# vcf-ops-mpb-mcp

![vcf-ops-mpb-mcp](assets/social-preview.png)

[![npm](https://img.shields.io/npm/v/vcf-ops-mpb-mcp?color=3fb6a8)](https://www.npmjs.com/package/vcf-ops-mpb-mcp) ![Node.js](https://img.shields.io/badge/node-%3E%3D18.17-3fb6a8) ![License: MIT](https://img.shields.io/badge/license-MIT-3fb6a8) ![VCF Operations](https://img.shields.io/badge/VCF%20Operations-9.x-1f3348)

An MCP server for the **VCF Operations Management Pack Builder (MPB)**. Any MCP client (Claude, Cursor, VS Code, a local model) can design, test, verify, install and export REST management packs, without the built-in AI Assistant and with any LLM you choose.

> **Unsupported API.** MPB is driven through `/suite-api/internal/mpbuilder/*`, an internal VCF Operations API that is undocumented and can change between releases. Broadcom support does not cover MPB. Use in labs and for community packs; pin to a tested VCF Operations build.

## Why

- **No lock-in.** VCF 9.1.1's AI Assistant only works with Gemini or VCF Private AI. This server works with whatever agent you run.
- **Designs as code.** Export each pack as JSON into git and re-import it anywhere. After an upgrade that breaks MPB-built packs (9.1.1 did), re-run one pipeline to rebuild them.
- **The full loop, headless.** Source test → collection preview → verify → install, including the steps the MPB UI hides (persisting the test response, collector UUIDs, two-step session auth).

## Tools

| Group | Tool | What it does |
|---|---|---|
| Discover | `mpb_connection_status` | Checks auth and MPB reachability |
| | `mpb_list_designs` | Designs with status and install state |
| | `mpb_get_design` | Info, validation errors, source, sections |
| | `mpb_get_design_status` | VALID / INVALID / VERIFIED and every error |
| | `mpb_get_item` | One request/object/relationship/event, or a `default` template |
| | `mpb_list_existing_object_types` / `mpb_get_existing_object_type` | Built-in object types to extend or relate to |
| | `mpb_list_collectors` | Collector `uuId`s for source tests |
| | `mpb_test_regex` | MPB's own regex check |
| Author | `mpb_create_design`, `mpb_update_design_info` | Create, rename, bump version |
| | `mpb_set_source`, `mpb_set_source_configuration` | Data source, auth, account fields |
| | `mpb_upsert_item`, `mpb_delete_items` | Requests, objects, relationships, events |
| | `mpb_import_design` | Import a JSON envelope, fixing known import quirks |
| | `mpb_delete_designs` | Delete designs |
| Test | `mpb_test_source` | Source test on a collector, saved into the design |
| | `mpb_run_request` | Run one request through MPB |
| | `mpb_collection_preview`, `mpb_verify_design` | Preview and verify |
| Ship | `mpb_install`, `mpb_install_status` | Build and install the pack |
| | `mpb_ship` | Test → preview → verify → install in one call |
| | `mpb_export_design` | Write the design to a JSON file, credential values removed |
| Raw | `mpb_api_call` | Any `/internal/mpbuilder/*` or `/api/*` call |

Resource `mpb://guide` explains the pipeline and the API's quirks to the agent.

**Safety:** `MPB_READ_ONLY=true` removes every tool that changes VCF Operations from the tool list. Deletes and installs return a dry run unless called with `confirm: true`. Install refuses designs that are not VALID, because MPB otherwise reports success and does nothing. Credentials passed to `mpb_test_source` are sent to VCF Operations for the test and are never written to disk.

## Setup

Requires Node.js 18.17 or later, and a VCF Operations 9.x account with the Developer Center / Management Pack Builder privilege.

```bash
npx -y vcf-ops-mpb-mcp          # run without installing
npm install -g vcf-ops-mpb-mcp  # or install the vcf-ops-mpb-mcp command
```

From source: `git clone https://github.com/imtrinity94/vcf-ops-mpb-mcp.git && cd vcf-ops-mpb-mcp && npm install`.

### Claude Desktop / Claude Code

```json
{
  "mcpServers": {
    "vcf-ops-mpb": {
      "command": "npx",
      "args": ["-y", "vcf-ops-mpb-mcp"],
      "env": {
        "VCFOPS_HOST": "ops.vmw.lab",
        "VCFOPS_USER": "admin",
        "VCFOPS_PASSWORD": "********",
        "VCFOPS_INSECURE_TLS": "true",
        "MPB_DESIGNS_DIR": "/path/to/mpb-designs"
      }
    }
  }
}
```

### Environment

| Variable | Default | Purpose |
|---|---|---|
| `VCFOPS_HOST` | – | VCF Operations FQDN (scheme and `/suite-api` are stripped) |
| `VCFOPS_USER` / `VCFOPS_PASSWORD` | – | Account with MPB privilege |
| `VCFOPS_AUTH_SOURCE` | (local) | Auth source name for non-local accounts |
| `VCFOPS_INSECURE_TLS` | `false` | Accept self-signed lab certificates |
| `VCFOPS_CA_FILE` | – | PEM file to trust instead |
| `MPB_READ_ONLY` | `false` | Hide every write tool |
| `MPB_DESIGNS_DIR` | `./mpb-designs` | Where exports go and relative imports resolve |
| `VCFOPS_TIMEOUT_MS` | `120000` | Per-request timeout |
| `MPB_MAX_OUTPUT_CHARS` | `60000` | Truncate large tool results |

Claude Code, one line:

```bash
claude mcp add vcf-ops-mpb -e VCFOPS_HOST=ops.vmw.lab -e VCFOPS_USER=admin -e VCFOPS_PASSWORD='********' -e VCFOPS_INSECURE_TLS=true -- npx -y vcf-ops-mpb-mcp
```

## How it works

```
AI agent (any LLM) ──MCP/stdio──▶ vcf-ops-mpb-mcp ──HTTPS + vRealizeOpsToken──▶ VCF Operations
                                                    X-Ops-API-use-unsupported   /suite-api/internal/mpbuilder/*
                                                                                    │
                                     design JSON in git ◀── export / import ──────┘
```

Pipeline: create or import design → set source → add requests, objects, relationships, events → source test (saved into the design) → collection preview → verify → install → export.

## Development

```bash
npm test   # runs the MCP server against an in-memory VCF Operations mock
```

Changes are listed in [CHANGELOG.md](CHANGELOG.md).

## Typical prompts

- "List my MPB designs and tell me why Synology is INVALID."
- "Import `synology.json`, test it with password X on the first collector, preview, verify, and install it."
- "Create a pack for the Veeam REST API: source `https://veeam.vmw.lab:9419/api`, a jobs request, a Backup Job object with duration and status."
- "Export every VALID design into the designs folder."

## Status

v1.0.0 is tested against an in-memory mock that follows the documented MPB behaviour (`npm test`). Still to check on a live VCF Operations 9.1.1 lab: the exact response shapes of preview jobs and the per-section POST bodies. Use `mpb_api_call` to look at raw responses if a tool's summary looks wrong.

## Credits

The MPB API mapping (endpoints, wire format, import quirks, the import → test → preview → verify → install recipe) comes from the research in [sentania-labs/vcf-content-factory](https://github.com/sentania-labs/vcf-content-factory) (MIT). See [NOTICE.md](NOTICE.md). This server is a new implementation and shares no code with it.

## License

MIT