Authenticate to Horizon and activate the session for this server.

The tokens are kept server-side: subsequent tool calls work immediately, and when the access token expires (~8 hours) the server renews it automatically with the refresh token. Only short token hints are returned.

Exchange the refresh token for a new access token.

Rarely needed: the server already refreshes an expired access token automatically.

Invalidate the current Horizon session (access + refresh tokens).

List all Horizon Connection Servers in the pod.

Get configuration details for a specific Connection Server.

List all vCenter Servers configured in the Horizon environment.

Get environment-level properties including version, FIPS mode, and feature flags.

Get the global Horizon configuration settings.

Includes client session timeouts, pre-launch settings, display protocol defaults, HTML Access settings, and other global options.

Get global VDI policies including USB redirection, multimedia redirection, clipboard settings, and other environment-wide policy settings.

Update global VDI policies (USB redirection, clipboard, multimedia redirection).

Always call get_global_policies first to read current values. Only modify the specific fields you intend to change — pass the full object back.

Update a Horizon settings section.

setting_type maps to these resources and endpoints: general → horizon://config/settings/general security → horizon://config/settings/security client → horizon://config/settings/client feature → horizon://config/settings/feature agent-restriction → horizon://config/settings/agent-restriction

Always read the current settings first and only modify the fields you intend to change.

general: Horizon returns restricted_client_data entries that have only a "type", but rejects them on update with "Restricted client version must be set for client type " (verified on 2606), so passing the settings back unchanged fails. Give every restricted_client_data entry a "version" before calling this.

List all Horizon licenses and their status, mode, and expiry information.

Get the configuration and connection status of the Horizon event database.

List instant clone domain accounts used for provisioning instant clone desktops.

List image management streams, versions, or tags.

Versions and tags belong to a stream, so Horizon requires a stream ID for them (verified live — omitting it returns 400 "im_stream_id parameter is missing"). List streams first, then pass a stream's id as stream_id.

List all registered Unified Access Gateways.

Initiate an immediate backup of one or more Connection Servers.

CAUTION: This triggers an active backup operation, not a validation check. If no server_ids are provided, all Connection Servers are backed up.

List all available Horizon MCP tools, resources, and unsupported operations.

Call this to understand what can be managed via this MCP server before attempting a task, or to accurately inform users which Horizon features are and are not supported.

Returns three sections: tools — all callable tools grouped by function resources — read-only MCP Resources (horizon://) for config and monitor data not_yet_supported — Horizon API operations not yet implemented

List entitlements for all pools of the given type.

Returns which users and groups are entitled to each pool. Use get_pool_entitlement for a specific pool's details.

Get the users and groups entitled to access a specific pool.

Add, replace, or remove entitlements for a desktop or application pool.

CAUTION: action='replace' removes any existing entitlements not in the provided list. CAUTION: action='remove' immediately revokes access for the specified principals. Always confirm with the user before using replace or remove.

NOTE: action='replace' is only supported for desktop pools — the Horizon API has no bulk-replace endpoint for application pools.

Search for AD users and groups in the Horizon environment.

Use the returned 'id' field when setting pool entitlements.

Common filter fields: name, login_name, group, domain. Example filters: Find user by login: {"type":"Equals","name":"login_name","value":"jsmith"} Find by display name: {"type":"Contains","name":"name","value":"John"} Groups only: {"type":"Equals","name":"group","value":"true"}

Returns {items, count, page, size, pages_fetched, has_more, next_page, truncated}. If has_more is true there may be more results: call again with page=next_page (or narrow the filter), or pass fetch_all=true to fetch pages automatically (stops after 10 pages or 5000 items and sets truncated=true). Never treat a result with has_more=true as the complete list.

Get detailed information about a specific AD user or group.

List all Active Directory domains configured in the Horizon environment.

Returns domain details including trust relationships, status, and bind accounts.

List AD containers (OUs) available in a domain for pool provisioning.

The rdn (relative distinguished name) from these results is used as ad_container_rdn in create_desktop_pool's customization_settings (or create_rdsh_farm's automated_farm_settings.customization_settings) to control which OU newly provisioned computers are placed in — NOT provisioning_settings. This is the OU picker equivalent of what the Horizon Console shows during pool creation.

Get a mapping of domain NETBIOS names to DNS names for all configured domains.

List Horizon audit events (administrative actions and system events).

Useful for reviewing recent changes, troubleshooting, and compliance auditing.

Returns {items, count, page, size, pages_fetched, has_more, next_page, truncated}. If has_more is true there may be more results: call again with page=next_page (or narrow the filter), or pass fetch_all=true to fetch pages automatically (stops after 10 pages or 5000 items and sets truncated=true). Never treat a result with has_more=true as the complete list.

List VMs in vCenter that can be used as base images for instant clone pools/farms.

List datastores available in vCenter for desktop pool or farm provisioning.

List VM folders in a vCenter datacenter for use in pool/farm configuration.

List datacenters in a vCenter Server.

The datacenter ID is required by list_vm_folders, list_hosts_or_clusters, and create_desktop_pool / create_rdsh_farm provisioning_settings.

List hosts and clusters in a vCenter datacenter.

The host_or_cluster_id is required by list_datastores, list_resource_pools, list_network_labels, and create_desktop_pool / create_rdsh_farm provisioning_settings.

List resource pools on a host or cluster.

The resource_pool_id is required by create_desktop_pool and create_rdsh_farm provisioning_settings.

List snapshots of a base VM that can be used as the image for an instant clone pool or farm.

The result's id is used as base_snapshot_id in create_desktop_pool's or create_rdsh_farm's provisioning_settings when source is INSTANT_CLONE.

CAUTION: don't just pick the first or most recent result. The chosen snapshot must have been taken AFTER the Horizon Agent (with Instant Clone support) was installed and configured on the VM — a snapshot from before that point will provision machines that fail customization (observed live: Horizon reports "AGENT_CUSTOMIZATION_FAULT ... IC Agent missing"). If multiple snapshots exist, check their names/descriptions for one indicating the agent is installed (e.g. containing "agent") rather than an earlier generic checkpoint (e.g. "clean"). When in doubt, ask the user which snapshot to use.

List network labels (port groups / distributed port groups) available on a host or cluster.

Network label IDs are used in the nics array of create_desktop_pool and create_rdsh_farm provisioning_settings: "nics": [{"nic_id": "", "network_label_id": ""}]

List the network interface cards (NICs) on a base VM or VM template.

Horizon requires either base_vm_id (instant-clone pools/farms, optionally with base_snapshot_id) or vm_template_id (full-clone pools) — verified live, omitting both returns 400.

Each result's id is the network_interface_card_id in the top-level nics array of create_desktop_pool / create_rdsh_farm: "nics": [{"network_interface_card_id": "", "network_label_assignment_specs": [...]}]

List VM templates available in vCenter for use as pool base images.

Templates are used for full-clone or linked-clone desktop pools (source=FULL_CLONE or LINKED_CLONE). Use the template_id in create_desktop_pool provisioning_settings instead of parent_vm_id.

List datastore clusters (Storage DRS pods) available on a host or cluster.

Use the datastore_cluster_id in create_desktop_pool or create_rdsh_farm provisioning_settings when using Storage DRS for automated datastore placement.

List vCenter customization specifications (Sysprep/QuickPrep) available for pool provisioning.

The customization_specification_id from these results is used in create_desktop_pool and create_rdsh_farm provisioning_settings to apply OS customization (hostname, domain join, license key) to provisioned VMs.

Retrieve diagnostic information for a user session in a single call.

Fetches any combination of: logon timing breakdown, real-time display protocol metrics, 15-minute historical performance, running processes, and active remote applications. Results are keyed by aspect name; a failed aspect returns {"error": ""} rather than failing the whole call.

The help desk endpoints take the session's internal_session_id, not its id (verified live: passing the id returns "Session with requested id was not found"), so this looks the session up first to get it.

Generate a Microsoft Remote Assistance ticket for a user session.

Returns an MSRA connection ticket that allows a help desk technician to view and control the user's desktop session.

Terminate a specific remote application running in a session.

CAUTION: The application will be force-closed. Unsaved data will be lost. Confirm with the user before calling this.

List all desktop pools (VDI and RDS) in the Horizon environment.

Returns {items, count, page, size, pages_fetched, has_more, next_page, truncated}. If has_more is true there may be more results: call again with page=next_page (or narrow the filter), or pass fetch_all=true to fetch pages automatically (stops after 10 pages or 5000 items and sets truncated=true). Never treat a result with has_more=true as the complete list.

Get detailed configuration and status of a specific desktop pool.

Uses the v13 endpoint (not v1) specifically so this response contains every field update_desktop_pool's schema can require — verified live, zero gap. Earlier versions of this tool used v1, whose response is missing most of those fields, making a real get-then-update round trip impossible without guessing at values Horizon never returns.

Create a new desktop pool.

CAUTION: Provisioning an AUTOMATED pool immediately begins creating VMs in vCenter. Always confirm with the user before calling this.

Update an existing desktop pool's configuration.

Delete a desktop pool and all of its machines.

CAUTION: This is irreversible. All machines in the pool are deleted and any active user sessions are terminated. Always confirm with the user before calling this.

Enable, disable, or toggle provisioning for one or more desktop pools.

enable/disable controls whether new user sessions can be established. enable-provisioning/disable-provisioning controls whether new VMs are provisioned. Disabling provisioning is the correct way to pause scale-out during maintenance.

List machines (virtual desktops) in the environment.

To filter by pool, use: filter={"type":"Equals","name":"desktop_pool_id","value":""} To filter by state, use: filter={"type":"Equals","name":"state","value":"AVAILABLE"}

Returns {items, count, page, size, pages_fetched, has_more, next_page, truncated}. If has_more is true there may be more results: call again with page=next_page (or narrow the filter), or pass fetch_all=true to fetch pages automatically (stops after 10 pages or 5000 items and sets truncated=true). Never treat a result with has_more=true as the complete list.

Get detailed information about a specific machine.

Perform a bulk action on one or more machines.

Actions:

• shutdown: gracefully power off (use force=true to override active sessions)

• restart: reboot the machine (use force=true to override active sessions)

• reset: hard reset (power cycle) — may cause data loss

• rebuild: re-provision the machine from the pool's image

• recover: recover a machine stuck in an error state

• enter_maintenance: put machine into maintenance mode (prevents new sessions)

• exit_maintenance: take machine out of maintenance mode

• archive: initiate machine archival

CAUTION: rebuild and reset are destructive and will discard unsaved user data. Always confirm with the user before calling these actions.

Assign or unassign users to a dedicated desktop machine.

Only applicable to machines in dedicated (non-floating) desktop pools. A machine can only have one assigned user at a time in most pool configurations.

List all RDS (Remote Desktop Session Host) farms in the environment.

Returns {items, count, page, size, pages_fetched, has_more, next_page, truncated}. If has_more is true there may be more results: call again with page=next_page (or narrow the filter), or pass fetch_all=true to fetch pages automatically (stops after 10 pages or 5000 items and sets truncated=true). Never treat a result with has_more=true as the complete list.

Get detailed information about a specific RDS farm.

Uses the v10 endpoint (not v1) so this response contains every field update_rdsh_farm's schema can require — verified live, zero gap (mirrors the same fix applied to get_desktop_pool).

Create a new RDS farm.

CAUTION: Provisioning an AUTOMATED farm immediately begins creating VMs in vCenter. Always confirm with the user before calling this.

Update an existing RDS farm's configuration.

Delete an RDS farm and all of its servers.

CAUTION: This is irreversible. All servers in the farm are deleted and any active user sessions are terminated. Always confirm with the user before calling this.

Enable or disable one or more RDS farms.

Disabling a farm prevents new sessions from being routed to it without terminating existing sessions — useful for draining a farm before maintenance.

Unlike desktop pools, farms have no bulk enable/disable endpoint, and Horizon's farm update schema requires several fields beyond "enabled" (verified live — a naive partial-body PUT gets rejected). So this fetches each farm's full current state first, changes only "enabled", and PUTs the complete spec back — a real get-then- update round trip, not a guess. Reports per-farm results if any still fail.

List published application pools in the environment.

Returns {items, count, page, size, pages_fetched, has_more, next_page, truncated}. If has_more is true there may be more results: call again with page=next_page (or narrow the filter), or pass fetch_all=true to fetch pages automatically (stops after 10 pages or 5000 items and sets truncated=true). Never treat a result with has_more=true as the complete list.

Get detailed information about a specific application pool.

Publish a new application pool from an RDS farm.

Update an existing application pool's configuration.

Horizon returns supported_file_types_data with both its auto-discovered file_types and enable_auto_update_file_types=true, then rejects that combination on update ("file_types cannot be set when enable_auto_update_file_types is enabled", verified on 2606). So when auto-update is on, file_types is dropped here: Horizon manages that list itself.

Delete a published application pool.

CAUTION: Users will immediately lose access to this application. Always confirm with the user before calling this.

List active user sessions in the environment.

Common filter fields: user_name, desktop_pool_id, machine_name, client_name, state. Session states: CONNECTED, DISCONNECTED, PENDING.

Returns {items, count, page, size, pages_fetched, has_more, next_page, truncated}. If has_more is true there may be more results: call again with page=next_page (or narrow the filter), or pass fetch_all=true to fetch pages automatically (stops after 10 pages or 5000 items and sets truncated=true). Never treat a result with has_more=true as the complete list.

Get detailed information about a specific user session.

Disconnect one or more user sessions (sessions remain active, clients are disconnected).

The user's applications keep running. Use logoff_sessions to fully terminate sessions.

Log off one or more user sessions, terminating their running applications.

CAUTION: This will close all running applications in the session. Unsaved data will be lost. Always confirm with the user before calling this.

Reset or restart the virtual machine backing one or more sessions.

CAUTION: Both actions will terminate the user's session. reset is a hard power-cycle and may cause data loss. restart attempts a graceful reboot but the session will still end. Always confirm with the user before calling this.

Send a pop-up notification message to one or more active user sessions.

Get health and status across Horizon infrastructure in a single call.

Components:

• summary: overall health rollup across all component types

• connection_servers: per-server reachability, load, and tunnel counts

• gateways: Unified Access Gateway connectivity status

• virtual_centers: vCenter Server connectivity and health

• ad_domains: Active Directory domain reachability and bind status

• farms: RDS farm health and server capacity

Results are keyed by component name. A failed component returns its error as a string rather than failing the whole call.

Get detailed health information for a specific Connection Server.

Get performance and capacity metrics across the Horizon environment in a single call.

Scopes:

• pools: session and machine counts per desktop pool

• sessions: aggregate connected/disconnected/pending session totals

• machines: aggregate machine state counts across all pools

• system: CPU and memory metrics for connection servers

• rds_servers: RDS server state counts across all farms

• license: current and peak license usage

Results are keyed by scope name. A failed scope returns its error as a string rather than failing the whole call.