Skip to main content
Glama
apollion69

vmware-aria-logs

by apollion69

VMware Aria Operations for Logs — MCP Server

PyPI version Python 3.11+ License: MIT Smithery

MCP server for querying and analyzing logs from VMware Aria Operations for Logs (formerly vRealize Log Insight). Provides log search, mass incident detection, and optional VMware Aria Operations (vROps) correlation.

Built for use with Claude Code, Claude Desktop, LobeChat, and any MCP-compatible client.

Features

  • Log Search — Query events with time range, text filters, and field constraints via Log Insight API v2

  • Incident Detection — Signature-based clustering to identify mass log incidents (Stormbreaker engine)

  • API Surface Probe — Detect appliance version and available API endpoints

  • Dashboard Listing — Enumerate saved dashboards (legacy vRLIC API, deprecated on 8.18+)

  • vROps Correlation — Cross-reference log entities with Aria Operations resources and alerts

Related MCP server: Log Analyzer MCP Server

Quick Start

uvx vmware-aria-logs

Install via pip

pip install vmware-aria-logs

Run with environment variables

export LI_BASE_URL=https://loginsight.example.com
export LI_USERNAME=admin
export LI_PASSWORD=your-password
export LI_PROVIDER=Local

vmware-aria-logs

MCP Tools

Tool

Description

query_events

Search log events with time range, text filter, field constraints

get_version

Get appliance version and probe API surface

list_dashboards

List saved dashboards (legacy vRLIC API, deprecated on 8.18+)

detect_incidents

Mass incident detection via signature clustering

find_vrops_resources

Find entities in Aria Operations by name

get_vrops_alerts

Get alerts for specific vROps resources

Configuration

Required Environment Variables

Variable

Description

Default

LI_BASE_URL

Log Insight appliance URL

LI_USERNAME

API username

admin

LI_PASSWORD

API password

LI_PROVIDER

Auth provider (Local, ActiveDirectory)

Local

LI_VERIFY_TLS

Verify TLS certificates

false

LI_TIMEOUT_SEC

HTTP request timeout (seconds)

30

Optional (vROps Correlation)

Variable

Description

Default

VROPS_BASE_URL

Aria Operations URL

VROPS_USERNAME

vROps username

admin

VROPS_PASSWORD

vROps password

VROPS_AUTH_SOURCE

Auth source

local

VROPS_VERIFY_TLS

Verify TLS certificates

false

VROPS_TIMEOUT_SEC

HTTP request timeout (seconds)

30

Claude Code / MCP Client Configuration

{
  "mcpServers": {
    "aria-logs": {
      "command": "uvx",
      "args": ["vmware-aria-logs"],
      "env": {
        "LI_BASE_URL": "https://loginsight.example.com",
        "LI_USERNAME": "admin",
        "LI_PASSWORD": "your-password"
      }
    }
  }
}

Why This Server?

VMware Aria Operations for Logs (Log Insight) is widely deployed in enterprise VMware environments, but lacks modern AI-assisted log analysis tooling. This MCP server bridges that gap:

  • Zero dependencies beyond the MCP SDK — uses Python stdlib urllib for HTTP

  • Stormbreaker engine — unique signature-based clustering that finds mass incidents humans miss

  • vROps correlation — cross-reference log events with infrastructure health in a single conversation

  • Works on v8.x+ — tested on Aria Operations for Logs 8.18.3, gracefully degrades deprecated APIs

Also Available On

License

MIT

Available Tools

6 tools
detect_incidentsA

Detect mass log incidents using signature clustering (Stormbreaker engine).

Queries events, groups them by normalized signature pattern, and returns clusters that exceed the mass threshold — ranked by event count.

Args: lookback_minutes: How far back to search (default 60 minutes). search_term: Free-text search term (optional, empty = all events). event_limit: Max events to fetch for analysis (default 5000). mass_threshold: Min events per signature to qualify as incident (default 5). max_incidents: Max incidents to return (default 20).

Returns: JSON with ranked incidents including signature, event count, blast radius (affected sources), and sample text.

ParametersJSON Schema
NameRequiredDescriptionDefault
lookback_minutesNo
search_termNo
event_limitNo
mass_thresholdNo
max_incidentsNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It transparently describes that the tool queries events, groups by signature, and returns clusters above a threshold. It does not mention any side effects or mutability, but the verb 'detect' implies a read-only operation. However, it lacks explicit non-destructive declaration.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a one-line purpose, a process overview, a parameter list with explanations, and a return value summary. Every sentence is informative and efficiently written without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has 5 parameters, no annotations, and an output schema exists, the description covers purpose, process, parameter semantics, and return format adequately. It provides sufficient context for an AI agent to understand and invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description compensates fully with clear explanations for all five parameters: lookback_minutes, search_term, event_limit, mass_threshold, max_incidents. Each has a concise purpose and default value stated, adding significant meaning beyond the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool detects mass log incidents using signature clustering with the Stormbreaker engine, distinguishing it from siblings like query_events (raw events) and list_dashboards (dashboards). It specifies the verb 'detect' and the resource 'incidents' with a clear methodology.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for detecting mass incidents via parameters like lookback_minutes, search_term, and mass_threshold. It does not explicitly state when to avoid using it or mention alternatives among siblings, but the specialized intent is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

find_vrops_resourcesA

Find resources in VMware Aria Operations (vROps) by name.

Useful for correlating Log Insight events with vROps monitored entities. Requires VROPS_BASE_URL to be configured.

Args: name: Resource name to search for (VM name, host name, etc.).

Returns: JSON array of matching vROps resources with IDs, names, and types.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations exist, so description carries burden. Discloses return format (JSON array with IDs, names, types) and prerequisite. Could mention case sensitivity or partial match behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Concise with 5 sentences including Args and Returns. Well-structured and free of fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple search tool with one parameter and output schema, description covers purpose, prerequisite, parameter, and return. Complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, but description adds meaning: 'Resource name to search for (VM name, host name, etc.)'. Compensates effectively.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states the verb 'find' and resource 'resources in VMware Aria Operations by name.' Distinguishes from siblings like get_vrops_alerts and query_events.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides a specific use case (correlating Log Insight events) and a prerequisite (VROPS_BASE_URL). Does not explicitly mention when to avoid use or list alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_versionA

Get VMware Aria Operations for Logs appliance version and API surface.

Returns version info and probes key API endpoints to determine which features are available on this deployment.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description bears full burden. It mentions probing key API endpoints but does not detail which endpoints or specify side effects (e.g., read-only). The description is adequate but lacks some behavioral details.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences with no fluff. The description is front-loaded with the main purpose and efficiently adds detail about probing endpoints.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple with no parameters, and an output schema exists. The description covers the key aspects (version and feature probing), so it is complete for this context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has no parameters, so schema coverage is 100% by default. The description adds value by explaining that the tool returns version info and probes endpoints for feature detection, beyond the empty schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Get' and the resource 'VMware Aria Operations for Logs appliance version and API surface'. It distinguishes from sibling tools like detect_incidents or query_events, which focus on different aspects.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use (to obtain version and feature availability). No explicit exclusions or alternatives are stated, but with no similar sibling tools, the context is clear enough.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_vrops_alertsB

Get alerts from VMware Aria Operations for specific resources.

Args: resource_ids: Comma-separated vROps resource IDs.

Returns: JSON array of alerts with severity, status, and descriptions.

ParametersJSON Schema
NameRequiredDescriptionDefault
resource_idsYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

B3.1/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so the description must disclose behavior. It mentions return format but fails to state that the operation is read-only, nor does it discuss authentication, rate limits, or side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is succinct and structured with Args and Returns sections, making it easy to scan. However, it could be more front-loaded with the key purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description is adequate for a simple retrieval tool with an output schema, but it lacks usage context, behavioral details, and differentiation from siblings.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description adds significant value by specifying that resource_ids are comma-separated vROps resource IDs, which is not in the schema. This compensates for the 0% schema description coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it gets alerts for specific resources using resource IDs. While it differentiates from siblings by focusing on alerts, it does not explicitly contrast with detect_incidents or query_events.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives. No prerequisites, conditions, or exclusions are mentioned, leaving the agent without context for proper selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_dashboardsA

List saved dashboards from Aria Operations for Logs.

Uses the legacy vRLIC API (/vrlic/api/v1/content/dashboards). This endpoint was deprecated in Aria Operations for Logs 8.18+ and will return an empty result on newer appliances.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It discloses that the tool uses a deprecated legacy API and will return empty results on newer systems, which is important behavioral context for the agent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three concise sentences with no fluff. The first sentence states the purpose, and the subsequent sentences provide critical caveats. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given zero parameters and an output schema, the description is fairly complete. It identifies the tool's purpose and its limitation (empty on new appliances). Could mention the return type, but output schema covers that.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There are no parameters, and schema coverage is 100%. The description adds no parameter information, which is acceptable because none exist.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'List saved dashboards from Aria Operations for Logs', specifying the verb and resource. It does not explicitly differentiate from sibling tools, but the action is distinct from detect_incidents, query_events, etc.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description mentions the legacy API and deprecation, warning that it returns empty on newer appliances. This provides some usage context but lacks explicit alternatives or when-not-to-use guidance compared to siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

query_eventsA

Search log events in VMware Aria Operations for Logs.

Args: lookback_minutes: How far back to search (default 60 minutes). search_term: Free-text search term (optional). limit: Maximum number of events to return (default 100, max 10000). field_name: Optional field constraint name (e.g. 'hostname', 'appname'). field_operator: Constraint operator (CONTAINS, NOT_CONTAINS, HAS, etc.). field_value: Constraint value.

Returns: JSON array of log events with text, source, timestamp, and fields.

ParametersJSON Schema
NameRequiredDescriptionDefault
lookback_minutesNo
search_termNo
limitNo
field_nameNo
field_operatorNoCONTAINS
field_valueNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. It mentions the return format and default values but does not explicitly state that this is a read-only, non-destructive operation. The agent must infer that from the verb 'search' and the return of log events.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and well-structured with a clear title, an Args block with parameter descriptions, and a Returns section. Every sentence adds value without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (6 parameters, no annotations, but with an output schema), the description covers the main aspects: input parameters with defaults and return format. It could mention that search_term is optional and the relationship between field_name, field_operator, and field_value, but it's largely complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description adds meaning beyond the input schema by explaining each parameter's purpose and constraints (e.g., 'limit: default 100, max 10000'). However, it does not list the accepted values for field_operator (e.g., CONTAINS, NOT_CONTAINS), which would enhance clarity.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Search' and resource 'log events' with a specific scope 'in VMware Aria Operations for Logs'. This distinguishes it from sibling tools like detect_incidents or get_vrops_alerts, which deal with different resource types.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance on when to use this tool versus alternatives. The description does not mention when not to use it or provide any context about preferred usage scenarios relative to siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. 6 tool updatesv0.1.0
    • First observeddetect_incidents
    • First observedfind_vrops_resources
    • First observedget_version
    • First observedget_vrops_alerts
    • First observedlist_dashboards
    • First observedquery_events

TDQS

A3.9/5.0
Disambiguation5/5

Each tool has a clearly distinct purpose: incident detection, resource lookup, version info, alerts, dashboards, and log queries. No overlapping functionality.

Naming Consistency5/5

All tool names follow a consistent verb_noun pattern in snake_case, e.g., detect_incidents, find_vrops_resources, query_events.

Tool Count5/5

6 tools is well-scoped for a log management server, covering core log analysis and cross-product integration without being too sparse or bloated.

Completeness3/5

Essential log query and incident detection are present, but missing CRUD for dashboards and incident management, leaving notable gaps in the tool surface.

Maintenance

ActivityInactive
ResponsivenessNo issues

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

  • A
    license
    B
    quality
    F
    maintenance
    An MCP server for searching and visualizing SolarWinds Observability logs, allowing users to query log data with filtering options and generate visual representations of log events over time.
    2
    1,422
    6
    MIT
  • A
    license
    Not graded
    quality
    D
    maintenance
    An MCP server for intelligent log analysis providing semantic search, error pattern clustering, and smart error detection. It enables users to process, vectorize, and query local logs to efficiently identify issues and generate AI-powered summaries.
    MIT
  • F
    license
    B
    quality
    B
    maintenance
    MCP server that integrates with Sumo Logic's API to perform log searches, data discovery, metrics queries, and monitoring.
    15
    6
    -

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/apollion69/vmware-aria-logs'

If you have feedback or need assistance with the MCP directory API, please join our Discord server