networkingwithehsan.local
    type: vcenter
    username: administrator@vsphere.local
    port: 443
    verify_ssl: false

All of the following resolve to the same target:

lab-vcenter
vcenter
vc.networkingwithehsan.local

The friendly tag is normally the easiest identifier to use with Claude or Codex.

Example prompts

Show me the VMs on lab-vcenter.
Check cluster health on prod-vcenter.
List the VMs running on esxi-lab-01.
Show active alarms on dr-vcenter.

Tag safety

VMware Knight validates identifiers to prevent ambiguous target selection.

A tag cannot conflict with the name, hostname/IP, or tag of another configured target.

Target matching is case-insensitive, so these refer to the same configured identifier:

lab-vcenter
LAB-VCENTER
Lab-vCenter

Tags are optional. Existing target names and hostname/IP references remain valid.

For multi-vCenter and multi-ESXi environments, descriptive tags are recommended.


2. Interactive Management Wizard

VMware Knight includes a guided terminal wizard so you do not need to manually edit the VMware target YAML configuration for normal day-to-day management.

Start it with:

vmware-knight wizard

The wizard displays:

VMware Knight Management Wizard

1. List VMware targets
2. Add VMware target
3. Edit VMware target
4. Remove VMware target
5. Set/Change target tag
6. Test connections
7. Configure MCP clients
8. Exit

2.1 List VMware targets

Choose:

1. List VMware targets

The wizard displays the configured targets with information such as:

  • target name

  • friendly tag

  • target type

  • hostname or IP address

  • username

  • port

This makes it easy to confirm the exact identifiers available to the MCP server.


2.2 Add a VMware target

Choose:

2. Add VMware target

The wizard guides you through adding either:

  • a vCenter Server

  • a standalone ESXi host

You are prompted for the target information, including:

  • target name

  • friendly tag/alias

  • hostname or IP address

  • target type

  • username

  • HTTPS port

  • TLS certificate verification preference

  • password

The configuration is validated before it is accepted.

Example:

Target name: vcenter
Friendly tag/alias: lab-vcenter
vCenter/ESXi host: vc.networkingwithehsan.local

Target type:
1. vCenter
2. ESXi

Select target type: 1
Username: administrator@vsphere.local
Port: 443
Verify TLS certificate? No
Password: ********

After enrollment, the target can be referenced by the friendly tag:

lab-vcenter

2.3 Edit a VMware target

Choose:

3. Edit VMware target

The wizard shows the configured targets and asks which one you want to modify.

You can update:

  • name

  • tag

  • hostname/IP

  • vCenter or ESXi target type

  • username

  • port

  • TLS verification

  • password

If you rename a target, VMware Knight migrates the stored credential reference to the new target name.

The configuration is validated before the change is accepted.


2.4 Remove a VMware target

Choose:

4. Remove VMware target

The wizard asks you to select the target and confirm removal.

Removing a target removes:

  • the target from VMware Knight configuration

  • its stored password entry

The wizard requires confirmation before completing the removal.


2.5 Set or change a target tag

Choose:

5. Set/Change target tag

This option provides a fast way to change only the friendly alias without editing the rest of the target configuration.

Example:

vcenter -> lab-vcenter

or:

esxi-01 -> esxi-lab-01

The new tag is validated against the identifiers of all other targets before it is saved.


2.6 Test VMware connections

Choose:

6. Test connections

VMware Knight runs its connection and environment checks against the configured targets.

Use this after:

  • adding a new vCenter

  • adding an ESXi host

  • changing a password

  • changing a hostname/IP

  • modifying TLS settings

  • troubleshooting MCP connectivity

You can also run the diagnostic command directly:

vmware-knight doctor

2.7 Configure MCP clients

Choose:

7. Configure MCP clients

VMware Knight currently focuses its wizard-driven MCP configuration on:

  1. Claude Desktop

  2. OpenAI Codex

The wizard asks for the VMware Knight executable path and writes or updates the selected MCP client configuration.

The default executable location is typically:

~/.local/bin/vmware-knight

The generated MCP server name is:

vmware-knight

3. Installation

Option A — Clone from GitHub

This is the recommended installation method while working directly from the project repository.

git clone https://github.com/CyberKnightLabs/vmware-knight-mcp.git
cd vmware-knight-mcp

Install with uv:

uv tool install .

Or install directly from GitHub without cloning first:

uv tool install git+https://github.com/CyberKnightLabs/vmware-knight-mcp.git

With pip:

pip install git+https://github.com/CyberKnightLabs/vmware-knight-mcp.git

After installation, verify the CLI:

vmware-knight --help

You should also have the MCP entry point:

vmware-knight-mcp

Option B — Development installation

Clone the repository:

git clone https://github.com/CyberKnightLabs/vmware-knight-mcp.git
cd vmware-knight-mcp

Create/use the project environment:

uv sync

Run commands from the source tree:

uv run vmware-knight --help

Start the wizard:

uv run vmware-knight wizard

Run the MCP server:

uv run vmware-knight mcp

4. First-Time Setup

After installing VMware Knight, start the wizard:

vmware-knight wizard

Recommended first-time sequence:

1. Choose "Add VMware target"
2. Add your vCenter or standalone ESXi host
3. Assign a friendly tag
4. Run "Test connections"
5. Repeat for additional VMware targets
6. Choose "Configure MCP clients"
7. Configure Claude Desktop or Codex
8. Restart the MCP client

Example environment:

Name            Tag              Type       Host
--------------  ---------------  ---------  -------------------------------
vcenter         lab-vcenter      vcenter    vc.networkingwithehsan.local
esxi-01         esxi-lab-01      esxi       10.10.10.51
esxi-02         esxi-lab-02      esxi       10.10.10.52

After setup, the AI assistant can use the tags directly.

Example:

Using VMware Knight, show me all VMs on lab-vcenter.

5. Configuration Files

VMware Knight stores its configuration under:

~/.vmware-knight/

Primary files include:

~/.vmware-knight/config.yaml
~/.vmware-knight/.env

The main configuration can also be overridden with:

VMWARE_KNIGHT_CONFIG

Example:

VMWARE_KNIGHT_CONFIG=/path/to/config.yaml vmware-knight doctor

Example target configuration

targets:
  - name: vcenter
    tag: lab-vcenter
    host: vc.networkingwithehsan.local
    type: vcenter
    username: administrator@vsphere.local
    port: 443
    verify_ssl: false

  - name: esxi-01
    tag: esxi-lab-01
    host: 10.10.10.51
    type: esxi
    username: root
    port: 443
    verify_ssl: false

For normal operation, use the wizard instead of manually editing this file.


6. MCP Client Setup

Claude Desktop

The wizard can configure Claude Desktop automatically:

vmware-knight wizard

Then select:

7. Configure MCP clients
1. Claude Desktop

A typical Claude Desktop MCP entry looks like:

{
  "mcpServers": {
    "vmware-knight": {
      "command": "/Users/yourname/.local/bin/vmware-knight",
      "args": ["mcp"]
    }
  }
}

Restart Claude Desktop after updating the MCP configuration.

Example prompt:

Using VMware Knight, list the VMs on lab-vcenter.

OpenAI Codex

The wizard can also configure Codex:

vmware-knight wizard

Then select:

7. Configure MCP clients
2. Codex

A typical Codex configuration looks like:

[mcp_servers.vmware-knight]
command = "/Users/yourname/.local/bin/vmware-knight"
args = ["mcp"]
enabled = true
startup_timeout_sec = 120

Restart Codex after changing its MCP configuration.

Example:

Using VMware Knight, show me the VMs on esxi-lab-01.

7. How VMware Knight Works

The basic workflow is:

User
  |
  v
Claude / Codex
  |
  v
VMware Knight MCP Server
  |
  +--> resolve target by tag / name / host
  |
  v
pyVmomi / vSphere APIs
  |
  +--> vCenter Server
  |      |
  |      +--> Clusters
  |      +--> ESXi Hosts
  |      +--> Virtual Machines
  |      +--> Datastores
  |
  +--> Standalone ESXi Host

When the AI sends a target such as:

lab-vcenter

VMware Knight resolves that identifier to the configured VMware target before establishing the connection.


8. Capabilities Overview

VMware Knight includes operations across the following areas:

Area

Capabilities

VM Lifecycle

Power operations, VM creation, deletion, reconfiguration, snapshots, clone, migration

Deployment

OVA deployment, templates, linked clones, ISO attachment, batch deployment

Guest Operations

Command execution, file upload, file download

Plan / Apply

Multi-step execution plans with review and rollback support

Cluster Management

Cluster information, creation, deletion, HA/DRS configuration, host membership

Datastore

Browse datastore content and discover deployment images

Networking

Distributed port group and host VMkernel management workflows

Alarm Management

List, acknowledge, and reset triggered alarms

Investigation

VM, host, datastore, cluster, and cross-vCenter investigation workflows

Scanning

Scheduled alarm, event, and ESXi host-log scanning

Notifications

JSONL logging and webhook-based notification workflows

MCP

Structured VMware operations through Claude and Codex

CLI

Direct command-line operation without an AI client


9. Quick Investigation Workflows

VMware Knight includes read-oriented investigation commands that help identify problems before making changes.

Examples:

vmware-knight attention

Show issues requiring attention across configured vCenter targets.

vmware-knight summary

Show a cluster-oriented health summary.

vmware-knight investigate vm web-01 --hours 72

Correlate information around a VM.

vmware-knight investigate host esxi-01

Correlate information around a host.

vmware-knight investigate datastore datastore1

Correlate information around a datastore.

Offline HTML output is also available for supported investigation workflows:

vmware-knight investigate vm web-01 --html

Some investigation workflows delegate read-only aggregation to the companion vmware-monitor library.


10. VM Lifecycle

VMware Knight supports common virtual-machine lifecycle operations.

Operation

CLI Example

vCenter

ESXi

Power On

vm power-on <name>

Yes

Yes

Graceful Shutdown

vm power-off <name>

Yes

Yes

Force Power Off

vm power-off <name> --force

Yes

Yes

Create VM

vm create <name> --cpu --memory --disk

Yes

Yes

Delete VM

vm delete <name>

Yes

Yes

Reconfigure VM

vm reconfigure <name> --cpu --memory

Yes

Yes

Create Snapshot

vm snapshot-create <name> --name <snap>

Yes

Yes

List Snapshots

vm snapshot-list <name>

Yes

Yes

Revert Snapshot

vm snapshot-revert <name> --name <snap>

Yes

Yes

Delete Snapshot

vm snapshot-delete <name> --name <snap>

Yes

Yes

Task Status

vm task-status <task-id>

Yes

Yes

Clone VM

vm clone <name> --new-name <new>

Yes

Yes

vMotion

vm migrate <name> --to-host <host>

Yes

No

Set TTL

vm set-ttl <name> --minutes <n>

Yes

Yes

Cancel TTL

vm cancel-ttl <name>

Yes

Yes

List TTLs

vm list-ttl

Yes

Yes

Clean Slate

vm clean-slate <name> --snapshot baseline

Yes

Yes

Example using a target tag:

vmware-knight vm power-on web-01 --target lab-vcenter

11. Guest Operations

Guest operations require VMware Tools inside the guest operating system.

Examples:

vmware-knight vm guest-exec web-01 \
  --cmd /bin/bash \
  --args "-c 'whoami'" \
  --user root

Upload a file:

vmware-knight vm guest-upload web-01 \
  --local ./script.sh \
  --guest /tmp/script.sh \
  --user root

Download a file:

vmware-knight vm guest-download web-01 \
  --guest /var/log/syslog \
  --local ./syslog.txt \
  --user root

Guest usernames are explicit. VMware Knight does not silently assume root.


12. Plan / Apply Workflow

For multi-step operations, VMware Knight supports a plan-oriented workflow.

Typical sequence:

Create Plan
    |
    v
Validate Operations
    |
    v
Review Affected Objects
    |
    v
Confirm
    |
    v
Apply Sequentially
    |
    +--> Success
    |
    +--> Failure --> Rollback available operations

Core MCP operations include:

vm_create_plan
vm_apply_plan
vm_rollback_plan

Plans are stored under:

~/.vmware-knight/plans/

Successful plans are automatically removed, and stale plans are cleaned up.


13. VM Deployment and Provisioning

VMware Knight includes several deployment workflows.

Operation

Example

Deploy OVA

deploy ova ./ubuntu.ova --name lab-vm --datastore ds1

Deploy Template

deploy template golden-ubuntu --name new-vm

Linked Clone

deploy linked-clone --source base-vm --snapshot clean --name test-vm

Attach ISO

deploy iso my-vm --iso "[datastore1] iso/ubuntu.iso"

Mark Template

deploy mark-template golden-vm

Batch Clone

deploy batch-clone --source base-vm --count 5 --prefix lab

Batch Deploy

deploy batch deploy.yaml

Example:

vmware-knight deploy ova ./ubuntu.ova \
  --name ubuntu-lab-01 \
  --datastore datastore1 \
  --target lab-vcenter

14. Cluster Management

Cluster operations include:

Operation

Command

Cluster Info

cluster info <name>

Create Cluster

cluster create <name> --ha --drs

Delete Cluster

cluster delete <name>

Add Host

cluster add-host <cluster> --host <host>

Remove Host

cluster remove-host <cluster> --host <host>

Configure HA/DRS

cluster configure <name> --ha --drs

Example:

vmware-knight cluster info LAB-CLUSTER --target lab-vcenter

Removing a host from a cluster requires the appropriate VMware state, including maintenance-mode requirements where applicable.


15. Alarm Management

VMware Knight supports VMware alarm workflows.

List triggered alarms:

vmware-knight alarm list --target lab-vcenter

Acknowledge an alarm:

vmware-knight alarm acknowledge esxi-01 "Host memory usage"

Reset alarms:

vmware-knight alarm reset esxi-01 "Host memory usage"

Reset operations should be reviewed carefully because VMware alarm-clear APIs may affect multiple alarms within the selected scope.


16. Datastore Operations

Browse datastore content:

vmware-knight datastore browse datastore1 --path "iso/"

Scan for deployment images:

vmware-knight datastore scan-images --target lab-vcenter

Image discovery can locate content such as:

ISO
OVA
OVF
VMDK

17. Scheduled Scanning

VMware Knight includes scheduled scanning for operational visibility.

Start the daemon:

vmware-knight daemon start

Check status:

vmware-knight daemon status

Stop it:

vmware-knight daemon stop

Run a one-time scan:

vmware-knight scan now

The scanner can work across multiple configured targets and process operational information such as:

  • triggered alarms

  • vCenter events

  • ESXi host logs

  • scan findings

  • incomplete/unreachable target conditions

Structured scan output is written under the VMware Knight configuration directory.


18. Safety Model

Infrastructure automation requires explicit safety controls.

VMware Knight includes safeguards around write and destructive operations.

Depending on the operation and interface, these include:

  • dry-run or preview behavior

  • explicit confirmation

  • additional confirmation for destructive operations

  • plan-before-apply workflows

  • audit logging

  • rollback information where supported

  • explicit target selection

  • identifier collision validation

  • no silent target switching

The friendly-tag system is also part of the safety model because it lets operators use understandable infrastructure identifiers while VMware Knight still resolves the target against a validated inventory.

Always review destructive operations before approving them.


19. Common Workflows

Deploy a lab VM

vmware-knight datastore browse datastore1 \
  --pattern "*.ova" \
  --target lab-vcenter
vmware-knight deploy ova ./ubuntu.ova \
  --name lab-vm \
  --datastore datastore1 \
  --target lab-vcenter
vmware-knight vm snapshot-create lab-vm \
  --name baseline \
  --target lab-vcenter
vmware-knight vm set-ttl lab-vm \
  --minutes 480 \
  --target lab-vcenter

Work with multiple VMware environments

Configure tags such as:

prod-vcenter
dr-vcenter
lab-vcenter
esxi-lab-01
esxi-lab-02

Then ask Claude or Codex:

Using VMware Knight, show me all VMs on lab-vcenter.
Using VMware Knight, check active alarms on prod-vcenter.
Using VMware Knight, list VMs on esxi-lab-01.

This is easier and safer than repeatedly typing raw IP addresses.


20. CLI Quick Reference

Diagnostics:

vmware-knight doctor
vmware-knight doctor --skip-auth

Wizard:

vmware-knight wizard

MCP server:

vmware-knight mcp

VM operations:

vmware-knight vm power-on my-vm --target lab-vcenter
vmware-knight vm power-off my-vm --target lab-vcenter
vmware-knight vm create new-vm --cpu 4 --memory 8192 --disk 100 --target lab-vcenter
vmware-knight vm delete my-vm --target lab-vcenter
vmware-knight vm snapshot-create my-vm --name before-upgrade --target lab-vcenter
vmware-knight vm snapshot-list my-vm --target lab-vcenter
vmware-knight vm snapshot-revert my-vm --name before-upgrade --target lab-vcenter
vmware-knight vm clone my-vm --new-name my-vm-clone --target lab-vcenter
vmware-knight vm migrate my-vm --to-host esxi-02 --target lab-vcenter
vmware-knight vm set-ttl my-vm --minutes 60 --target lab-vcenter
vmware-knight vm list-ttl --target lab-vcenter

Deployment:

vmware-knight deploy ova ./ubuntu.ova --name my-vm --datastore ds1 --target lab-vcenter
vmware-knight deploy template golden-ubuntu --name new-vm --target lab-vcenter
vmware-knight deploy linked-clone --source base-vm --snapshot clean --name test-vm --target lab-vcenter
vmware-knight deploy iso my-vm --iso "[datastore1] iso/ubuntu.iso" --target lab-vcenter

Cluster:

vmware-knight cluster info LAB-CLUSTER --target lab-vcenter
vmware-knight cluster create LAB-CLUSTER --ha --drs --target lab-vcenter
vmware-knight cluster configure LAB-CLUSTER --ha --drs --target lab-vcenter

Alarms:

vmware-knight alarm list --target lab-vcenter

Datastore:

vmware-knight datastore browse datastore1 --path "iso/" --target lab-vcenter
vmware-knight datastore scan-images --target lab-vcenter

Scanning:

vmware-knight scan now
vmware-knight daemon start
vmware-knight daemon status
vmware-knight daemon stop

21. Project Structure

vmware-knight-mcp/
├── vmware_knight/
│   ├── config.py
│   ├── connection.py
│   ├── doctor.py
│   ├── init_wizard.py
│   ├── setup_wizard.py
│   ├── cli/
│   ├── ops/
│   ├── scanner/
│   ├── notify/
│   └── mcp_server/
├── skills/
│   └── vmware-knight/
├── examples/
├── tests/
├── config.example.yaml
├── pyproject.toml
├── RELEASE_NOTES.md
└── README.md

22. Technology

VMware Knight is built primarily with:

  • Python

  • pyVmomi

  • Typer

  • FastMCP / Model Context Protocol

  • YAML-based target configuration

  • local credential/environment storage

  • automated pytest coverage


23. Testing

Run the project tests with:

uv run pytest -q

The project includes tests for areas such as:

  • configuration loading

  • target resolution

  • friendly tag resolution

  • identifier collision handling

  • wizard operations

  • credential migration

  • MCP configuration

  • lifecycle safety gates

  • plan/apply behavior

  • cluster operations

  • guest operations

  • alarms

  • deployment

  • regression coverage


24. Updating VMware Knight

If installed directly from GitHub with uv, reinstall from the repository:

uv tool install --force \
  git+https://github.com/CyberKnightLabs/vmware-knight-mcp.git

For a cloned repository:

cd vmware-knight-mcp
git pull origin main
uv sync

25. Troubleshooting

Check the installation

vmware-knight --help

Check VMware configuration

vmware-knight doctor

Check targets

vmware-knight wizard

Choose:

1. List VMware targets

Test connectivity

From the wizard choose:

6. Test connections

MCP client does not show VMware Knight

Confirm that:

  • the vmware-knight executable path exists

  • the MCP configuration uses the correct executable

  • the MCP server name is vmware-knight

  • the client has been restarted after changing its MCP configuration

For Codex, a typical block is:

[mcp_servers.vmware-knight]
command = "/Users/yourname/.local/bin/vmware-knight"
args = ["mcp"]
enabled = true
startup_timeout_sec = 120

TLS errors in a lab

If your lab uses a self-signed certificate, the wizard allows TLS certificate verification to be disabled for that target.

Do this only when you understand and accept the security implications.


26. Repository

GitHub:

https://github.com/CyberKnightLabs/vmware-knight-mcp

Clone:

git clone https://github.com/CyberKnightLabs/vmware-knight-mcp.git

27. License

MIT

See LICENSE for the complete license text.

Related MCP Connectors

Related MCP Servers

  • A
    license
    B
    quality
    D
    maintenance
    Enables AI assistants to manage and monitor VergeOS virtualization platforms through natural language, including VM operations, network management, tenant administration, and cluster monitoring.
    21
    MIT
  • A
    license
    A
    quality
    A
    maintenance
    AI-powered VMware vCenter/ESXi monitoring and operations. 20 MCP tools for inventory queries, health monitoring, VM lifecycle management, fast provisioning (Linked Clone, OVA, template deploy), snapshot management, and datastore browsing. Supports vSphere 6.5–8.0. Works with local models via Ollama/LM Studio.
    44
    980 PyPI
    73
    MIT
  • A
    license
    Not graded
    quality
    B
    maintenance
    Enables AI assistants to interact with Veeam Backup & Replication infrastructure through natural language, allowing monitoring, management, and troubleshooting of backup jobs, sessions, and restore points.
    MIT
  • A
    license
    Not graded
    quality
    C
    maintenance
    Enables natural language interaction with VMware SDDC Manager and vCenter APIs through MCP tools, allowing users to query workload domains, VMs, clusters, and more.
    MIT