vcf-mcp
It gives an LLM agent full, authenticated API access to a VMware Cloud Foundation 9.1 estate through eight MCP tools.
vcf_targets – list every appliance and check reachability/operation counts.
vcf_search_api – find operations by intent (e.g. "commission hosts") across ~8,900 APIs.
vcf_describe_api – inspect an operation's parameters, required body fields, and responses.
vcf_validate – dry-run a request body against VCF validation endpoints without changing anything.
vcf_call – execute any API operation (GET/POST/PATCH/PUT/DELETE); auth and async task ids are handled.
vcf_task – check/wait on long-running tasks and see subtask failures.
vcf_inventory – snapshot domains, clusters, hosts, gateways, and alerts.
vcf_audit – review every mutating call made through the server, with redacted bodies.
Provides tools for interacting with VMware Cloud Foundation 9.1 APIs, enabling agents to search, describe, validate, call, and monitor operations across SDDC Manager, vCenter, NSX, Avi Load Balancer, VCF Operations, and vSAN Data Protection.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@vcf-mcplist all hosts in the SDDC and their states"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
vcf-mcp
An MCP server that gives an LLM agent full API access to a VMware Cloud Foundation 9.1 estate.
It connects to seven appliances — SDDC Manager, VCF Installer, vCenter, NSX, Avi Load Balancer, VCF Operations and vSAN Data Protection — and exposes their 8,931 API operations through eight tools. It handles authentication for each appliance, resolves request paths, follows async tasks, and records every mutating call.
It speaks MCP over stdio, so it works with any MCP client: Claude Code, Claude Desktop, Cursor, Windsurf, Zed, Continue, or your own agent built on an MCP SDK. There is nothing to install — point a client at:
uvx --from git+https://github.com/NiranEC77/vcf-mcp vcf-mcpContents
How it works · Install · Configure · Connect an agent · Tools · Targets · Environment variables · Write safety · Tests · VCF 9.1 behaviour
Related MCP server: vlp-mcp-agent
How it works
One tool per endpoint does not scale. 8,931 tool schemas would exhaust the context window before the agent asked its first question, and tool selection degrades badly past a few dozen options.
Instead, the OpenAPI specs are indexed once at startup into a compact record per operation (method, path, summary, operationId, tags). The agent then works the way an engineer does — search, read the schema, dry-run, execute, follow the task:
vcf_search_api("commission hosts") -> POST /v1/hosts (commissionHosts)
vcf_describe_api(operation_id=...) -> required fields, types, responses
vcf_validate(target, path, body) -> dry-runs the spec, changes nothing
vcf_call(target, method, path, body) -> executes it, auth handled
vcf_task(target, task_id) -> follows the async resultContext cost stays fixed however many operations exist. Adding an appliance means adding a spec file and a registry entry, not a new tool.
Authentication is per-appliance and automatic. Each target has its own scheme (see Targets); the server mints a token on first use, caches it in memory for the process lifetime, never writes it to disk, and re-mints it automatically on a 401/403.
Spec handling. Both dialects are parsed: OpenAPI 3.x (SDDC Manager,
Installer, Operations, vCenter) and Swagger 2.0 (NSX). Base paths differ per
spec — /suite-api for Operations, /api for vCenter, /policy/api/v1 for
NSX policy — and are resolved at index time, so paths returned by search are
real request paths you can pass straight to vcf_call.
Install
Requires network access to the appliances. Nothing else — uvx fetches,
builds and runs the server in one step, and the API specs ship inside the
package, so there is no separate download:
uvx --from git+https://github.com/NiranEC77/vcf-mcp vcf-mcp checkThat is also the command an MCP client should launch (see
Connect an agent). uvx comes with
uv; install it with
curl -LsSf https://astral.sh/uv/install.sh | sh.
To install it as a normal command instead:
uv tool install git+https://github.com/NiranEC77/vcf-mcp # then: vcf-mcp
pipx install git+https://github.com/NiranEC77/vcf-mcp # same, via pipx
pip install git+https://github.com/NiranEC77/vcf-mcp # into a venvOr work from a clone (Python 3.10+):
git clone https://github.com/NiranEC77/vcf-mcp.git && cd vcf-mcp
uv venv --python 3.12 && uv pip install -e .A clone keeps its config and logs in the repo directory; an installed copy
uses ~/.config/vcf-mcp/ and ~/.local/state/vcf-mcp/. Either way the
environment variables below override both.
Configure
1. Appliance addresses
No addresses are stored in this repo. Create a hosts.json — in
~/.config/vcf-mcp/ for an installed copy, or the repo root for a clone
(where it is gitignored), or anywhere if you set VCF_MCP_HOSTS_FILE:
{
"hosts": {
"sddc": "sddc-manager.example.local",
"installer": "vcf-installer.example.local",
"vcenter": "vcenter.example.local",
"nsx": "nsx-vip.example.local",
"ops": "vcf-ops.example.local",
"avi": "avi-controller.example.local",
"vsan-dp": "vcenter.example.local"
}
}Any target can instead be set with VCF_MCP_<TARGET>_HOST, which wins over the
file. vsan-dp is served by the vCenter appliance, so it takes the same
address as vcenter. Targets you leave out are reported as unconfigured by
vcf_targets rather than called.
2. Credentials
Passwords are read from a .env file — point VCF_MCP_ENV_FILE at whichever
file is already your rotation point, or create one next to hosts.json:
NSX_ADMIN_PASSWORD=...
SDDC_MANAGER_PASSWORD=...
VCF_INSTALLER_PASSWORD=...
NESTED_VCSA_PASSWORD=...
VCF_APPLIANCE_PASSWORD=...Each target tries its own ordered subset of these keys; empty values and
anything containing CHANGEME are skipped. A single target can be overridden
with VCF_MCP_<TARGET>_PASSWORD. Nothing is copied into the repo, and no tool
ever returns a secret — failures name the key they looked for, never a value.
Authentication is capped at 3 attempts per target
(config.MAX_AUTH_ATTEMPTS). vSphere SSO locks accounts after repeated
failures, so trying every password in the file is not a harmless fallback.
Avi has no standing credential anywhere. Its admin password is
VCF-generated and lives only in SDDC Manager's credential store. The server
fetches it at auth time (GET /v1/credentials, resourceType NSX_ALB), uses
it to log in, and never returns, logs or persists it. Set
VCF_MCP_AVI_PASSWORD to override this for a controller VCF does not manage.
Avi rejects HTTP Basic outright — only the session flow works.
3. Verify
vcf-mcp index # index all operations (~8s, then cached to disk)
vcf-mcp check # print every target and whether it answersPrefix with uvx --from git+https://github.com/NiranEC77/vcf-mcp if you have
not installed it. check names any target whose address is still unset.
Connect an agent
The server is a stdio process: run vcf-mcp with no arguments (equivalently,
python -m vcf_mcp) and it speaks MCP on stdin/stdout.
Any MCP client
Most clients read the same JSON shape. Add this to the client's MCP config —
no prior install needed, uvx handles it:
{
"mcpServers": {
"vcf": {
"command": "uvx",
"args": ["--from", "git+https://github.com/NiranEC77/vcf-mcp", "vcf-mcp"],
"env": {
"VCF_MCP_HOSTS_FILE": "/absolute/path/to/hosts.json",
"VCF_MCP_ENV_FILE": "/absolute/path/to/your/.env"
}
}
}
}If you installed it already, replace those two fields with
"command": "vcf-mcp" (or the absolute path to the executable, which some
clients require because they do not inherit your shell's PATH).
.mcp.example.json in this repo is that file, ready to copy. Where each client
keeps its config:
Client | Config location |
Claude Code |
|
Claude Desktop |
|
Cursor |
|
Windsurf |
|
Zed |
|
Continue |
|
Claude Code
claude mcp add vcf \
--env VCF_MCP_HOSTS_FILE=/absolute/path/to/hosts.json \
--env VCF_MCP_ENV_FILE=/absolute/path/to/your/.env \
-- uvx --from git+https://github.com/NiranEC77/vcf-mcp vcf-mcpYour own agent
Any MCP SDK can launch it as a subprocess. With the Python SDK:
from mcp import ClientSession, StdioServerParameters
from mcp.client.stdio import stdio_client
params = StdioServerParameters(
command="uvx",
args=["--from", "git+https://github.com/NiranEC77/vcf-mcp", "vcf-mcp"],
env={"VCF_MCP_HOSTS_FILE": "/absolute/path/to/hosts.json"},
)
async with stdio_client(params) as (read, write):
async with ClientSession(read, write) as session:
await session.initialize()
result = await session.call_tool("vcf_search_api", {"query": "commission hosts"})The server advertises read_only and destructive annotations per tool, so a
client that gates writes can do so without a hardcoded tool list.
Tools
Tool | Arguments | Returns |
|
| Every appliance: name, product, address, auth scheme, operation count, whether it answers |
|
| Ranked operations with method, full path, summary, operationId |
|
| Path/query parameters, resolved request body schema with required fields, response schemas |
|
|
|
|
| Status, response body, and |
|
| Task status and, on failure, which subtask failed and why |
|
| Domains, clusters, hosts, gateways and alerts in one snapshot |
|
| Recent mutating calls made through this server |
vcf_call is annotated as destructive; every other tool is annotated read-only.
Typical sequence for a change: vcf_search_api → vcf_describe_api →
vcf_validate → vcf_call → vcf_task.
Targets
Target | Product | Authentication | Operations |
| SDDC Manager |
| 500 |
| VCF Installer |
| 57 |
| vCenter Server |
| 1,367 |
| NSX Manager (VIP) | HTTP Basic | 5,182 |
| Avi Load Balancer (NSX ALB) |
| 1,233 |
| VCF Operations |
| 527 |
| vSAN Data Protection | vCenter session | 65 |
Every scheme above was verified against a live 9.1 estate.
Environment variables
Variable | Effect |
Defaults differ between a clone and an installed copy, as noted: |
Variable | Effect | Default (clone → installed) |
| Path to the addresses file |
|
| Override one address, e.g. | — |
| Path to the credentials |
|
| Override one target's password, e.g. | — |
| Installer's generated credentials file | alongside the |
| Enforce TLS verification | off — appliances present self-signed certs |
| Where mutations are recorded |
|
| Spec source directory |
|
| Index cache directory |
|
Write safety
There is no write gate. Any operation the API allows — including
DELETE /v1/domains/{id} and host decommission — executes immediately when the
agent calls it. This is deliberate: the server does not try to second-guess
which operations are safe.
What exists instead is a record. Every POST/PATCH/PUT/DELETE is appended to
logs/vcf-mcp-audit.jsonl with target, path, status, duration and a
redacted body — anything keyed like a password, token, secret or credential
is replaced before the line is written. vcf_audit reads it back, including
changes made by earlier sessions.
If you want a gate, client.request() is the single chokepoint that every call
in the server passes through.
Tests
.venv/bin/python -m pytest tests/ -q36 offline tests, no appliance required. Each pins a bug found during the
build: camelCase tokenisation, plural stemming, $ref cycle handling,
truncation across differently-named collections, secret redaction, task-id
detection, case-insensitive task states, and the rule that no appliance address
is ever hardcoded into the registry.
Specs
Vendored from vmware/vcf-api-specs
at commit 3949fc3 (2026-05-13), version 9.1.0.0. Provenance in
specs/SPECS-PROVENANCE.txt.
The 170 Avi object specs in specs/avi/ were downloaded from an Avi
controller's own swagger endpoint (/swagger/<Object>.yaml), so they are
version-matched to the deployed build by construction. Avi's per-object files
re-declare related objects' paths; the index deduplicates them and keeps the
declaration from the file named after the resource.
VCF 9.1 behaviour
Discovered while building against a live estate, and encoded in the server:
POST /v1/system/prechecksis gone; the replacement isPOST /v1/system/health-summary(startHealthCheck).The whole
/v1/edge-clustersfamily on SDDC Manager is deprecated, includingupdateEdgeCluster(PATCH /v1/edge-clusters/{id}).Deprecated operations are hidden from search unless
include_deprecatedis set. Well-scoring ones are still reported underhidden_deprecated, so a legacy path found in old documentation is identified as legacy rather than appearing not to exist.SDDC Manager returns task status as
"Successful", not"SUCCESSFUL";vcf_taskcompares case-insensitively.vCenter (vAPI) specs declare enums as prose ("Possible values: ...").
vcf_describe_apilifts them into a realenumlist.NSX often has the strictest password complexity rules of the fleet, so an estate is frequently built with one password NSX accepts.
NSX_ADMIN_PASSWORDis therefore tried first for several targets.
Available Tools
8 toolsvcf_auditARead-onlyIdempotent
Show recent mutating calls made through this server.
Every POST/PATCH/PUT/DELETE is logged with target, path, status and a redacted body. Use it to answer "what did I change?" -- including changes made by an earlier session.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses that the tool logs every POST/PATCH/PUT/DELETE and includes target, path, status, and redacted body, going beyond the annotation hints. It also notes that logs include changes from previous sessions, adding useful behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the primary purpose, followed by a concise explanation of the log contents and typical use case. No filler or unnecessary detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only tool with strong annotations and one self-explanatory parameter, the description covers purpose, output contents, and intended usage. It lists the log fields, so no separate output schema is needed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema includes a single 'limit' parameter (default 50) but the description does not explain its meaning or effect. Since schema description coverage is 0%, the description should have compensated but does not, leaving parameter semantics implicit.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: 'Show recent mutating calls made through this server.' It identifies the action (show) and resource (recent mutation logs), and it is distinct from sibling tools by focusing on audit history rather than current state.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides an explicit use case ('Use it to answer "what did I change?"') and notes it covers changes from earlier sessions. It does not explicitly exclude alternatives like vcf_inventory, but the context is clear enough for an agent to choose this tool for audit queries.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
vcf_callADestructive
Call a VCF API operation. Authentication is handled for you.
This performs real operations against real infrastructure. Reads are safe; POST/PATCH/PUT/DELETE change the estate, and some are irreversible (decommissioning a host, deleting a workload domain). Every mutating call is recorded to the audit log. Check vcf_describe_api first when writing.
Long-running operations return HTTP 202 and a task id -- follow it with vcf_task rather than assuming success.
Args: target: Appliance name from vcf_targets. method: GET, POST, PATCH, PUT or DELETE. path: Full request path including any base prefix, exactly as vcf_search_api reports it (e.g. "/v1/hosts", "/policy/api/v1/infra/segments/web-seg"). Substitute real ids for {placeholders}. query: Query parameters as an object. body: JSON request body. timeout: Seconds to wait (VCF operations can be slow; default 300). max_response_chars: Shrink oversized responses to fit (default 20000).
| Name | Required | Description | Default |
|---|---|---|---|
| body | No | ||
| path | Yes | ||
| query | No | ||
| method | Yes | ||
| target | Yes | ||
| timeout | No | ||
| max_response_chars | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
It goes far beyond annotations by noting authentication is handled, mutating operations change the estate and some are irreversible, every mutation is audit-logged, and long-running calls return HTTP 202 + task id. This is exactly the type of behavioral context raw API callers need.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is structured as a summary line, safety/async warnings, then a concise Args list. Each sentence adds unique value, and the high-risk nature of the tool justifies the length.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers dangerous side effects, auth, async task handling, path construction, and response-size truncation. However, it does not describe the general response envelope (status/body) or error behavior beyond 202, leaving some ambiguity for a raw API caller without an output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema coverage, the description fully compensates by explaining the role of each of the 7 parameters, including exact path format with examples, query/body types, timeout default, and max_response_chars. Every parameter is given operational meaning.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with 'Call a VCF API operation,' a specific verb+resource statement, and distinguishes itself from siblings by explaining how target/path come from vcf_targets/vcf_search_api and how vcf_task handles long-running results. It is unambiguous that this is the raw arbitrary API execution tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly instructs to check vcf_describe_api first when writing, and to follow HTTP 202 responses with vcf_task rather than assuming success. It also situates the tool among siblings by sourcing target from vcf_targets and path from vcf_search_api, giving clear when/how guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
vcf_describe_apiARead-onlyIdempotent
Show the full signature of one API operation before calling it.
Identify the operation either by operation_id (from vcf_search_api) or
by method plus path. Returns path/query parameters, the resolved
request body schema with required fields marked, and response schemas.
Always do this before a POST/PATCH/PUT -- VCF request bodies are large and unforgiving, and the schema names the required fields.
Args: depth: How deep to expand nested schemas (1-6, default 3). Raise it when a nested object shows "truncated". max_properties: Cap properties rendered per object (default 60).
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | ||
| depth | No | ||
| method | No | ||
| target | No | ||
| operation_id | No | ||
| max_properties | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and idempotentHint=true, and the description adds context by explaining what the tool returns (path/query parameters, request body schema with required fields, response schemas) and how depth/max_properties affect the output. It also warns that 'VCF request bodies are large and unforgiving', which is useful behavioral context. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and well-structured: a clear opening, a usage note, and a compact Args section. Every sentence adds value, with no redundant or filler content. The formatting with bullet-like Args makes scanning easy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, the description provides adequate information about return values (schemas, required fields, response schemas). It explains depth and max_properties, which are the main customization knobs. The missing 'target' parameter is a notable omission, but the tool is otherwise well-covered for its complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has 0% description coverage, so the description must compensate. It explains depth and max_properties well and mentions operation_id, method, and path as identification mechanisms. However, the 'target' parameter is completely absent from the description, leaving its meaning unclear. This gap prevents a higher score.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: 'Show the full signature of one API operation before calling it.' It identifies the specific resource (one API operation) and the verb 'Show', distinguishing it from siblings like vcf_call (which actually invokes) and vcf_search_api (which finds operations).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit guidance is provided: 'Always do this before a POST/PATCH/PUT' and 'Identify the operation either by operation_id (from vcf_search_api) or by method plus path.' This tells the agent exactly when to use this tool and how to specify the operation, while implying it is a pre-call step.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
vcf_inventoryARead-onlyIdempotent
Snapshot the estate: domains, clusters, hosts, gateways, alerts.
One call that answers "what have I got?" across SDDC Manager, vCenter, NSX and Operations. Unreachable appliances are reported inline rather than failing the whole snapshot.
Args: targets: Restrict to specific appliances (default: all with a recipe). per_section_limit: Items shown per section before summarising.
| Name | Required | Description | Default |
|---|---|---|---|
| targets | No | ||
| per_section_limit | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the readOnly/idempotent annotations, the description discloses two important behaviors: unreachable appliances are reported inline instead of failing the whole snapshot, and per_section_limit controls summarization. It also reveals that targets defaults to 'all with a recipe.' These details materially affect how the agent interprets the result, exceeding what annotations alone provide.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with a punchy summary, followed by a clarifying sentence on scope, a behavioral note, and a short Args list. Every sentence adds value—none are tautological or redundant. It is compact while still covering purpose, behavior, and parameters.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's broad scope (inventory across multiple VCF components) and lack of an output schema, the description adequately explains what is returned (domains, clusters, hosts, gateways, alerts), how sections work, and how failures are handled. It is complete enough for an agent to decide when to use it and what to expect.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has no descriptions and 0% coverage, so the Args section carries the full burden. It explains 'targets' as a restriction to specific appliances with a default of all, and 'per_section_limit' as the item count before summarization. This gives clear, actionable meaning beyond the bare schema types and defaults.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with 'Snapshot the estate: domains, clusters, hosts, gateways, alerts,' providing a specific verb and resource. It further clarifies the cross-system scope ('across SDDC Manager, vCenter, NSX and Operations') and positions it as a one-call overview tool, clearly distinguishing it from sibling tools like vcf_targets or vcf_search_api.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'One call that answers "what have I got?"' clearly establishes the intended use case for high-level estate snapshots. It also explains behavior on unreachable appliances, which sets expectations in failure scenarios. However, it does not explicitly name alternative tools or state when to avoid this tool, so it is a clear context without explicit exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
vcf_search_apiARead-onlyIdempotent
Find VCF API operations by intent, across ~7,700 indexed operations.
Search the way you would describe the task -- "commission hosts", "rotate passwords", "expand cluster", "list segments" -- rather than guessing a path. Results are ranked and include method, full request path, summary and operationId.
Args: query: What you want to do, in plain words. target: Restrict to one appliance (sddc, vcenter, nsx, ops, installer, vsan-dp). Strongly recommended when you know it. method: Restrict to GET/POST/PATCH/PUT/DELETE. limit: Maximum results (default 25). include_deprecated: Include operations VCF 9.1 marks deprecated.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| query | Yes | ||
| method | No | ||
| target | No | ||
| include_deprecated | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and destructiveHint, covering the safety profile. The description adds valuable behavioral context: results are ranked and include method, full path, summary, and operationId. It also explains the include_deprecated behavior, providing useful details beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured: a brief statement of purpose and scale, followed by practical usage guidance, then a clear list of argument descriptions. Every sentence adds value, and the examples ('commission hosts', 'rotate passwords') make the tool's intent immediately understandable without unnecessary verbosity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given there is no output schema, the description explains what results contain (method, path, summary, operationId) and how they are ordered (ranked). It covers all parameters, provides context for the deprecated filter, and gives performance expectations (~7,700 operations). The description is complete for this search tool's complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description carries the full burden for parameter semantics. It explicitly describes all five parameters: query, target (with appliance list), method (HTTP verbs), limit (default 25), and include_deprecated (VCF 9.1 deprecation). This fully compensates for the missing schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: 'Find VCF API operations by intent, across ~7,700 indexed operations.' It uses a specific verb (find) and resource (VCF API operations), and distinguishes itself from siblings like vcf_describe_api and vcf_call by focusing on search/discovery rather than describing or executing specific operations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear usage context: 'Search the way you would describe the task... rather than guessing a path.' It advises on using the target parameter when the appliance is known. However, it does not explicitly mention when not to use this tool or name alternative tools for related tasks, stopping short of a full when/when-not specification.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
vcf_targetsARead-onlyIdempotent
List every VCF appliance this server can talk to.
Start here. Returns each target's name, product, address, auth scheme,
how many API operations it serves, and whether it is currently answering.
The target name from this list is what every other tool expects.
| Name | Required | Description | Default |
|---|---|---|---|
| check_reachability | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the safety profile is known. The description adds value by disclosing the return content (name, product, address, auth scheme, operation count, reachability) and emphasizing the importance of the target name. It does not contradict annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and well-structured: a one-sentence purpose statement, a short 'Start here' directive, a list of return fields, and a note about the target name's role in other tools. Every sentence earns its place, and the key information is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple listing tool, the description covers the main purpose, the content of the output, and how to use the results with sibling tools. The one gap is the lack of explanation for the check_reachability parameter, but the overall guidance is sufficient for an agent to invoke the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has one parameter, check_reachability, with no description in the schema (0% coverage). The tool description does not mention this parameter at all, so it fails to compensate for the missing schema documentation. The parameter name alone is insufficient to explain its effect, especially since the description mentions reachability only in the return list, not tying it back to the parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: 'List every VCF appliance this server can talk to.' It uses a specific verb (list), a specific resource (VCF appliance), and immediately distinguishes this tool as the entry point by saying 'Start here' and noting that the target name is expected by other tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit guidance on when to use this tool: 'Start here.' It also explains that the returned target name is what every other tool expects, which tells the agent to use this tool first to get identifiers for subsequent operations. This is strong contextual guidance, even without naming alternatives explicitly.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
vcf_taskARead-onlyIdempotent
Check, or wait on, a long-running VCF task.
Most mutations return a task id instead of a result. This reports the task's current status and, when it fails, which subtask failed and why.
Args: target: sddc or installer. task_id: The id returned by vcf_call. wait_seconds: Poll until the task reaches a terminal state or this many seconds elapse. 0 (default) checks once and returns.
| Name | Required | Description | Default |
|---|---|---|---|
| target | Yes | ||
| task_id | Yes | ||
| wait_seconds | No | ||
| poll_interval | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses key behaviors beyond the annotations: it reports status, failure subtask and reason, and explains the polling behavior controlled by wait_seconds. No contradictions with the readOnlyHint/idempotentHint annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, front-loaded with the core purpose, and well-structured with a short intro, context, and Args list. Every sentence contributes value without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description provides sufficient context for a straightforward polling tool, including when to use it and what to expect on failure. It lacks explicit return format details (no output schema) and omits poll_interval, but overall covers the essential operational aspects.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds meaning for target (sddc or installer), task_id (returned by vcf_call), and wait_seconds (poll vs single check). However, it omits poll_interval entirely, leaving this parameter undocumented since schema coverage is 0%.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool checks or waits on a long-running VCF task and reports status, including which subtask failed and why. It distinguishes itself from vcf_call by explaining that mutations return a task id, which this tool then monitors.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context: use this after a mutation returns a task id, and it can check once or poll until terminal. It does not explicitly name alternatives, but the context is sufficient and the default behavior (wait_seconds=0) is explained.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
vcf_validateARead-onlyIdempotent
Test a spec against VCF's validation endpoint WITHOUT executing it.
SDDC Manager and the Installer pair most mutating endpoints with a validation twin that takes the same request body and checks it end to end -- POST /v1/clusters/validations for POST /v1/clusters, and so on. This is the safe way to iterate on a spec before committing it.
Give the real path (e.g. "/v1/hosts") or the validation path directly; the twin is resolved automatically, run, and polled to completion. Returns validated true/false plus each failed check with its error.
Targets without the /validations convention (vCenter uses ?action=check operations) get a list of the nearest check-style operations instead.
Args: target: Appliance name from vcf_targets (sddc and installer have the richest validation surface). path: The operation you intend to run, or its /validations path. body: The same JSON body you would give the real operation. wait_seconds: How long to poll for the validation verdict.
| Name | Required | Description | Default |
|---|---|---|---|
| body | No | ||
| path | Yes | ||
| target | Yes | ||
| wait_seconds | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Even though annotations already flag readOnlyHint, openWorldHint, idempotentHint, and non-destructive, the description adds substantial behavioral context: it does not execute, it polls to completion, it resolves the validation twin automatically, and it returns validated true/false plus each failed check. It also covers the edge case for non-conforming targets, which is not derivable from annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is detailed but every sentence earns its place. It front-loads the most critical fact ('WITHOUT executing it'), then explains the validation-twin pattern, the return format, the edge case, and finally parameter details in a structured list. It is neither bloated nor under-specified.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite having no output schema, the description discloses the return shape (validated true/false plus failed checks) and clarifies the polling behavior. It covers the main usage flow, the automatic twin resolution, and the fallback for targets without /validations. For a tool of this complexity, the description is complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has zero description coverage for all four parameters, yet the description's Args section clearly explains each: target (appliance name, with guidance on which have the richest surface), path (the actual operation or its /validations path), body (same JSON body as the real operation), and wait_seconds (poll duration). This fully compensates for the schema gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Test a spec against VCF's validation endpoint WITHOUT executing it.' This immediately distinguishes it from execution-oriented siblings like vcf_call. The explanation of validation twins further clarifies the purpose and the relationship to mutating endpoints.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly frames usage as 'the safe way to iterate on a spec before committing it,' signaling when to use it instead of actual execution. It also describes behavior for targets lacking the standard convention (fallback to listing check-style operations), giving practical guidance. The mention that sddc and installer have the richest validation surface adds targeting advice.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
8 tool updates
v0.1.0- First observed
vcf_audit - First observed
vcf_call - First observed
vcf_describe_api - First observed
vcf_inventory - First observed
vcf_search_api - First observed
vcf_targets - First observed
vcf_task - First observed
vcf_validate
TDQS
Scored across 8 tools
Each tool addresses a distinct stage in the VCF API workflow: target enumeration, operation search, schema inspection, estate snapshot, direct invocation, task tracking, validation, and auditing. No two tools overlap in core purpose; even search vs. describe vs. call are clearly separated.
All tools share the consistent 'vcf_' prefix and use lowercase snake_case, making them recognizable as a family. Naming style is slightly mixed—some are verb_noun (search_api, describe_api), some are bare nouns (targets, inventory, task), and some are bare verbs (call, validate)—but the pattern is still predictable and readable.
Eight tools is a well-scoped size for a VCF API gateway. Each tool serves a necessary function without redundancy, covering discovery, exploration, execution, validation, monitoring, and auditing in a focused set that is neither sparse nor overwhelming.
The tool surface forms a complete lifecycle for VCF API interaction: identify targets, find operations, inspect schemas, call safely, validate beforehand, track long-running tasks, and audit changes. There are no obvious dead ends or missing essential capabilities for the stated purpose.
Maintenance
Related MCP Connectors
An MCP server that provides an API to LLMs to manage their JumpCloud resources.
MCP server for AI agents to plan, verify, and deploy Cloudflare-native apps.
The Remote MCP server acts as a standardized bridge between LLM applications (like Claude, ChatGPT, and Cursor) and external services, enabling AI agents to access external tools and resources. Its primary capability is providing a centralized search tool to discover other MCP servers and their respective tools. Unlike local implementations, it runs remotely with OAuth authentication and permission controls for security.
MCP server for building and testing AI agents with multi-model experimentation and insights.
Related MCP Servers
- FlicenseNot gradedqualityCmaintenanceA comprehensive MCP server for VMware vSphere management, enabling AI agents to perform VM operations, monitoring, snapshots, and reporting through a secure, Dockerized environment.21-
- FlicenseNot gradedqualityDmaintenanceMCP server for automating VLP lab VM operations, exposing VM management tools to AI agents like Cursor and Claude Code.-
- AlicenseBqualityAmaintenanceAn MCP server that enables Claude and other LLM agents to manage and monitor Pexip Infinity deployments through natural language, with 122 tools for configuration, status, history, and command operations.761MIT
- AlicenseNot gradedqualityBmaintenanceAn MCP server that gives an LLM full control over a VMware-hosted Windows VM: lifecycle, snapshots, remote execution, file transfer, and kernel debugging.MIT