VMware-AIops
VMware AIops
Author: Wei Zhou, VMware by Broadcom — wei-wz.zhou@broadcom.com This is a community-driven project by a VMware engineer, not an official VMware product. For official VMware developer tools see developer.broadcom.com.
English | 中文
AI-powered VMware vCenter/ESXi VM lifecycle and deployment tool — 60 tools.
Companion skills handle everything else:
Skill
Scope
Install
Read-only: inventory, health, alarms, events, metrics
uv tool install vmware-monitorDatastores, iSCSI, vSAN management
uv tool install vmware-storageTanzu Namespaces, TKC cluster lifecycle
uv tool install vmware-vksNeed read-only monitoring only? Use VMware-Monitor — zero destructive code in the codebase.
⚡ Quick Investigation Reports (read-only)
Triage → investigate → act, all in one conversation. Five opinionated read-only reports aggregate and correlate server-side and hand back a high-signal result (never raw inventory), so you can decide where to look before changing anything. Each renders a self-contained offline HTML snapshot with --html (no external assets; drill-down detail collapses in native <details>, zero JavaScript). All delegate to the vmware-monitor library using AIops's own vCenter connection.
Question | Command | What it correlates |
"What needs attention now?" across all vCenters |
| Every vCenter merged into one globally-ranked issue list; unreachable targets degrade gracefully |
"Is anything on fire?" across all clusters |
| Every cluster's hosts + VM power + live CPU/mem + alarms → ranked top-N issues + per-cluster status |
"What's happening around this VM?" |
| VM state + host + cluster + backing datastores + snapshots + alarms + performance + a merged event timeline |
"What's happening around this host?" |
| Host state + cluster + the VMs it runs + mounted datastores + alarms + performance + correlated timeline |
"What's happening around this datastore?" |
| Capacity/free + mounting hosts + VMs it backs + alarms + correlated timeline |
vmware-aiops attention # what needs attention now, all vCenters
vmware-aiops investigate vm web-01 --hours 72 # everything around a VM, then act on it
vmware-aiops investigate vm web-01 --html # → offline snapshot in ~/vmware-health/Via MCP these are the tools cluster_health_summary, cross_vcenter_attention, vm_investigation_bundle, host_investigation_bundle, datastore_investigation_bundle. (Requires vmware-monitor installed.)
Quick Install (Recommended)
Works with Claude Code, Cursor, Codex, Gemini CLI, Trae, and 30+ AI agents:
# Via Skills.sh
npx skills add vmware-skills/VMware-AIops
# Via ClawHub
clawhub install @zw008/vmware-aiopsPyPI Install (No GitHub Access Required)
# Install via uv (recommended)
uv tool install vmware-aiops
# Or via pip
pip install vmware-aiops
# China mainland mirror (faster)
pip install vmware-aiops -i https://pypi.tuna.tsinghua.edu.cn/simpleOffline / Air-Gapped Install (from source)
This project uses the modern PEP 517 build system (hatchling), so there is no
setup.py by design — that is expected, not a missing file. If you cloned the
source and hit ERROR: File "setup.py" or "setup.cfg" not found ... editable mode currently requires a setuptools-based build, your pip is older than 21.3 and
cannot do an editable (-e) install with a non-setuptools backend. Editable
mode is a developer convenience, not needed to run the tool — do one of:
# From the source tree — a normal (non-editable) install builds a wheel:
pip install . # NOT pip install -e .
# ...or upgrade pip first, and editable works too:
pip install --upgrade pip && pip install -e .For a truly air-gapped host, build the wheels on a connected machine and copy them over — the target then needs no network:
# On a connected machine, collect this package + its dependencies as wheels:
pip wheel . -w dist # → dist/*.whl (or: uv build, for just this package)
# Copy dist/ to the air-gapped host, then install offline:
pip install --no-index --find-links dist vmware-aiopsWhy this over other VMware MCP servers
Most open-source VMware MCP servers (e.g. bright8192/esxi-mcp-server,
giuliolibrando/vmware-vsphere-mcp-server) are single-vCenter VM wrappers:
list/power/snapshot a VM, basic monitoring, a confirm=True flag. They explicitly
do not cover networking, storage, Kubernetes, ops analytics, load balancing, or
compliance — and "logging is documented" is not an audit trail.
This is one skill in an 11-package family that covers the whole estate and runs every tool through a governed harness:
Other VMware MCP servers | This family | |
VM lifecycle + monitoring | ✅ | ✅ |
NSX networking (segments/gateways/NAT/routing/IPAM) | ❌ | ✅ vmware-nsx |
NSX security (DFW/groups/IDS-IPS/traceflow) | ❌ | ✅ vmware-nsx-security |
Storage (datastore/iSCSI/vSAN) | ❌ | ✅ vmware-storage |
Tanzu Kubernetes (Supervisor/Namespace/TKC) | ❌ | ✅ vmware-vks |
Aria Operations (metrics/alerts/capacity) | ❌ | ✅ vmware-aria |
AVI / NSX ALB load balancing + AKO | ❌ | ✅ vmware-avi |
Compliance baselines + drift (CIS/SCG/等保/PCI) | ❌ | ✅ vmware-harden |
Governed harness (unified audit, policy engine, token budget + runaway breaker, graduated risk tiers, undo-token, prompt-injection sanitize) | ❌ | ✅ vmware-policy on every tool |
If you only ever power-cycle VMs in one vCenter, a single-file server is fine. If you run a real (regulated, NSX-segmented, multi-domain) VMware estate and need an AI operator an auditor can sign off on, that's what this family is for — see docs/compliance-ready.md.
Capabilities Overview
What This Skill Does
Category | Tools | Count |
VM Lifecycle | power on/off, TTL auto-delete, clean slate | 6 |
Deployment | OVA, template, linked clone, batch clone/deploy | 8 |
Guest Ops | exec commands, upload/download files, provision | 5 |
Plan/Apply | multi-step planning with rollback | 4 |
Cluster | create, delete, HA/DRS config, add/remove hosts | 6 |
Datastore | browse files, scan for images | 2 |
Network | dvSwitch portgroup list/create, host VMkernel list/add/remove, DF-bit MTU-path ping | 6 |
CLI vs MCP: Which Mode to Use
Scenario | Recommended | Why |
Local/small models (Ollama, Qwen <32B) | CLI | ~2K tokens context vs ~10K for MCP; small models struggle with many tool schemas |
Token-sensitive workflows | CLI | SKILL.md + Bash tool = minimal overhead |
Cloud models (Claude, GPT-4o) | Either | Both work; MCP gives structured JSON I/O |
Automated pipelines / Agent chaining | MCP | Type-safe parameters, structured output, no shell parsing |
Monitoring / storage / K8s | Companion skills |
Rule of thumb: Use CLI for cost efficiency and small models. Use MCP for structured automation with large models.
Architecture
User (Natural Language)
↓
AI CLI Tool (Claude Code / Gemini / Codex / Aider / Continue / Trae / Kimi)
↓ reads SKILL.md / AGENTS.md / rules
↓
vmware-aiops CLI
↓ pyVmomi (vSphere SOAP API)
↓
vCenter Server ──→ ESXi Cluster ──→ VM
or
ESXi Standalone Host ──→ VMVersion Compatibility
vSphere / VCF Version | Support | Notes |
VCF 9.1 / vSphere 9.1 | ✅ Full | Released 2026-05-12. pyVmomi |
VCF 9.0 / vSphere 9.0 | ✅ Full | pyVmomi 8.0.3+ connects against vSphere 9 SOAP API. From VCF 9, pyVmomi is also bundled inside the unified VCF Python SDK. |
8.0 / 8.0U1-U3 | ✅ Full |
|
7.0 / 7.0U1-U3 | ✅ Full | All APIs supported |
6.7 | ✅ Compatible | Backward-compatible, tested |
6.5 | ✅ Compatible | Backward-compatible, tested |
pyVmomi auto-negotiates the API version during SOAP handshake — no manual configuration needed. The same codebase manages 7.0 / 8.0 / 9.0 / 9.1 environments seamlessly.
Official Broadcom References
SDKs: https://developer.broadcom.com/sdks — VCF Python SDK (recommended for VCF 9+, bundles pyVmomi + vSAN SDK), vSphere Automation SDK for Python (REST APIs)
REST APIs: https://developer.broadcom.com/xapis — vSphere Automation API, VCF API, SDDC Manager API
CLI Tools: https://developer.broadcom.com/tools — PowerCLI 9.1, ESXCLI, OVF Tool
Common Workflows
Deploy a Lab Environment
Browse datastore for OVA images →
vmware-aiops datastore browse <ds> --pattern "*.ova"Deploy VM from OVA →
vmware-aiops deploy ova ./image.ova --name lab-vm --datastore ds1Install software inside VM →
vmware-aiops vm guest-exec lab-vm --cmd /bin/bash --args "-c 'apt-get install -y nginx'" --user rootCreate baseline snapshot →
vmware-aiops vm snapshot-create lab-vm --name baselineSet TTL for auto-cleanup →
vmware-aiops vm set-ttl lab-vm --minutes 480
Batch Clone for Testing
Create plan:
vm_create_planwith multiple clone + reconfigure stepsReview plan with user (shows affected VMs, irreversible warnings)
Apply:
vm_apply_planexecutes sequentially, stops on failureIf failed:
vm_rollback_planreverses executed stepsSet TTL on all clones for auto-cleanup
Migrate VM to Another Host
Check VM info via
vmware-monitor→ verify power state and current hostMigrate:
vmware-aiops vm migrate my-vm --to-host esxi-02Verify migration completed
VM Lifecycle
Operation | Command | Confirmation | vCenter | ESXi |
Power On |
| — | ✅ | ✅ |
Graceful Shutdown |
| Double | ✅ | ✅ |
Force Power Off |
| Double | ✅ | ✅ |
Reset |
| — | ✅ | ✅ |
Suspend |
| — | ✅ | ✅ |
Create VM |
| — | ✅ | ✅ |
Delete VM |
| Double | ✅ | ✅ |
Reconfigure |
| Double | ✅ | ✅ |
Create Snapshot |
| — | ✅ | ✅ |
List Snapshots |
| — | ✅ | ✅ |
Revert Snapshot |
| Double | ✅ | ✅ |
Delete Snapshot |
| Double | ✅ | ✅ |
Task Status |
| — | ✅ | ✅ |
Clone VM |
| Double | ✅ | ✅ |
vMotion |
| Double | ✅ | ❌ |
Set TTL |
| Double | ✅ | ✅ |
Cancel TTL |
| — | ✅ | ✅ |
List TTLs |
| — | ✅ | ✅ |
Clean Slate |
| Double | ✅ | ✅ |
Guest Exec |
| Double | ✅ | ✅ |
Guest Exec (with output) |
| — | ✅ | ✅ |
Guest Upload |
| Double | ✅ | ✅ |
Guest Download |
| — | ✅ | ✅ |
Guest Operations require VMware Tools running inside the guest OS.
guest-exec-outputauto-detects Linux/Windows shell and captures stdout/stderr.
Plan → Apply (Multi-step Operations)
For complex operations involving 2+ steps or 2+ VMs, use the plan/apply workflow instead of executing individually:
Step | What Happens |
1. Create Plan | AI calls |
2. Review | AI shows plan to user: steps, affected VMs, irreversible warnings |
3. Apply |
|
4. Rollback (if failed) | Asks user whether to rollback, then |
Plans stored in ~/.vmware-aiops/plans/, auto-deleted on success, auto-cleaned after 24h.
VM Deployment & Provisioning
Operation | Command | Speed | vCenter | ESXi |
Deploy from OVA |
| Minutes | ✅ | ✅ |
Deploy from Template |
| Minutes | ✅ | ✅ |
Linked Clone |
| Seconds | ✅ | ✅ |
Attach ISO |
| Instant | ✅ | ✅ |
Convert to Template |
| Instant | ✅ | ✅ |
Batch Clone |
| Minutes | ✅ | ✅ |
Batch Deploy (YAML) |
| Auto | ✅ | ✅ |
Cluster Management
Operation | Command | Confirmation | vCenter | ESXi |
Cluster Info |
| — | ✅ | ❌ |
Create Cluster |
| — | ✅ | ❌ |
Delete Cluster |
| Double | ✅ | ❌ |
Add Host |
| Double | ✅ | ❌ |
Remove Host |
| Double | ✅ | ❌ |
Configure HA/DRS |
| Double | ✅ | ❌ |
remove-hostrequires the host to be in maintenance mode first; the host is moved out of the cluster into the datacenter's host folder as a standalone host.
Alarm Management
Operation | Command | Confirmation | vCenter | ESXi |
List Triggered Alarms |
| — | ✅ | ❌ |
Acknowledge Alarm |
| — | ✅ | ❌ |
Clear (Reset) Alarms |
| Double | ✅ | ❌ |
Blast radius: vSphere has no per-alarm clear API.
alarm resetusesAlarmManager.ClearTriggeredAlarms, which clears all triggered alarms matching the named alarm's entity type (host/VM/all) and current status (red/yellow) — not just the named one. The named alarm is looked up first (typos fail fast), and the output'sscopefield reports exactly what was cleared. Cleared alarms re-trigger automatically if their underlying condition persists.
Datastore Browser
Feature | vCenter | ESXi | Details |
Browse Files | ✅ | ✅ | List files/folders in any datastore path |
Scan Images | ✅ | ✅ | Discover ISO, OVA, OVF, VMDK across all datastores |
Scheduled Scanning & Notifications
Feature | Details |
Daemon | APScheduler-based, configurable interval (default 15 min) |
Multi-target Scan | Sequentially scan all configured vCenter/ESXi targets |
Scan Content | Alarms + Events + Host logs (hostd, vmkernel, vpxd) |
Log Analysis | Regex pattern matching: error, fail, critical, panic, timeout, corrupt |
Structured Log | JSONL output to |
Webhook | Slack, Discord, or any HTTP endpoint |
Daemon Management |
|
Safety Features
Feature | Details |
Dry-Run Mode (CLI only) |
|
Plan → Confirm → Execute → Log | CLI workflow: show current state, confirm changes, execute, audit log |
Double Confirmation (CLI only) | Destructive CLI commands (power-off, delete, reconfigure, snapshot-revert/delete, clean-slate, guest-exec, guest-upload, cluster delete/remove-host, alarm clear) require 2 sequential prompts and take no bypass flag |
No confirmation on the MCP path | The 43 write tools an agent sees over MCP act on the first call — no |
Rejection Logging | Declined CLI confirmations are recorded in the audit trail |
Audit Trail | All operations logged to |
Input Validation | VM name, CPU (1-128), memory (128-1048576 MB), disk (1-65536 GB) validated |
Password Protection |
|
SSL Self-signed Support |
|
Prompt Injection Protection | vSphere event messages and host logs are truncated, stripped of control characters, and wrapped in boundary markers before output |
Webhook Data Scope | Sends notifications to user-configured URLs only — no third-party services by default |
Task Waiting | All async operations wait for completion and report result |
State Validation | Pre-operation checks (VM exists, power state correct) |
vCenter vs ESXi Comparison
Capability | vCenter | ESXi Standalone |
vMotion migration | ✅ | ❌ |
Cross-host clone | ✅ | ❌ |
Cluster management | ✅ | ❌ |
All VM lifecycle ops | ✅ | ✅ |
OVA/Template/Linked Clone deploy | ✅ | ✅ |
Datastore browsing & image scan | ✅ | ✅ |
Snapshots | ✅ | ✅ |
Guest operations | ✅ | ✅ |
Inventory, alarms, events, sensors, host services, and scanning are now in vmware-monitor.
What protects you
The table above lists two different surfaces and it is worth being blunt about which protections apply to which, because getting this wrong is worse than having no protection at all — a guardrail you believe in is one you stop compensating for.
On the CLI, a destructive command asks twice and takes no bypass flag, and
--dry-run previews any write. That defends a mistyped command typed by a
human. It does not defend against an agent, which satisfies both prompts with
yes |.
Over MCP, there is no confirmation step at all. All 43 write tools —
vm_delete, cluster_delete, vm_guest_exec among them — act on the first
call. Seven host-networking and DRS tools take a confirm argument that
defaults to a no-write preview, but that is a preview switch, not an approval
gate: one more call is all it takes. This is deliberate. A confirmed=
handshake was considered in July 2026 and cut, along with the earlier
VMWARE_READ_ONLY switch, because neither was a real boundary — the switch was
enforced on the MCP path only and any agent with a shell walked around it via
the CLI, and a handshake is a speed-bump a model that intends to act steps over.
What actually decides whether a write lands is the vCenter/ESXi service
account. Give the skill an account with the privileges the work needs and no
more; vCenter refuses the rest itself, on every surface, with no way around it
from inside this skill. To run an agent read-only, give it a read-only vCenter
role — one decision, enforced where it is made. Every call is then recorded in
~/.vmware/audit.db before the caller sees a result, which is how you find out
what happened.
vm_guest_exec is the one to think hardest about. It runs a caller-supplied
command inside the guest OS with the credentials handed to it, which the
documentation's own example makes root; nothing bounds what the command may
be. The guest account is a separate authorization boundary from the vCenter
one — a read-only vCenter role does not constrain what this tool does inside a
VM. If you do not need guest operations, do not configure guest credentials.
The full inventory of which tools are gated and which are not is in references/capabilities.md, where the numbers are checked against the live tool registry by the test suite rather than maintained by hand.
Troubleshooting
"VM not found" error
VM names are case-sensitive in vSphere. Use exact name from vmware-monitor inventory vms.
Guest exec returns empty output
Use vm_guest_exec_output instead of vm_guest_exec — it auto-captures stdout/stderr. Basic vm_guest_exec only returns exit code.
Deploy OVA times out
Large OVA files (>10GB) may exceed the default 120s timeout. The upload happens via HTTP NFC lease — ensure network between the machine running vmware-aiops and ESXi is stable.
Plan apply fails mid-way
Run vmware-aiops plan list to see failed plan status. Ask user if they want to rollback with vm_rollback_plan. Irreversible steps (delete_vm) are skipped during rollback.
Connection refused / SSL error
Verify target is reachable:
vmware-aiops doctorFor self-signed certs: set
verify_ssl: falsein config.yaml (lab environments only)
Supported AI Platforms
Platform | Status | Config File | AI Model |
Claude Code | ✅ Native Skill |
| Anthropic Claude |
Gemini CLI | ✅ Context file + MCP |
| Google Gemini |
OpenAI Codex CLI | ✅ Skill + AGENTS.md |
| OpenAI GPT |
Aider | ✅ Conventions |
| Any (cloud + local) |
Continue CLI | ✅ Rules |
| Any (cloud + local) |
Trae IDE | ✅ Rules |
| Claude/DeepSeek/GPT-4o/Doubao |
Kimi Code CLI | ✅ Skill |
| Moonshot Kimi |
MCP Server | ✅ MCP Protocol |
| Any MCP client |
Python CLI | ✅ Standalone | N/A | N/A |
Platform Comparison
Feature | Claude Code | Gemini CLI | Codex CLI | Aider | Continue | Trae IDE | Kimi CLI |
Cloud AI | Anthropic | OpenAI | Any | Any | Multi | Moonshot | |
Local models | — | — | — | Ollama | Ollama | — | — |
Skill system | SKILL.md | Context file | SKILL.md | — | Rules | Rules | SKILL.md |
MCP support | Native | Native | Via Skills | Third-party | Native | — | — |
Free tier | — | 60 req/min | — | Self-hosted | Self-hosted | — | — |
MCP Server Integrations
The vmware-aiops MCP server works with any MCP-compatible agent or tool. Ready-to-use configuration templates are in examples/mcp-configs/.
Agent / Tool | Local Model Support | Config Template | Integration Guide |
✅ Self-hosted, any LLM | |||
✅ Ollama, LM Studio | |||
✅ Fully offline | |||
✅ Ollama, vLLM | |||
VS Code Copilot | — | ||
— | |||
Continue | ✅ Ollama | ||
Claude Code | — | — |
Xiaoguai (小怪) — a self-hostable, audit-first agent platform (Rust, single binary + embedded SQLite) from the same maintainer. It runs the vmware-aiops MCP server as one of its toolboxes; being both an MCP consumer and an MCP server, its HMAC-chained audit log and human-on-the-loop approval gates line up with this skill's own audit + confirm design. See its MCP integration guide.
Fully local operation (no cloud API required):
# Aider + Ollama + vmware-aiops (via SKILL.md)
aider --conventions skills/vmware-aiops/SKILL.md --model ollama/qwen2.5-coder:32b
# Any MCP agent + local model + vmware-aiops MCP server
# See examples/mcp-configs/ for your agent's config formatInstallation
Step 0: Prerequisites
# Python 3.10+ required
python3 --version
# Node.js 18+ required for Gemini CLI and Codex CLI
node --versionStep 1: Clone & Install Python Backend
All platforms share the same Python backend.
git clone https://github.com/vmware-skills/VMware-AIops.git
cd VMware-AIops
python3 -m venv .venv
source .venv/bin/activate
pip install -e .Step 2: Configure
mkdir -p ~/.vmware-aiops
cp config.example.yaml ~/.vmware-aiops/config.yaml
# Edit config.yaml with your vCenter/ESXi targetsSet passwords via .env file (recommended):
# Use the template
cp .env.example ~/.vmware-aiops/.env
# Edit and fill in your passwords, then lock permissions
chmod 600 ~/.vmware-aiops/.envSecurity note: Prefer
.envfile over command-lineexportto avoid passwords appearing in shell history. The.envfile should havechmod 600(owner-only read/write).
Password environment variable naming convention:
VMWARE_{TARGET_NAME_UPPER}_PASSWORD
# Replace hyphens with underscores, UPPERCASE
# Example: target "home-esxi" → VMWARE_HOME_ESXI_PASSWORD
# Example: target "prod-vcenter" → VMWARE_PROD_VCENTER_PASSWORDSecurity Best Practices
NEVER hardcode passwords in scripts or config files
NEVER pass passwords as command-line arguments (visible in
ps)ALWAYS use
~/.vmware-aiops/.envwithchmod 600ALWAYS configure connections via
config.yaml— credentials are loaded from.envautomaticallyConfig File Contents:
config.yamlstores target hostnames, ports, and a reference to the.envfile. It does not contain passwords or tokens. All secrets are stored exclusively in.envTLS: Enabled by default. Disable only for ESXi hosts with self-signed certificates in isolated lab environments
Webhook: Disabled by default. When enabled, sends monitoring summaries to your own configured URL only — payloads contain no credentials, IPs, or PII, only aggregated alert metadata. No data sent to third-party services
Least Privilege: Use a dedicated vCenter service account with minimal permissions. For monitoring-only use cases, prefer the read-only VMware-Monitor
Prompt Injection Protection: All vSphere-sourced content is truncated, stripped of control characters, and wrapped in boundary markers before output
Code Review: We recommend reviewing the source code and commit history before deploying in production
Production Safety: For production environments, use the read-only VMware-Monitor instead. AI agents can misinterpret context and execute unintended destructive operations — real-world incidents have shown that AI-driven infrastructure tools without proper isolation can delete production databases and entire environments. VMware-Monitor eliminates this risk at the code level: no destructive functions exist in its codebase
Step 3: Connect Your AI Tool
Choose one (or more) of the following:
Option A: Claude Code
Method 1: Skills.sh or ClawHub (recommended)
Either installer places the skill in Claude Code's skills directory for you:
npx skills add vmware-skills/VMware-AIops
# or
clawhub install @zw008/vmware-aiopsMethod 2: Manual skill install
git clone https://github.com/vmware-skills/VMware-AIops.git
cd VMware-AIops
# Copy the skill into Claude Code's personal skills directory
mkdir -p ~/.claude/skills/vmware-aiops
cp -r skills/vmware-aiops/. ~/.claude/skills/vmware-aiops/For tool access (not just skill context), also register the MCP server:
claude mcp add vmware-aiops -- vmware-aiops mcpRestart Claude Code, then:
> Show me all VMs on esxi-lab.example.comSubmit to Official Marketplace
This plugin can also be submitted to the Anthropic official plugin directory for public discovery.
Option B: Gemini CLI
# Install Gemini CLI
npm install -g @google/gemini-cli
# Load the skill as project context (Gemini CLI reads GEMINI.md on startup)
cp skills/vmware-aiops/SKILL.md ./GEMINI.mdFor tool access (not just context), register the MCP server in ~/.gemini/settings.json:
{
"mcpServers": {
"vmware-aiops": {
"command": "vmware-aiops",
"args": ["mcp"],
"env": { "VMWARE_AIOPS_CONFIG": "~/.vmware-aiops/config.yaml" }
}
}
}Then start Gemini CLI:
gemini
> Show me all VMs on my ESXi hostOption C: OpenAI Codex CLI
# Install Codex CLI
npm i -g @openai/codex
# Or on macOS:
# brew install --cask codex
# Copy skill to Codex skills directory
mkdir -p ~/.codex/skills/vmware-aiops
cp skills/vmware-aiops/SKILL.md ~/.codex/skills/vmware-aiops/SKILL.md
# Copy AGENTS.md to project root
cp skills/vmware-aiops/SKILL.md ./AGENTS.mdThen start Codex CLI:
codex --enable skills
> List all VMs on my ESXiOption D: Aider (supports local models)
# Install Aider
pip install aider-chat
# Install Ollama for local models (optional)
# macOS:
brew install ollama
ollama pull qwen2.5-coder:32b
# Run with cloud API
aider --conventions skills/vmware-aiops/SKILL.md
# Or with local model via Ollama
aider --conventions skills/vmware-aiops/SKILL.md \
--model ollama/qwen2.5-coder:32bOption E: Continue CLI (supports local models)
# Install Continue CLI
npm i -g @continuedev/cli
# Copy rules file
mkdir -p .continue/rules
cp skills/vmware-aiops/SKILL.md .continue/rules/vmware-aiops.mdConfigure ~/.continue/config.yaml for local model:
models:
- name: local-coder
provider: ollama
model: qwen2.5-coder:32bThen:
cn
> Check ESXi health and alarmsOption F: Trae IDE
Copy the rules file to your project's .trae/rules/ directory:
mkdir -p .trae/rules
cp skills/vmware-aiops/SKILL.md .trae/rules/project_rules.mdTrae IDE's Builder Mode reads .trae/rules/ Markdown files at startup.
Note: You can also install Claude Code extension in Trae IDE and use
.claude/skills/format directly.
Option G: Kimi Code CLI
# Copy skill file to Kimi skills directory
mkdir -p ~/.kimi/skills/vmware-aiops
cp skills/vmware-aiops/SKILL.md ~/.kimi/skills/vmware-aiops/SKILL.mdOption H: MCP Server (Glama / Claude Desktop)
The MCP server exposes VMware operations as tools via the Model Context Protocol. Works with any MCP-compatible client (Claude Desktop, Cursor, etc.).
After uv tool install vmware-aiops, start the MCP server with one command (v1.5.15+):
# Recommended — single command, no network re-resolve
vmware-aiops mcp
# With a custom config path
VMWARE_AIOPS_CONFIG=/path/to/config.yaml vmware-aiops mcpClaude Desktop config (claude_desktop_config.json):
{
"mcpServers": {
"vmware-aiops": {
"command": "vmware-aiops",
"args": ["mcp"],
"env": {
"VMWARE_AIOPS_CONFIG": "/path/to/config.yaml"
}
}
}
}# Run without installing (requires PyPI access each launch)
uvx --from vmware-aiops vmware-aiops mcp
# Legacy entry point (still works, kept for backward compatibility)
vmware-aiops-mcpBehind a corporate TLS proxy? uvx may fail with
invalid peer certificate: UnknownIssuer. Use the recommendedvmware-aiops mcpform above (no network needed), or setUV_NATIVE_TLS=true.
Option I: Standalone CLI (no AI)
# Already installed in Step 1
source .venv/bin/activate
vmware-aiops vm power-on my-vm --target home-esxi
vmware-aiops deploy ova ./ubuntu.ova --name my-vm --target home-esxi
vmware-aiops datastore browse datastore1 --target home-esxiUpdate / Upgrade
Already installed? Re-run the install command for your channel to get the latest version:
Install Channel | Update Command |
ClawHub |
|
Skills.sh |
|
Git clone |
|
uv |
|
Check your current version: vmware-aiops --version
Chinese Cloud Models
For users in China who prefer domestic cloud APIs or have limited access to overseas services.
DeepSeek
Cost-effective, strong coding capability.
# Set DeepSeek API key (get from https://platform.deepseek.com)
export DEEPSEEK_API_KEY="your-key"
# Run with Aider
aider --conventions skills/vmware-aiops/SKILL.md \
--model deepseek/deepseek-coderPersistent config ~/.aider.conf.yml:
model: deepseek/deepseek-coder
conventions: skills/vmware-aiops/SKILL.mdQwen (Alibaba Cloud)
Alibaba Cloud's coding model, free tier available.
# Set DashScope API key (get from https://dashscope.console.aliyun.com)
export DASHSCOPE_API_KEY="your-key"
aider --conventions skills/vmware-aiops/SKILL.md \
--model qwen/qwen-coder-plusOr via OpenAI-compatible endpoint:
export OPENAI_API_BASE="https://dashscope.aliyuncs.com/compatible-mode/v1"
export OPENAI_API_KEY="your-dashscope-key"
aider --conventions skills/vmware-aiops/SKILL.md \
--model qwen-coder-plus-latestDoubao (ByteDance)
export OPENAI_API_BASE="https://ark.cn-beijing.volces.com/api/v3"
export OPENAI_API_KEY="your-ark-key"
aider --conventions skills/vmware-aiops/SKILL.md \
--model your-doubao-endpoint-idWith Continue CLI
Configure ~/.continue/config.yaml:
# DeepSeek
models:
- name: deepseek-coder
provider: openai-compatible
apiBase: https://api.deepseek.com/v1
apiKey: your-deepseek-key
model: deepseek-coder
# Qwen
models:
- name: qwen-coder
provider: openai-compatible
apiBase: https://dashscope.aliyuncs.com/compatible-mode/v1
apiKey: your-dashscope-key
model: qwen-coder-plus-latestLocal Models (Aider + Ollama)
For fully offline operation — no cloud API, no internet, full privacy.
Aider + Ollama + local Qwen/DeepSeek is ideal for air-gapped environments.
Step 1: Install Ollama
# macOS
brew install ollama
# Linux — download from https://ollama.com/download and install manually
# See https://github.com/ollama/ollama for platform-specific instructionsStep 2: Pull a model
Model | Command | Size | Note |
Qwen 2.5 Coder 32B |
| ~20GB | Best local coding model |
Qwen 2.5 Coder 7B |
| ~4.5GB | Low-memory option |
DeepSeek Coder V2 |
| ~8.9GB | Strong reasoning |
CodeLlama 34B |
| ~19GB | Meta coding model |
Hardware: 32B → ~20GB VRAM (or 32GB RAM for CPU). 7B → 8GB RAM.
Step 3: Run with Aider
pip install aider-chat
ollama serve
# Aider + local Qwen (recommended)
aider --conventions skills/vmware-aiops/SKILL.md \
--model ollama/qwen2.5-coder:32b
# Aider + local DeepSeek
aider --conventions skills/vmware-aiops/SKILL.md \
--model ollama/deepseek-coder-v2
# Low-memory option
aider --conventions skills/vmware-aiops/SKILL.md \
--model ollama/qwen2.5-coder:7bPersistent config ~/.aider.conf.yml:
model: ollama/qwen2.5-coder:32b
conventions: skills/vmware-aiops/SKILL.mdLocal Architecture
User → Aider CLI → Ollama (localhost:11434) → Qwen / DeepSeek local model
│ ↓
│ reads AGENTS.md instructions
│ ↓
└──────────────────────────────→ vmware-aiops CLI ──→ ESXi / vCenterTip: Local models are fully offline — perfect for air-gapped environments or strict data compliance.
CLI Reference
# Diagnostics
vmware-aiops doctor # Check environment, config, connectivity
vmware-aiops doctor --skip-auth # Skip vSphere auth check (faster)
# MCP Config Generator
vmware-aiops mcp-config generate --agent goose # Generate config for Goose
vmware-aiops mcp-config generate --agent claude-code # Generate config for Claude Code
vmware-aiops mcp-config list # List all supported agents
# VM operations
vmware-aiops vm power-on my-vm # Power on
vmware-aiops vm power-off my-vm # Graceful shutdown (2x confirm)
vmware-aiops vm power-off my-vm --force # Force power off (2x confirm)
vmware-aiops vm create my-new-vm --cpu 4 --memory 8192 --disk 100 # Create VM
vmware-aiops vm delete my-vm --confirm # Delete VM (2x confirm)
vmware-aiops vm reconfigure my-vm --cpu 4 --memory 8192 # Reconfigure (2x confirm)
vmware-aiops vm snapshot-create my-vm --name "before-upgrade" # Create snapshot
vmware-aiops vm snapshot-list my-vm # List snapshots
vmware-aiops vm snapshot-revert my-vm --name "before-upgrade" # Revert snapshot
vmware-aiops vm snapshot-delete my-vm --name "before-upgrade" # Delete snapshot (waits ≤30 min for consolidation)
vmware-aiops vm snapshot-delete my-vm --name "old-big" --no-wait # Fire async, return a task id
vmware-aiops vm task-status task-1234 # Poll an async task by id
vmware-aiops vm clone my-vm --new-name my-vm-clone # Clone VM
vmware-aiops vm migrate my-vm --to-host esxi-02 # vMotion
vmware-aiops vm set-ttl my-vm --minutes 60 # Auto-delete in 60 min
vmware-aiops vm cancel-ttl my-vm # Cancel TTL
vmware-aiops vm list-ttl # Show all TTLs
vmware-aiops vm clean-slate my-vm --snapshot baseline # Revert to baseline (2x confirm)
# Guest Operations (requires VMware Tools in guest)
vmware-aiops vm guest-exec my-vm --cmd /bin/bash --args "-c 'whoami'" --user root
vmware-aiops vm guest-upload my-vm --local ./script.sh --guest /tmp/script.sh --user root
vmware-aiops vm guest-download my-vm --guest /var/log/syslog --local ./syslog.txt --user root
# Plan → Apply (multi-step operations)
vmware-aiops plan list # List pending/failed plans
# Deploy
vmware-aiops deploy ova ./ubuntu.ova --name my-vm --datastore ds1 # Deploy from OVA
vmware-aiops deploy template golden-ubuntu --name new-vm # Deploy from template
vmware-aiops deploy linked-clone --source base-vm --snapshot clean --name test-vm # Linked clone (seconds)
vmware-aiops deploy iso my-vm --iso "[datastore1] iso/ubuntu-22.04.iso" # Attach ISO
vmware-aiops deploy mark-template golden-vm # Convert VM to template
vmware-aiops deploy batch-clone --source base-vm --count 5 --prefix lab # Batch clone
vmware-aiops deploy batch deploy.yaml # Batch deploy from YAML spec
# Cluster
vmware-aiops cluster info my-cluster # Cluster details (HA/DRS status)
vmware-aiops cluster create my-cluster --ha --drs # Create cluster with HA+DRS
vmware-aiops cluster delete my-cluster # Delete cluster (2x confirm)
vmware-aiops cluster add-host my-cluster --host esxi-03 # Add host to cluster (2x confirm)
vmware-aiops cluster remove-host my-cluster --host esxi-03 # Remove host (2x confirm)
vmware-aiops cluster configure my-cluster --ha --drs # Configure HA/DRS (2x confirm)
# Alarm management
vmware-aiops alarm list # List triggered alarms
vmware-aiops alarm acknowledge esxi-01 "Host memory usage" # Acknowledge alarm
vmware-aiops alarm reset esxi-01 "Host memory usage" # Clear alarms (2x confirm; clears ALL matching entity type + status)
# Datastore (browse and scan only — iSCSI/vSAN moved to vmware-storage)
vmware-aiops datastore browse datastore1 --path "iso/" # Browse datastore
vmware-aiops datastore scan-images --target home-esxi # Scan all datastores for images
# Scan
vmware-aiops scan now # One-time scan
# Daemon
vmware-aiops daemon start # Start scanner
vmware-aiops daemon status # Check status
vmware-aiops daemon stop # Stop daemon
# Companion skills for other operations:
# vmware-monitor: inventory, alarms, events, sensors
# vmware-storage: datastores, iSCSI, vSAN
# vmware-vks: Tanzu/TKC cluster lifecycleConfiguration
See config.example.yaml for all options.
Section | Key | Default | Description |
targets | name | — | Friendly name |
targets | host | — | vCenter/ESXi hostname or IP |
targets | type | vcenter |
|
targets | port | 443 | Connection port |
targets | verify_ssl | true | Verify the target's TLS certificate (set false only for self-signed lab hosts) |
scanner | interval_minutes | 15 | Scan frequency |
scanner | severity_threshold | warning | Min severity: critical/warning/info |
scanner | lookback_hours | 1 | How far back to scan |
scanner | log_types | [vpxd, hostd, vmkernel] | Log sources |
notify | log_file | ~/.vmware-aiops/scan.log | JSONL log output |
notify | webhook_url | — | Webhook endpoint (Slack, Discord, etc.) |
Project Structure
VMware-AIops/
├── skills/ # Skills index (npx skills add)
│ └── vmware-aiops/
│ ├── SKILL.md # Slimmed-down skill (progressive disclosure)
│ └── references/ # Detailed docs loaded on-demand
│ ├── capabilities.md # Full capabilities tables
│ ├── cli-reference.md # Complete CLI reference
│ └── setup-guide.md # Install, security, AI platforms
├── vmware_aiops/ # Python backend
│ ├── config.py # YAML + .env config
│ ├── connection.py # Multi-target pyVmomi
│ ├── cli/ # Typer CLI (double confirm)
│ ├── ops/ # Operations
│ │ ├── inventory.py # VMs, hosts, datastores, clusters
│ │ ├── health.py # Alarms, events, sensors
│ │ ├── vm_lifecycle.py # VM CRUD, snapshots, clone, migrate
│ │ ├── vm_deploy.py # OVA, template, linked clone, batch deploy
│ │ └── datastore_browser.py # Datastore browsing, image discovery
│ ├── scanner/ # Log scanning daemon
│ ├── notify/ # Notifications (JSONL + webhook)
│ └── mcp_server/ # MCP server wrapper
│ ├── server.py # FastMCP server with tools
│ └── __main__.py
├── examples/mcp-configs/ # MCP client config templates
├── tests/ # Test suite
├── smithery.yaml # Smithery marketplace config
├── RELEASE_NOTES.md
├── config.example.yaml
└── pyproject.tomlAPI Coverage
Built on pyVmomi (vSphere Web Services API / SOAP).
API Object | Usage |
| VM lifecycle, snapshots, clone, migrate |
| ESXi host info, sensors, services |
| Storage capacity, type, accessibility |
| File browsing, image discovery (ISO/OVA/VMDK) |
| OVA import and deployment |
| Cluster, DRS, HA |
| Network listing |
| Active alarm monitoring |
| Event/log queries |
Related Projects
Skill | Scope | Tools | Install |
VM lifecycle, deployment, guest ops, cluster, datastore browse, triage | 49 |
| |
Read-only monitoring, alarms, events, investigation bundles | 27 |
| |
Datastores, iSCSI, vSAN | 11 |
| |
Tanzu Namespaces, TKC cluster lifecycle | 20 |
| |
NSX networking: segments, gateways, NAT, routing, IPAM | 33 |
| |
DFW policies/rules, security groups, Traceflow, IDS/IPS | 21 |
| |
Aria Operations metrics, alerts, capacity, anomalies | 28 |
| |
AVI (NSX ALB) load balancing, AKO Kubernetes ops | 28 |
| |
Compliance baselines (CIS / vSphere SCG / 等保 / PCI-DSS), drift detection | 6 |
|
Troubleshooting & Contributing
If you encounter any errors or issues, please send the error message, logs, or screenshots to zhouwei008@gmail.com. Contributions are welcome — feel free to join us in maintaining and improving this project!
License
MIT