Skip to main content
Glama

VMware Pilot

Author: Wei Zhou, VMware by Broadcom — wei-wz.zhou@broadcom.com This is a community-driven project by a VMware engineer, not an official VMware product. For official VMware developer tools see developer.broadcom.com.

English | 中文

Multi-step workflow orchestration for VMware MCP skills — state machine, approval gates, audit trail.

Companion skills handle everything else:

Skill

Scope

Install

vmware-aiops

VM lifecycle, deployment, guest ops, cluster

uv tool install vmware-aiops

vmware-monitor

Read-only: inventory, health, alarms, events

uv tool install vmware-monitor

vmware-storage

Datastores, iSCSI, vSAN management

uv tool install vmware-storage

vmware-vks

Tanzu Namespaces, TKC cluster lifecycle

uv tool install vmware-vks

vmware-nsx

NSX networking: segments, gateways, NAT

uv tool install vmware-nsx-mgmt

vmware-nsx-security

DFW firewall rules, security groups

uv tool install vmware-nsx-security

vmware-aria

Aria Ops: metrics, alerts, capacity

uv tool install vmware-aria

vmware-avi

AVI load balancing, pool management, AKO K8s ops

uv tool install vmware-avi

Install

uv tool install vmware-pilot
vmware-pilot mcp          # start the MCP server (stdio)

Offline / Air-Gapped Install (from source)

This project uses the modern PEP 517 build system (hatchling), so there is no setup.py by design — that is expected, not a missing file. If you cloned the source and hit ERROR: File "setup.py" or "setup.cfg" not found ... editable mode currently requires a setuptools-based build, your pip is older than 21.3 and cannot do an editable (-e) install with a non-setuptools backend. Editable mode is a developer convenience, not needed to run the tool — do one of:

# From the source tree — a normal (non-editable) install builds a wheel:
pip install .              # NOT  pip install -e .

# ...or upgrade pip first, and editable works too:
pip install --upgrade pip && pip install -e .

For a truly air-gapped host, build the wheels on a connected machine and copy them over — the target then needs no network:

# On a connected machine, collect this package + its dependencies as wheels:
pip wheel . -w dist        # → dist/*.whl   (or: uv build, for just this package)

# Copy dist/ to the air-gapped host, then install offline:
pip install --no-index --find-links dist vmware-pilot

Related MCP server: vmware-harden

MCP Tools (13 — 4 read, 9 write)

Tool

Description

get_skill_catalog

List all available skills and tools for workflow design

list_workflows

List built-in and custom templates

review_workflow

Sanity-check a planned workflow before execution

design_workflow

Natural language goal → draft workflow

update_draft

Edit draft workflow steps

confirm_draft

Finalize draft → ready to execute

plan_workflow

Generate execution plan from template, returns workflow_id

create_workflow

Create custom workflow from step list (refused if a destructive step has no approval gate before it)

run_workflow

Execute workflow, pauses at approval gates

get_workflow_status

Query state + diff report + audit log

approve

Human approval, continue execution

rollback

Explicit, best-effort undo of steps pilot recorded as succeeded — never automatic. Previews (blast_radius) unless confirm=True

cancel_workflow

Cancel a workflow — move it to the terminal CANCELLED state. Previews (blast_radius) unless confirm=True

Built-in Templates (15)

n is the number of VMs (or drift items); ranges depend on which optional parameters are set. clone_and_test has 7 steps when change_spec is a guest command (an extra gate before it runs in staging). investigate_alert's approvals are synthesis checkpoints; its steps are all reads. See skills/vmware-pilot/references/templates.md for parameters and steps.

Template

Steps

Approval

Skills Used

clone_and_test

6-7

Yes

aiops, monitor

incident_response

4

Yes

monitor, aiops

investigate_alert

4 (8 with deep_dive)

Yes

monitor, aria

plan_and_approve

3

Yes

aiops

compliance_scan

1-3

No

monitor, aria

network_segment_setup

3-6

Yes

nsx, nsx-security

vks_cluster_deploy

5

Yes

vks

rolling_restart

2+3n

Yes

aiops, monitor

capacity_expansion

5

Yes

aria, aiops, monitor

disaster_recovery

5

Yes

aiops, monitor, nsx

patch_deployment

1+3n

Yes

aiops, monitor

storage_expansion

6

Yes

storage

baseline_capture

1-5

No

monitor, nsx, storage

baseline_audit

1-5

No

monitor, nsx, storage, aria

baseline_remediate

3+n

Yes

varies

MCP Configuration

{
  "mcpServers": {
    "vmware-pilot": {
      "command": "vmware-pilot",
      "args": ["mcp"]
    }
  }
}

Fallback: {"command": "uvx", "args": ["--from", "vmware-pilot", "vmware-pilot-mcp"]} still works, but uvx re-resolves against PyPI on every start and fails behind a TLS-inspecting corporate proxy (invalid peer certificate: UnknownIssuer). The installed entry point above touches the network zero times; set UV_NATIVE_TLS=true if you must use uvx.

License

MIT

Available Tools

13 tools
approveA

[WRITE] Approve a workflow that is waiting for human confirmation.

Use this only after showing the user the pending step and getting explicit human consent; use cancel_workflow instead when the approval is rejected. Only works when workflow state is 'awaiting_approval'. After approval, execution continues to the next steps.

Note: this server has no dispatcher — after approval, remaining steps are recorded as 'not_executed' and the result carries outcome='dispatch_required' with a 'pending_dispatch' list for the calling agent to perform (see run_workflow).

Returns: Updated workflow state after resuming.

ParametersJSON Schema
NameRequiredDescriptionDefault
approverNoName of the person approving (for audit trail).
workflow_idYesThe workflow ID to approve.

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes beyond annotations by disclosing the dispatcher absence, the 'not_executed' recording for remaining steps, and the 'dispatch_required' outcome with 'pending_dispatch' list. This is critical behavioral context not present in annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Well-structured: opens with a clear purpose, follows with usage guidance and a critical note about the dispatcher, then states the return value. Every sentence adds value without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Since there is no output schema, the description must explain return behavior, which it does (updated state and the dispatch_required case). It also covers prerequisites and side effects, making the tool fully understandable for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and both parameters have clear descriptions. The description adds no extra parameter semantics beyond what the schema already provides, so baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('Approve') and resource ('a workflow') and explicitly differentiates from cancel_workflow. The '[WRITE]' prefix clarifies the operation type. Clear and unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit when-to-use conditions: after showing the user and obtaining consent. Also names the alternative (cancel_workflow) for the rejection case and the state requirement ('awaiting_approval'). No inference needed.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

cancel_workflowA
Destructive

[WRITE] Cancel a workflow — move it to the terminal CANCELLED state.

Use this when an approval is REJECTED, a review flags the plan as unsafe, or an operator decides the workflow must never run. A cancelled workflow is dead: run_workflow and approve refuse to execute it. Without this, an approval-rejected PENDING workflow could still be picked up and run.

Without confirm=True this only previews: it returns blast_radius — the workflow's id, type and state, the executed steps that stay applied (left_in_place: cancelling part-way leaves a half-applied change), the steps that would be skipped (would_skip), steps with unknown effects, and blockers — and changes nothing. Show that to the user and get their explicit decision. Do not set confirm=True on your own because the user asked to cancel earlier — the user has not seen the preview yet.

Cancel only stops FUTURE steps. It does NOT undo already-completed steps — use rollback() to reverse those. Refused with confirm=True: an already completed/failed/cancelled workflow, a step whose status Pilot does not recognise, a workflow record that cannot be read, and — unless acknowledge_unknown_effects=True — a step left 'running' or 'interrupted' (listed in unknown_effects). The cancellation is written to the workflow audit log.

Returns: Preview: {"action": "preview", "blast_radius", "hint"}. Acting: the workflow state (state='cancelled', outcome='cancelled', action='cancelled') with blast_radius, or an error if refused.

ParametersJSON Schema
NameRequiredDescriptionDefault
reasonNoOptional human-readable reason (e.g. "approval rejected by on-call"), recorded in the audit log.
confirmNoFalse (default) returns the blast radius and changes nothing. True applies it.
workflow_idYesThe workflow ID to cancel.
acknowledge_unknown_effectsNoSet True only after the user has checked, in the target system, whether each unknown_effects step took effect. Covers only those steps; every other refusal still applies.

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the destructive/write annotations, the description reveals preview-vs-acting behavior, refusal conditions, audit-log writes, left_in_place and unknown_effects semantics, and that cancelled workflows are dead to run_workflow and approve. No annotation contradiction exists.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Longer than usual, but every section carries necessary safety information for a destructive operation with no output schema. The purpose and the critical 'don't confirm on your own' caution appear early, and the Returns section is clearly separated.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 4-parameter destructive workflow cancellation tool with no output schema, the description is complete: it explains return values, expected side effects, refusal cases, and the rollback alternative. Nothing an agent needs to select or invoke it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is complete, but the description layers on critical extra meaning: confirm=false previews, acknowledge_unknown_effects covers only those steps, and reason is recorded in the audit log. This materially improves an agent's ability to set these parameters correctly.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource — 'Cancel a workflow — move it to the terminal CANCELLED state.' It also distinguishes itself from siblings by saying it only stops future steps and explicitly routes completed-step reversal to rollback(). An agent can tell this apart from run_workflow, approve, and rollback.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit conditions (approval REJECTED, unsafe plan, operator decision), the not-to-use case (undoing completed steps), and the safe preview-then-confirm workflow. It even warns not to set confirm=True merely because the user asked earlier. This is exactly the when/when-not/alternative guidance required.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

confirm_draftA

[WRITE] Confirm a draft workflow — changes state from DRAFT to PENDING.

Use this once the user has approved the draft's steps; call update_draft instead if anything still needs changing. After confirmation, the workflow can be executed via run_workflow(). Optionally saves as a YAML template for future reuse. Refused — the draft stays a draft and nothing is saved — while any destructive or unclassifiable step, or any step passing confirm=True, lacks a require_approval gate before it.

Returns: Confirmed workflow summary. Call run_workflow() to execute.

ParametersJSON Schema
NameRequiredDescriptionDefault
workflow_idYesThe draft workflow ID to confirm.
save_as_templateNoIf True, save to ~/.vmware/workflows/ for reuse. Refused when the draft's name is a built-in template's name.

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations, it discloses the DRAFT-to-PENDING state change, optional template persistence, and important refusal conditions for destructive or unclassifiable steps lacking require_approval gates. It also states that nothing is saved when confirmation is refused, which is genuinely useful behavioral context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded, covering action, usage, alternatives, refusal, and return value in a short space. It loses a point for the awkwardly worded 'Refused — ... while ...' sentence, which is grammatically tangled but still decipherable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a write operation with no output schema, it explains the return value ('Confirmed workflow summary'), the required next step, the alternative tool, and the failure/refusal semantics. The remaining details, such as built-in template conflict behavior, are covered by the schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the schema already documents workflow_id and save_as_template well. The description adds small extra meaning by mentioning that the template is YAML and placing the save within the confirmation flow, which is slightly beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Confirm a draft workflow — changes state from DRAFT to PENDING.' This clearly names the action, the object, and the state transition, and it is immediately distinguishable from siblings like update_draft and run_workflow.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly states the trigger condition ('once the user has approved the draft's steps'), the alternative ('call update_draft instead if anything still needs changing'), and the next step ('run_workflow()'). This gives the agent concrete routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

create_workflowA

[WRITE] Create a custom workflow dynamically from a step list.

Use this when you already know the steps and no built-in template matches; prefer plan_workflow when one does, and design_workflow when the user gave a goal rather than steps. Call get_skill_catalog first for the skill and tool names a step may target.

Each step dict must have: action, skill, tool, params. Optional: rollback_tool, rollback_params. action="require_approval" (skill "pilot", tool "approve") inserts a human approval gate. A workflow whose destructive or unclassifiable step, or a step passing confirm=True, has no gate before it is REFUSED — nothing is saved — and the error names the step and the gate to insert.

Returns: dict with workflow_id and plan summary. Next call review_workflow to check the plan, then run_workflow to execute. Nothing is undone automatically on failure; see rollback.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYesWorkflow name (used as workflow_type).
stepsYesList of step dicts, each with action/skill/tool/params.
descriptionYesHuman-readable description.
save_as_templateNoIf True, save as YAML to ~/.vmware/workflows/ for reuse. Refused when name is a built-in template's name, since the saved template would replace the built-in.

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations, the description discloses critical behavioral rules: steps without approval gates for destructive/confirm=True operations are refused with nothing saved, the error names the step and gate, and failures are not automatically rolled back. This adds real operational context that the sparse annotations do not capture.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but every section earns its place: purpose, usage routing, step contract, refusal behavior, return value, and next actions. It is front-loaded with the core purpose and usage guidance, and the later paragraphs organize constraints and follow-up steps logically.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with no output schema and complex nested step objects, the description covers why, when, how, what can fail, what the return looks like, and which sibling to call next. The edge-case behavior around approval gates and rollback is exactly the kind of contextual detail an agent needs to invoke this tool safely.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds substantial meaning for the steps parameter: required and optional keys, the require_approval action convention, and the confirm=True refusal condition. It does not need to explain every schema field, but it enriches the most complex parameter well beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action ('Create a custom workflow dynamically from a step list') and distinguishes this tool from siblings by clarifying it is for known steps with no matching built-in template. It names plan_workflow and design_workflow as alternatives, making the tool's niche unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says when to use this tool ('when you already know the steps and no built-in template matches') and when to prefer alternatives with concrete conditions ('prefer plan_workflow when one does, and design_workflow when the user gave a goal rather than steps'). It also instructs the agent to call get_skill_catalog first, which is actionable and specific.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

design_workflowA

[WRITE] Start designing a workflow from a natural language description.

Call this when the user describes a complex operation and you need to design a multi-step workflow. Returns a DRAFT workflow with proposed steps for the user to review and edit before execution.

Design flow: design_workflow → update_draft (add steps, then iterate on user feedback) → confirm_draft (state becomes PENDING) → run_workflow.

Use get_skill_catalog() first to see which tools the steps may target.

Returns: dict with workflow_id (state=DRAFT), proposed steps placeholder, and instructions for the AI to fill in steps via update_draft.

ParametersJSON Schema
NameRequiredDescriptionDefault
goalYesNatural language description of what the user wants to accomplish.
constraintsNoOptional constraints (e.g. "must have approval before any destructive step", "use NSX for networking", "target is vcenter-prod").

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses the key behavior: it creates a DRAFT workflow with state=DRAFT, returns a proposed-steps placeholder for review/edit, and pushes the agent toward update_draft and confirm_draft next. The annotations already indicate a non-read-only, non-destructive write, and the description adds lifecycle context without contradicting them.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured and front-loaded with the action and trigger, followed by the flow and return contract. There is minor redundancy between 'Returns a DRAFT workflow...' and the later 'Returns:' block, but the latter is more precise about the output shape.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a two-parameter tool with no output schema, the description is largely complete: it names the required input, the returned workflow state, the placeholder behavior, and the follow-up flow. It does not cover error conditions or constraints details, but the schema fills the constraints gap and the missing details are minor.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, with both `goal` and `constraints` already documented. The description adds little parameter-level detail beyond explaining that the input is a natural-language description; it does not go deeper on constraints, so the schema carries the semantic weight.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a clear verb and resource ('Start designing a workflow') and explains that it converts a natural-language goal into a DRAFT workflow with proposed steps. It does not explicitly call out how it differs from similar siblings like plan_workflow or create_workflow, though the DRAFT/lifecycle wording provides some differentiation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives an explicit trigger: use this when the user describes a complex operation needing a multi-step workflow. It also provides a design flow and instructs the agent to call get_skill_catalog for candidate tools. However, it does not mention when not to use this tool or how it compares to sibling planning tools, so it lacks explicit exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_skill_catalogA
Read-onlyIdempotent

[READ] Get the complete catalog of available skills and tools for workflow design.

Use this to understand what building blocks are available when designing a custom workflow, then feed the skill and tool names into create_workflow or update_draft steps. Note this is a static curated catalog, not a live query of each skill's registry, so it may lag a skill's actual tool list; pilot cannot call these tools itself — the calling agent does.

Returns: dict mapping skill name → {description, tools: {tool_name: {risk, desc}}}.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, and destructiveHint false. The description adds valuable context: the catalog is static and may lag actual skill tool lists, and that the calling agent cannot invoke these tools itself. It also specifies the return structure, going beyond the annotation coverage.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured and concise: it starts with the purpose, then usage context, a caveat, and the return format. Each sentence earns its place, with no redundancy or fluff. The front-loading of the read nature and purpose is effective.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a no-parameter read-only catalog tool, the description is complete. It explains what is returned (dict mapping), how to use the result, and a known limitation (static data, lag). It also clarifies an important behavioral constraint (pilot cannot call these tools). Nothing essential is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There are zero parameters, so schema coverage is effectively 100% and the description cannot add parameter-specific details. Per the baseline for no parameters, a score of 4 is appropriate; the description does not need to compensate for any missing parameter docs.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states a specific verb ('Get') and resource ('complete catalog of available skills and tools for workflow design'). It distinguishes itself from sibling tools by explicitly positioning itself as the source for building blocks used in workflow creation, not as a tool that designs or executes workflows.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides clear context for when to use it: when designing a custom workflow, to understand available building blocks, and then feed names into create_workflow or update_draft. It also notes it is not a live query, which implicitly advises against using it when real-time registry data is needed, though it doesn't explicitly name alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_workflow_statusA
Read-onlyIdempotent

[READ] Get current workflow state, diff report, and audit log.

Use this to poll a workflow after run_workflow and to find out why one stopped: outcome='dispatch_required' means you must perform the pending steps yourself, 'awaiting_approval' means call approve. Returns a point-in-time snapshot and does not advance the workflow.

Returns: Full workflow state including steps, audit log, and diff report.

ParametersJSON Schema
NameRequiredDescriptionDefault
workflow_idYesThe workflow ID to query.

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Even though annotations already mark this as readOnly and idempotent, the description adds critical behavioral detail: 'Returns a point-in-time snapshot and does not advance the workflow.' It also explains the meaning of outcome values ('dispatch_required', 'awaiting_approval'), giving the agent a concrete understanding of what the tool actually provides and what side effects it lacks. This goes well beyond the annotation hints.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured and highly information-dense: an opening READ marker, purpose statement, usage guidance, behavioral disclaimer, and return summary. Not a word is wasted, and the key usage condition (polling after run_workflow) is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read-only tool with one parameter and no output schema, the description fully covers what an agent needs: what it returns (steps, audit log, diff report), why to call it (polling, diagnosing stops), and the relevant outcome semantics. It complements the annotation-heavy safety profile and gives actionable dispatch guidance without omitting anything necessary.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema itself already documents the sole parameter workflow_id with 'The workflow ID to query.' The description does not add extra meaning about the parameter beyond that; it references workflow_id indirectly through context but doesn't elaborate on its format, provenance, or constraints. Since schema coverage is 100%, this is exactly the baseline 3 case where no description compensation is needed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with 'Get current workflow state, diff report, and audit log,' which names a specific verb ('get'), the resource ('workflow status'), and the constituent parts (state, diff, audit log). It further distinguishes itself from siblings by framing the tool as a read-only polling action after run_workflow, clearly separating it from the many mutation tools like approve or cancel.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly tells when to use this tool: 'poll a workflow after run_workflow' and to 'find out why one stopped.' It also provides conditional next actions based on outcome values (e.g., 'dispatch_required' means perform pending steps, 'awaiting_approval' means call approve), which implicitly names the alternative tools and routes the agent appropriately.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_workflowsA
Read-onlyIdempotent

[READ] List all available workflow templates (built-in + custom).

Use this first to see whether a template already covers the goal, then pass its name to plan_workflow; if none fit, use create_workflow instead. Built-in templates are always available. Custom templates are loaded from ~/.vmware/workflows/*.yaml — drop a YAML file there to add your own workflows.

Returns: dict with builtin and custom workflow lists, each with name, description, steps count, plus active_workflows — the IDs of in-flight runs to pass to get_workflow_status.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover readOnly, idempotent, and non-destructive traits. The description adds value by detailing the return structure (dict with builtin, custom, active_workflows) and the source of custom templates (~/.vmware/workflows/*.yaml), which goes beyond annotations and helps the agent understand behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a [READ] marker, clear usage guidance, and a Returns section. It is slightly longer than necessary but each sentence earns its place by providing actionable context. The front-loaded purpose makes it easy to scan.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no parameters and no output schema, the description compensates by explaining the return structure and linking to related tools (plan_workflow, create_workflow, get_workflow_status). It also explains where custom workflows live, which is essential for an agent to use the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so the baseline is 4. The description correctly implies no inputs are needed and does not need to explain parameters. It focuses on output and usage, which is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool lists all available workflow templates (built-in + custom). It uses a specific verb-resource pair and distinguishes itself from siblings by explaining its role as the initial discovery step, routing to plan_workflow or create_workflow as needed.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to use this tool ('Use this first to see whether a template already covers the goal') and provides clear alternatives (plan_workflow, create_workflow). It also instructs how to add custom workflows via YAML files, offering concrete usage context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

plan_workflowA

[WRITE] Create an execution plan for a multi-step workflow.

Use this when the goal matches one of the built-in types below; use create_workflow instead when none of them fit. A custom YAML template whose destructive or unclassifiable step (or step passing confirm=True) has no require_approval gate before it is refused, naming the step and the file to fix.

Available workflow types:

  • clone_and_test: Clone VM → apply changes → monitor → approve → commit

  • incident_response: Diagnose alert → collect info → approve → remediate

  • plan_and_approve: Wrap aiops batch operations with approval gate

  • compliance_scan: Read-only health/capacity/anomaly check (no approval)

Returns: dict with workflow_id, steps summary, and plan details.

ParametersJSON Schema
NameRequiredDescriptionDefault
paramsYesWorkflow-specific parameters.
workflow_typeYesOne of the available workflow types.

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond annotations, the description discloses a specific refusal behavior: custom YAML templates with a destructive/unclassifiable step or confirm=True without require_approval are refused with a message naming the step and file. It also distinguishes read-only compliance_scan from approval-required flows. Annotations are not contradicted.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the operation and usage guidance; the workflow-type list is compact and the refusal/return notes are each relevant. It is slightly dense but not bloated.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers purpose, when-to-use, alternatives, all built-in types, refusal behavior, and return value. The only minor gap is per-type parameter shape, but given params is an open object this is not fatal.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema gives only 'One of the available workflow types' for workflow_type; the description supplies the actual enum values and summarizes each. For params, it stays generic, but with additionalProperties allowed and 100% schema coverage, this is acceptable.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The first sentence states a clear action on a distinct resource: 'Create an execution plan for a multi-step workflow.' It also names the exact sibling alternative (create_workflow) in the same sentence, allowing an agent to distinguish it immediately.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says when to use ('when the goal matches one of the built-in types below') and when to use a different tool ('use create_workflow instead when none of them fit'). It also provides the list of built-in types and their purpose, plus a refusal condition for unsafe custom templates.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

review_workflowA
Read-onlyIdempotent

[READ] Sanity-check a planned workflow before execution.

Performs structural validation only — does NOT call into other skills. Catches the common authoring errors before they hit production:

  • Delete-then-use: a step deletes resource X, a later step references X

  • Missing required params: a step has empty params or placeholder values

  • Cross-skill order issues: surfacing the cross-skill dispatch sequence

  • Risk profile: count of destructive / write / read-only / unclassified steps

  • Approval coverage: is every destructive OR unclassifiable step gated behind a preceding require_approval?

Each step is placed in a tier from the tool's entry in get_skill_catalog first, then from name patterns. A step that matches neither is reported as ungated_unclassified rather than assumed safe: pilot dispatches nothing itself and cannot inspect a sibling skill's annotations, so "this tool is unknown to me" is the honest finding, and it needs the same gate a known destructive step does. The remedy is in the message — add the tool to SKILL_CATALOG with the risk its own skill declares, or add a gate.

Medium-risk writes (create / scale / enable) are classified and counted but not gated: the family gates destructive work, and several built-in templates deliberately create in staging before asking for approval.

Returns: Dict with keys: - verdict: "approved" if no structural issues, otherwise "needs_revision" - findings: list of {severity, kind, message, step_index}. Kinds ungated_destructive, ungated_unclassified and destructive_in_parallel_group are what run_workflow refuses on; force=True overrides that only for a built-in template, never for a custom workflow's missing approval gate. - summary: counts — total/destructive/write/read_only/approval_gates, parallel_groups, est_duration_min, plus classified_steps and unclassified_steps so an "approved" verdict can be told apart from a workflow this review could not read.

ParametersJSON Schema
NameRequiredDescriptionDefault
workflow_idYesThe workflow ID returned by ``plan_workflow``.

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations, the description discloses that this is a pure read/review operation that cannot inspect sibling skill annotations, explains why unclassified steps are reported as 'ungated_unclassified' rather than assumed safe, details the classification order (get_skill_catalog first, then name patterns), and clarifies force=True only applies to built-in templates. This is substantial behavioral nuance the annotations do not provide.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with purpose and scoping, and uses clear bullet lists and a return-key breakdown. It is long, and there is some redundancy between 'does NOT call into other skills' and the later 'pilot dispatches nothing itself' passage, but the detail is mostly justified given the absence of an output schema and the nuanced validation policy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description fully documents the return structure (verdict, findings, summary), the finding kinds that cause run_workflow to refuse, the force=True caveat, and the classification rules. An agent has all necessary information to invoke the tool correctly and interpret its results.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already fully describes workflow_id as 'The workflow ID returned by plan_workflow' with 100% coverage. The description adds only contextual framing like 'planned workflow' and 'before execution' but no additional parameter-specific semantics, so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Sanity-check a planned workflow before execution.' It clearly differentiates from siblings by stating 'structural validation only' and 'does NOT call into other skills', so it cannot be confused with run_workflow, plan_workflow, or design_workflow.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says to use it 'before execution' and 'before they hit production', and states when-not: 'structural validation only' and 'does NOT call into other skills'. It also references run_workflow's refusal behavior, force=True semantics, and the gating relationship with require_approval, giving clear contextual guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

rollbackA
Destructive

[WRITE] Abort a workflow and rollback completed steps in reverse order.

Without confirm=True this only previews: it returns blast_radius — the workflow's id, type and state, the executed steps whose rollback_tool would run with its rollback_params, secrets redacted (would_roll_back — these often carry confirm=True, and this call's confirm=True is the decision to run them), the executed steps that have none and stay applied (left_in_place), steps you performed from pending_dispatch that Pilot will not reverse (not_reversed_by_pilot), steps with unknown effects, and blockers — and changes nothing. Show that to the user and get their explicit decision. Do not set confirm=True on your own because the user asked for a rollback earlier — the user has not seen the preview yet.

Nothing rolls back automatically: a failed step leaves the workflow 'failed' and stops. This tool is the explicit, best-effort undo, and it only reverses steps pilot itself recorded as 'success' — which, on this server (no dispatcher), are approval gates only. Steps YOU performed from pending_dispatch are still 'not_executed' here, so to undo them call each one's rollback_tool with its rollback_params yourself, last step first. Embedders that pass a dispatcher to WorkflowExecutor get those calls made for them. Steps without a rollback_tool are skipped; a failed undo does not stop the rest. The workflow state is set to 'failed' afterwards.

Refused with confirm=True: a workflow in draft, completed, rolling_back or cancelled state, a step whose status Pilot does not recognise, a workflow record that cannot be read, and — unless acknowledge_unknown_effects=True — a step left 'running' or 'interrupted' by a Pilot process that stopped mid-dispatch (listed in unknown_effects).

Returns: Preview: {"action": "preview", "blast_radius", "hint"}. Acting: the workflow state with "action": "rolled_back", rollback_results for each step pilot recorded as succeeded, and blast_radius. Check get_workflow_status afterwards to see which steps were actually reversed and which were skipped.

ParametersJSON Schema
NameRequiredDescriptionDefault
confirmNoFalse (default) returns the blast radius and changes nothing. True applies it.
workflow_idYesThe workflow ID to rollback.
acknowledge_unknown_effectsNoSet True only after the user has checked, in the target system, whether each unknown_effects step took effect. Covers only those steps; every other refusal still applies.

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

It discloses critical behavior beyond annotations: confirm changes effect, nothing rolls back automatically, only 'success' steps are undone, failed undo doesn't stop the rest, state is set to 'failed', refusal conditions, and redaction of secrets. This is exactly the contextual depth an agent needs for a destructive, non-idempotent operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but tightly organized: primary action, preview behavior, execution semantics, refusals, return shape. Each paragraph adds distinct operational guidance and the opening sentence front-loads the purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a destructive tool with no output schema, it fully covers return shapes, error/refusal cases, side effects on workflow state, and follow-up verification via get_workflow_status. No critical operational gap remains.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Though schema coverage is 100%, the description adds substantial meaning: confirm=False is a preview, confirm=True applies rollback and is the actual decision to run rollback_tool calls, and acknowledge_unknown_effects only covers listed unknown steps. This goes well beyond the schema's terse field descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The first sentence names a specific verb and resource ('Abort a workflow and rollback completed steps in reverse order') and the rest clarifies that it is a best-effort undo for Pilot-recorded successes, which sets it apart from sibling cancellation and workflow-status tools. An agent can identify what action this performs without inspecting the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit usage rules: preview first with confirm=False, show the user, require explicit decision, and never self-confirm just because the user asked earlier. It also specifies alternatives for steps the tool will not reverse (call each rollback_tool with rollback_params yourself) and notes the dispatcher variant.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

run_workflowA

[WRITE] Advance a planned workflow. Pauses at approval gates.

IMPORTANT — this MCP server has no dispatcher and cannot call other skills' MCP tools itself. Steps are recorded as 'not_executed' and the run finishes with outcome='dispatch_required' (NOT 'completed'), returning each pending step's skill/tool/params. YOU (the calling agent) must then perform those skill/tool calls in order. A workflow only reaches 'completed' when every step genuinely executed via a real dispatcher (embedders supplying one to WorkflowExecutor).

Safety: the workflow is structurally reviewed before each run. Runs are REFUSED if review finds ungated destructive or unclassifiable steps, or destructive steps inside a parallel group. For a built-in template, force=True overrides that (forced runs are written to the workflow audit log). For a custom workflow (create_workflow, design_workflow, or a YAML template) an ungated step is refused even with force=True: add a require_approval step before it instead.

When an approval gate is reached, the workflow pauses with state 'awaiting_approval'. Call approve() to continue.

Returns: Current workflow state with 'outcome' (completed | awaiting_approval | dispatch_required | failed) and, when dispatch is required, a 'pending_dispatch' list of steps for the agent to perform.

ParametersJSON Schema
NameRequiredDescriptionDefault
forceNoBypass blocking review findings on a built-in template. Use only with explicit human consent; the bypass is audited. Has no effect on a custom workflow's missing approval gate.
workflow_idYesThe workflow ID from plan_workflow.

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only provide readOnly/idempotence/destructive/open-world hints, so the description carries the behavioral burden. It adds the important no-dispatcher execution model, recording of 'not_executed' steps, audit logging of forced runs, refusal conditions, and the fact that 'completed' only happens with a real dispatcher. This is far more than the annotations alone could convey.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Longer than minimal, but the tool is complex and every paragraph serves a distinct purpose: execution model, safety review, approvals, and return values. The critical no-dispatcher caveat is front-loaded, and the use of bolded terms helps structure the content without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Even without an output schema, the description fully documents the possible outcome values, the pending_dispatch list, refusal conditions, and the agent's subsequent responsibilities. For a mutation tool with security-relevant behavior and a dispatcher gap, this is complete enough for an agent to invoke it correctly and know what to do next.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description adds valuable meaning beyond the schema by explaining that force bypasses review findings only on built-in templates, is audited, and has no effect on custom workflows. This extra nuance helps the agent use the force parameter correctly.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('Advance') and resource ('a planned workflow'), and specifies the pause-at-approval behavior. It also differentiates itself from siblings by telling the agent to call approve() to continue after an approval gate, making it clear this tool is the execution step, not the approval step.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit when-to-use and when-not-to-use guidance: runs are refused for ungated destructive steps, force only applies to built-in templates, custom workflows require an added require_approval step, and approval gates require approve(). It also tells the agent it must perform the pending skill/tool calls itself when dispatch_required is returned, which is a critical routing instruction.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

update_draftA

[WRITE] Update a DRAFT workflow's name, description, or steps.

Call this after design_workflow() to fill in the actual steps, or to modify steps based on user feedback. Use it only while the workflow is still DRAFT — after confirm_draft the steps are frozen and you must create_workflow a new one instead.

Each step dict: {action, skill, tool, params, rollback_tool?, rollback_params?} Use action="require_approval" for approval gates. A draft may be saved without them while it is being designed; the result lists every step that still needs one, and confirm_draft refuses until none are left.

Returns: Updated workflow summary for user review.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameNoWorkflow name (optional, updates workflow_type).
stepsNoComplete list of steps (replaces all existing steps).
descriptionNoHuman-readable description.
workflow_idYesThe draft workflow ID.

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already establish this is a write (readOnlyHint=false) and non-idempotent. The description adds useful behavioral detail beyond those markers: steps are replaced wholesale, approval gates are tracked, and the result lists steps still needing approval while confirm_draft will refuse until none remain. It also discloses the return value. It doesn't mention potential errors or side effects in depth, but the added lifecycle and validation context earns a solid 4.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded: the first sentence states the core purpose, then usage context, then step format, then behavioral detail. Every sentence adds necessary information for correct invocation, with no filler or redundancy. It is slightly longer than minimal but the additional context is all operational, so it earns a 4.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a mutation tool with 4 parameters and no output schema, the description is thorough: it covers when to call, when not to call, the step data structure, approval validation behavior, and the return format. It doesn't explain default parameter behavior or error cases, but the schema already covers parameter descriptions and the draft lifecycle constraint is fully addressed. Overall, an agent has enough context to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description adds value by specifying the exact step dict shape ({action, skill, tool, params, rollback_tool?, rollback_params?}) and the special action value 'require_approval' for approval gates. It also explains the consequence of omitting approval gates during design, clarifying semantics of the steps parameter beyond the schema's 'replaces all existing steps.'

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with 'Update a DRAFT workflow's name, description, or steps,' which names a specific action, resource, and the fields it affects. It further distinguishes itself from siblings by explicitly restricting usage to the DRAFT state and pointing to create_workflow for post-confirmation workflows, so an agent can clearly tell it apart without opening schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives explicit when-to-use guidance: 'Call this after design_workflow() to fill in the actual steps, or to modify steps based on user feedback.' It also states a hard when-not-to-use rule: after confirm_draft the steps are frozen and one must create_workflow a new one instead. This covers both the appropriate trigger and the exclusion condition, leaving no ambiguity.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 2 tool updatesv1.12.0
    • Changedcancel_workflow2 fields changed
      • addedInput schema / properties / acknowledge_unknown_effects
        Added value: +{
        +  "default": false,
        +  "description": "Set True only after the user has checked, in the target system, whether each unknown_effects step took effect. Covers only those steps; every other refusal still applies.",
        +  "title": "Acknowledge Unknown Effects",
        +  "type": "boolean"
        +}
      • addedInput schema / properties / confirm
        Added value: +{
        +  "default": false,
        +  "description": "False (default) returns the blast radius and changes nothing. True applies it.",
        +  "title": "Confirm",
        +  "type": "boolean"
        +}
    • Changedrollback2 fields changed
      • addedInput schema / properties / acknowledge_unknown_effects
        Added value: +{
        +  "default": false,
        +  "description": "Set True only after the user has checked, in the target system, whether each unknown_effects step took effect. Covers only those steps; every other refusal still applies.",
        +  "title": "Acknowledge Unknown Effects",
        +  "type": "boolean"
        +}
      • addedInput schema / properties / confirm
        Added value: +{
        +  "default": false,
        +  "description": "False (default) returns the blast radius and changes nothing. True applies it.",
        +  "title": "Confirm",
        +  "type": "boolean"
        +}
  2. 13 tool updatesv1.11.1
    • Changedapprove3 fields changed
      • addedInput schema / additionalProperties
        Added value: +false
      • addedInput schema / properties / approver / description
        Added value: +"Name of the person approving (for audit trail)."
      • addedInput schema / properties / workflow_id / description
        Added value: +"The workflow ID to approve."
    • Changedcancel_workflow3 fields changed
      • addedInput schema / additionalProperties
        Added value: +false
      • addedInput schema / properties / reason / description
        Added value: +"Optional human-readable reason (e.g. \"approval rejected by on-call\"), recorded in the audit log."
      • addedInput schema / properties / workflow_id / description
        Added value: +"The workflow ID to cancel."
    • Changedconfirm_draft3 fields changed
      • addedInput schema / additionalProperties
        Added value: +false
      • addedInput schema / properties / save_as_template / description
        Added value: +"If True, save to ~/.vmware/workflows/ for reuse. Refused when the draft's name is a built-in template's name."
      • addedInput schema / properties / workflow_id / description
        Added value: +"The draft workflow ID to confirm."
    • Changedcreate_workflow5 fields changed
      • addedInput schema / additionalProperties
        Added value: +false
      • addedInput schema / properties / description / description
        Added value: +"Human-readable description."
      • addedInput schema / properties / name / description
        Added value: +"Workflow name (used as workflow_type)."
      • addedInput schema / properties / save_as_template / description
        Added value: +"If True, save as YAML to ~/.vmware/workflows/ for reuse. Refused when name is a built-in template's name, since the saved template would replace the built-in."
      • addedInput schema / properties / steps / description
        Added value: +"List of step dicts, each with action/skill/tool/params."
    • Changeddesign_workflow3 fields changed
      • addedInput schema / additionalProperties
        Added value: +false
      • addedInput schema / properties / constraints / description
        Added value: +"Optional constraints (e.g. \"must have approval before any destructive step\", \"use NSX for networking\", \"target is vcenter-prod\")."
      • addedInput schema / properties / goal / description
        Added value: +"Natural language description of what the user wants to accomplish."
    • Changedget_skill_catalog1 field changed
      • addedInput schema / additionalProperties
        Added value: +false
    • Changedget_workflow_status2 fields changed
      • addedInput schema / additionalProperties
        Added value: +false
      • addedInput schema / properties / workflow_id / description
        Added value: +"The workflow ID to query."
    • Changedlist_workflows1 field changed
      • addedInput schema / additionalProperties
        Added value: +false
    • Changedplan_workflow3 fields changed
      • addedInput schema / additionalProperties
        Added value: +false
      • addedInput schema / properties / params / description
        Added value: +"Workflow-specific parameters."
      • addedInput schema / properties / workflow_type / description
        Added value: +"One of the available workflow types."
    • Changedreview_workflow2 fields changed
      • addedInput schema / additionalProperties
        Added value: +false
      • addedInput schema / properties / workflow_id / description
        Added value: +"The workflow ID returned by ``plan_workflow``."
    • Changedrollback2 fields changed
      • addedInput schema / additionalProperties
        Added value: +false
      • addedInput schema / properties / workflow_id / description
        Added value: +"The workflow ID to rollback."
    • Changedrun_workflow3 fields changed
      • addedInput schema / additionalProperties
        Added value: +false
      • addedInput schema / properties / force / description
        Added value: +"Bypass blocking review findings on a built-in template. Use only with explicit human consent; the bypass is audited. Has no effect on a custom workflow's missing approval gate."
      • addedInput schema / properties / workflow_id / description
        Added value: +"The workflow ID from plan_workflow."
    • Changedupdate_draft5 fields changed
      • addedInput schema / additionalProperties
        Added value: +false
      • addedInput schema / properties / description / description
        Added value: +"Human-readable description."
      • addedInput schema / properties / name / description
        Added value: +"Workflow name (optional, updates workflow_type)."
      • addedInput schema / properties / steps / description
        Added value: +"Complete list of steps (replaces all existing steps)."
      • addedInput schema / properties / workflow_id / description
        Added value: +"The draft workflow ID."
  3. 2 tool updatesv1.5.38
    • Addedcancel_workflow
    • Changedrun_workflow1 field changed
      • addedInput schema / properties / force
        Added value: +{
        +  "default": false,
        +  "title": "Force",
        +  "type": "boolean"
        +}
  4. 12 tool updatesv1.5.22
    • First observedapprove
    • First observedconfirm_draft
    • First observedcreate_workflow
    • First observeddesign_workflow
    • First observedget_skill_catalog
    • First observedget_workflow_status
    • First observedlist_workflows
    • First observedplan_workflow
    • First observedreview_workflow
    • First observedrollback
    • First observedrun_workflow
    • First observedupdate_draft

TDQS

A4.5/5.0

Scored across 13 tools

Disambiguation5/5

Each tool targets a distinct lifecycle stage or concern: design/update/confirm for drafts, plan/create for different workflow origins, run/approve/cancel/rollback for execution control, and list/review/status/catalog for inspection. The overlapping creation tools (design_workflow, plan_workflow, create_workflow) are clearly separated by input type and use case.

Naming Consistency4/5

Most tools follow verb_noun (design_workflow, update_draft, get_workflow_status, confirm_draft, cancel_workflow, list_workflows, review_workflow, run_workflow), with a few single-word verbs (approve, rollback) that still read clearly in context. The convention is consistent enough that an agent can predict tool purpose from the name.

Tool Count5/5

13 tools cover the full workflow lifecycle without redundancy. Each tool earns its place: creation (3 variants), editing/confirmation, execution control, and inspection. The count feels well-scoped for a workflow orchestration server.

Completeness5/5

The tool surface covers the entire lifecycle: design → update → confirm → review → run → approve/cancel/rollback, plus discovery (list_workflows, get_skill_catalog) and monitoring (get_workflow_status). There are no obvious dead ends, and the refusal/error paths explicitly name remediation actions (e.g., adding approval gates).

Maintenance

ActivityActive
ResponsivenessResponsive

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    D
    maintenance
    Enables orchestration of MCP tool calls through declarative YAML-defined directed graphs with data transformation, conditional routing, and observable execution flows.
    57 npm
    22
    MIT
  • A
    license
    A
    quality
    A
    maintenance
    VMware vSphere compliance and hardening — read-only baseline scanning plus drift detection across CIS, DISA STIG, vSphere SCG, China DJCP 2.0, and PCI-DSS frameworks. Includes LLM-powered remediation suggestions; apply-side gated through the vmware-pilot approval workflow.
    8
    473 PyPI
    3
    MIT