Skip to main content
Glama
vmware-skills

io.github.zw008/vmware-log-insight

VMware Log Insight

Disclaimer: Community-maintained open-source project, not affiliated with, endorsed by, or sponsored by VMware, Inc. or Broadcom Inc. "VMware", "vSphere", and "Aria" are trademarks of Broadcom. Source is publicly auditable under the MIT license.

Read-only log search and aggregation for VMware Aria Operations for Logs (formerly vRealize Log Insight) — the appliance that collects syslog from ESXi hosts, vCenter, and VMs. The centralized-log data source for the VMware skill family. Strictly non-destructive: it queries, it never writes.

Upgrading to 2.0

2.0 renames all 7 MCP tools so every name starts with a verb (e.g. alert_get → get_log_alert, alert_history → get_log_alert_history, alert_list → list_log_alerts). The full old → new table is in RELEASE_NOTES.md. Nothing else changes: same tools, parameters, safety gates and CLI commands. If an agent prompt, script or ~/.vmware/rules.yaml names a tool, update it — though deny rules written with the old names keep working with vmware-policy ≥ 1.18 (vmware-audit policy lists any rule the renames widened), and vmware-pilot ≥ 1.13 translates old names in saved workflows. If an install older than 2.0 shares that rules.yaml, give it vmware-policy ≥ 1.18.2 too: it matches each rule against both the old and the new name, so one file serves both.

Related MCP server: quickwit-mcp

Companion Skills

Need

Skill

Tools

Raw centralized logs + spikes

vmware-log-insight (this)

7

vCenter events & alarms

vmware-monitor

27

Metrics, anomalies, capacity

vmware-aria

28

Incident correlation / root cause

vmware-debug — feed it search_logs output

2

VM lifecycle / operations

vmware-aiops

49

Install

uv tool install vmware-log-insight
mkdir -p ~/.vmware-log-insight
cp config.example.yaml ~/.vmware-log-insight/config.yaml   # edit host/username/provider
echo 'VMWARE_LOG_INSIGHT_PROD_PASSWORD=...' > ~/.vmware-log-insight/.env
chmod 600 ~/.vmware-log-insight/.env
vmware-log-insight doctor

Offline / Air-Gapped Install (from source)

This project uses the modern PEP 517 build system (hatchling), so there is no setup.py by design — that is expected, not a missing file. If you cloned the source and hit ERROR: File "setup.py" or "setup.cfg" not found ... editable mode currently requires a setuptools-based build, your pip is older than 21.3 and cannot do an editable (-e) install with a non-setuptools backend. Editable mode is a developer convenience, not needed to run the tool — do one of:

# From the source tree — a normal (non-editable) install builds a wheel:
pip install .              # NOT  pip install -e .

# ...or upgrade pip first, and editable works too:
pip install --upgrade pip && pip install -e .

For a truly air-gapped host, build the wheels on a connected machine and copy them over — the target then needs no network:

# On a connected machine, collect this package + its dependencies as wheels:
pip wheel . -w dist        # → dist/*.whl   (or: uv build, for just this package)

# Copy dist/ to the air-gapped host, then install offline:
pip install --no-index --find-links dist vmware-log-insight

MCP Tools (7 — all read-only)

Tool

What

search_logs

Search events by time window + text (whole-token match), up to 200 events

aggregate_logs

Count/aggregate over time bins (UCOUNT/AVG/... of a field), with z-score spike detection

list_log_fields

List the appliance's fields (name + type), for aggregate_logs field

get_log_insight_version

Appliance version/build

list_log_alerts / get_log_alert / get_log_alert_history

Query defined alerts and their trigger history

Workflows

  • Find errors fast — vmware-log-insight search -q error -l 1h.

  • Where did logs burst? — vmware-log-insight aggregate -q error -l 6h --bin-ms 300000, read spikes[], then search the spike window.

  • Root cause — pass search_logs results (plus vCenter events from vmware-monitor and metrics from vmware-aria) to vmware-debug build_incident_timeline.

Troubleshooting

  • 401 on /sessions → check username/password/provider and the VMWARE_LOG_INSIGHT_<TARGET>_PASSWORD env var.

  • 503 everywhere → appliance starting up; doctor reports it as a status, not a crash.

  • Empty results → widen --last; text matches whole words, not substrings (try word*); default API port is 9543 (set port if different).

  • UCOUNT needs a field → pass --field (names from fields); COUNT and SAMPLE take none.

Security

Read-only by construction. Credentials in ~/.vmware-log-insight/.env (chmod 600); plaintext passwords auto-obfuscated to grep-safe b64: (obfuscation, not encryption — inject from a secret manager for real secrecy). TLS on by default. See SECURITY.md.

Remote access (HTTPS) and limiting tools

By default vmware-log-insight mcp speaks stdio to one local client and offers every tool. Two options change that (vmware-policy ≥ 1.21.0).

Serve over HTTPS so clients on other machines can connect. Every caller needs a bearer token:

vmware-audit token create alice          # prints the token once; give it to alice
vmware-audit token list                  # names only
vmware-audit token revoke alice          # refused from its next request, no restart
vmware-log-insight mcp --transport https --host 0.0.0.0 --port 8443 \
    --cert /etc/vmware-mcp/server.pem --key /etc/vmware-mcp/server-key.pem \
    --public-name mcp.example.com

Connect a client (Claude Code shown; any MCP client that supports streamable HTTP and custom headers works):

claude mcp add --transport http vmware-log-insight https://mcp.example.com:8443/mcp \
    --header "Authorization: Bearer $VMWARE_MCP_TOKEN"
{
  "mcpServers": {
    "vmware-log-insight": {
      "type": "http",
      "url": "https://mcp.example.com:8443/mcp",
      "headers": { "Authorization": "Bearer ${VMWARE_MCP_TOKEN}" }
    }
  }
}
  • The server will not start without a token, refuses Host/Origin values outside --public-name, and checks before it binds that unauthenticated requests get 401. Use a certificate your clients trust for those names.

  • Behind a TLS-terminating reverse proxy on the same machine use --transport http --host 127.0.0.1 --public-name mcp.example.com and pass the Authorization header through.

  • Behind a load balancer or gateway on another machine, keep --transport https (a self-signed certificate is fine), list in --public-name the host name the balancer sends as Host, and have it forward Authorization. Its health probe can use GET /healthz, which needs no token and returns only {"status": "ok"} (vmware-policy ≥ 1.23.0).

  • Send traceparent or X-Request-ID with each request to have it stored on the audit row; vmware-audit log --correlation-id ID then finds the calls behind one platform request.

  • The audit log records each caller as token:<name>. Calls run side by side, with or without a target: each target keeps up to VMWARE_MCP_POOL_SIZE sessions (default 2), and each session is a login on the target. A call that finds them all busy waits at most 300 s for one.

  • Everyone who can reach the endpoint acts with this server's account. Tokens identify callers; they grant nothing on the platform. Run one endpoint per privilege level.

  • Several people or roles on one endpoint: run vmware-audit roles enable once, then give each token a role (vmware-audit token create NAME --role reader, or a role in roles.yaml naming tools and targets; vmware-policy ≥ 1.24.0). A role limits what the token may call on this endpoint; it cannot grant more than the account has. See vmware-policy's README, "Roles for network callers".

Limiting tools: every tool of this server is read-only, so --expose read changes nothing here; it exists for the write-capable skills. Least privilege comes from the account the server uses.

Details: skills/vmware-log-insight/references/setup-guide.md ("Serving MCP over HTTPS", "Limiting which tools are offered").

License

MIT.

Available Tools

7 tools
aggregate_logsA
Read-onlyIdempotent

[READ] Aggregate matching events into a time series and detect spikes.

WHEN: to find when/whether log volume burst without pulling raw events. Follow up with search_logs on the spike window.

RETURNS: {aggregation, field, bin_width_ms, constraints, bins:[{timestamp_ms, end_ms, value}] oldest first, spikes:[{timestamp_ms, end_ms, value, zscore}]}, plus 'note' when an empty series has a likely cause. For SAMPLE each bin's value is one example event {timestamp_ms, text, fields}, and no spikes are computed. The appliance omits bins with no events; for COUNT and UCOUNT those are added back as 0 (filled_empty_bins: true) so a burst after a quiet stretch still stands out. On a sparse series (a few events in an hour) that makes most non-empty bins spikes — read them as "events happened here", not as bursts. A bin is flagged as a spike when it sits at least 2 standard deviations above the mean; a series of fewer than 3 bins, or a flat one, reports no spikes rather than calling everything a spike — so an empty 'spikes' list is not evidence of calm when the window is short. Read-only.

ParametersJSON Schema
NameRequiredDescriptionDefault
lastNoRelative window ending now — "30m", "2h", "7d" (units s/m/h/d) or a bare number of seconds. Cannot be combined with begin_ms/end_ms. Omit all three and the window defaults to the last hour.
textNoWord(s) matched with CONTAINS (whole words, not substrings; `*` is a wildcard), exactly as in search_logs. Omit to aggregate every event in the window.
fieldNoThe field the function applies to, as listed by list_log_fields ('name') — e.g. aggregation="UCOUNT", field="hostname" counts distinct hosts per bin. Required for UCOUNT/AVG/MIN/MAX/SUM/STDDEV/VARIANCE, refused for COUNT/SAMPLE. AVG/MIN/MAX/SUM/STDDEV/VARIANCE need a NUMBER field (list_log_fields 'type'). An unknown name returns an empty series with a 'note', not an error. Pass 'name' exactly as list_log_fields gives it: for a content-pack field that is the qualified "com.vmware.vsphere:vmw_esxi_auth_failed_user" — the bare display name and 'internal_name' match nothing.
end_msNoAbsolute window end as epoch milliseconds. Usable on its own; cannot be combined with last.
targetNoLog Insight target name as spelled in ~/.vmware-log-insight/config.yaml. Omit to use that file's default_target — with no default configured, omitting it is an error that lists the configured names.
begin_msNoAbsolute window start as epoch milliseconds (seconds are refused). Usable on its own; must be before end_ms; cannot be combined with last.
aggregationNoThe function applied within each bin — exactly one of COUNT, UCOUNT, AVG, MIN, MAX, SUM, STDDEV, VARIANCE, SAMPLE (lower case is accepted and upper-cased). Anything else raises a ValueError listing the nine. Default COUNT, which answers "how many events per bin" and is what spike detection is normally run on. COUNT and SAMPLE take no field; the other seven require one.COUNT
bin_width_msNoWidth of each time bin in milliseconds, must be positive (default 60000 = one minute). It sets the resolution of both the series and the spike test: bins much wider than the burst average it away, bins much narrower make every quiet minute look like noise.

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations cover safety (readOnly/idempotent/non-destructive), and the description goes well beyond them: empty-bin back-filling for COUNT/UCOUNT (filled_empty_bins), SAMPLE returning one example event and no spikes, the 2-sigma spike rule, the <3-bin/flat-series exception, and the warning that an empty 'spikes' list is not evidence of calm. These are exactly the behavioral traits annotations cannot convey.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the action, then labeled WHEN and RETURNS sections, so it is easy to scan. It is long, but with no output schema the return-shape detail and spike caveats earn their space; only mild trimming would be possible.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite no output schema, the RETURNS block fully describes the response shape (bins, spikes, note, SAMPLE variant), and window/field/aggregation semantics plus edge cases are covered. Nothing needed to invoke or interpret the result is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so every parameter is already documented in the schema. The description restates some of that (e.g., COUNT being the aggregation spike detection runs on, bin_width_ms resolution trade-offs), adding reinforcement rather than new meaning. Baseline 3 is appropriate since the schema carries the parameter load.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource ('Aggregate matching events into a time series and detect spikes') and immediately contrasts with the raw-event sibling via 'without pulling raw events' and 'Follow up with search_logs'. An agent can route between aggregate_logs and search_logs without opening either schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The WHEN block names the intended use case (find whether/where log volume burst) and explicitly names the alternative (search_logs on the spike window) with the condition that selects it. The boundary between aggregating and pulling raw events is spelled out rather than inferred.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_log_alertA
Read-onlyIdempotent

[READ] Get the stored definition of one alert. Use this after list_log_alerts.

Returns the same sanitized {id, name, enabled, info} projection as an list_log_alerts row plus 'raw_keys' — the sorted key names the appliance actually sent — so you can see what else the definition carries without this skill guessing at its shape. For when the alert fired, use get_log_alert_history. Read-only.

ParametersJSON Schema
NameRequiredDescriptionDefault
targetNoLog Insight target name as spelled in ~/.vmware-log-insight/config.yaml. Omit to use that file's default_target — with no default configured, omitting it is an error that lists the configured names.
alert_idYesThe alert id exactly as returned in an list_log_alerts row's 'id' field (not the alert's name). An empty or malformed id (anything with '/', '?', spaces, or '..') is refused before any call; an unknown id comes back as HTTP 404 (500 for an id that is not a UUID) on 8.18.7, reported as "copy an exact id", not "retry".

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly/idempotent/non-destructive, so the safety profile is covered; the description adds real value with the return projection ({id, name, enabled, info} plus raw_keys) and how raw_keys exposes previously unseen fields. It does not need to restate 'Read-only' since annotations carry that, but the return-shape disclosure is substantive.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with a [READ] tag and the core action, then supporting detail. Every sentence carries information (routing, return shape, raw_keys rationale), though the closing 'Read-only.' slightly duplicates the annotation.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description usefully describes what comes back, including raw_keys, so an agent knows the response shape. Combined with the thorough schema error descriptions, the definition is nearly complete for a simple two-parameter read.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so both target and alert_id are fully documented in the schema, including error behavior (404/500, malformed-id refusal). The description adds no parameter-level detail beyond the schema, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Get the stored definition of one alert') and names the sibling it follows from (list_log_alerts). It is clearly distinguishable from get_log_alert_history, which it explicitly routes to for firing data.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit sequencing guidance ('Use this after list_log_alerts') and names the alternative for a different question ('For when the alert fired, use get_log_alert_history'). Both when-to-use and when-to-use-something-else are covered.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_log_alert_historyA
Read-onlyIdempotent

[READ] List recent trigger-history records for an alert.

Use this for when an alert fired, not how it's defined. Returns the family list envelope {items, returned, limit, total, truncated, hint}; each item is {timestamp_ms (when it fired), acknowledged, message_count, messages: [{timestamp_ms, text}]} with at most 3 of the record's events (verified on 8.18.7). An alert that never fired returns an empty list, not an error. The appliance pages history, so a page shorter than limit is the whole history (real total); a full page has total null and truncated true. Read-only.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMaximum history records returned, most recent first, 1..50 (default 50) — 50 is the appliance's own page cap; a larger value is lowered and 'note' says so. There is no offset, so records older than the newest 50 are not reachable through this tool.
targetNoLog Insight target name as spelled in ~/.vmware-log-insight/config.yaml. Omit to use that file's default_target — with no default configured, omitting it is an error that lists the configured names.
alert_idYesThe alert id exactly as returned in an list_log_alerts row's 'id' field (not the alert's name). An empty or malformed id is refused before any call; an unknown id is HTTP 404 (or 500) on 8.18.7.

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover readOnly/idempotent/destructive, yet the description still adds substantial non-obvious behavior: the exact return envelope {items, returned, limit, total, truncated, hint}, the fact that each item carries at most 3 events, and the paging rule that a full page yields total null and truncated true. That is exactly the kind of context annotations cannot express.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the purpose and the discriminating clause before the return-shape detail. It is dense and long-ish, but nearly every sentence carries information an agent needs (envelope shape, 3-event cap, pagination behavior); only the '(verified on 8.18.7)' asides are mild filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, so the description must carry the return contract — and it does, including item fields, the messages sub-array, empty-list behavior, and truncation semantics. Combined with 100% parameter coverage, an agent has everything needed to call and interpret this tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds interpretive meaning for limit that the schema alone doesn't: it explains how to read total/truncated relative to page size and implies the limit bounds how much history is reachable. The alert_id and target semantics are left entirely to the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: 'List recent trigger-history records for an alert.' It also explicitly scopes itself against the definition-oriented sibling with 'Use this for when an alert fired, not how it's defined,' so an agent can separate it from get_log_alert/list_log_alerts without opening schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives clear when-to-use guidance ('when an alert fired, not how it's defined') plus an edge-case rule: an alert that never fired returns an empty list, not an error. It stops short of naming the alternative tool explicitly (get_log_alert) or stating when-not to call it, so it is clear context without full routing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_log_insight_versionA
Read-onlyIdempotent

[READ] Return the Log Insight appliance version/build (diagnostics and query-syntax compatibility). Returns {version, release_name, build}. Use this first when a query behaves unexpectedly, to confirm the appliance version before trusting search_logs. Read-only.

ParametersJSON Schema
NameRequiredDescriptionDefault
targetNoLog Insight target name as spelled in ~/.vmware-log-insight/config.yaml. Omit to use that file's default_target — with no default configured, omitting it is an error that lists the configured names. This is also the cheapest way to prove a given target's credentials work at all.

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, openWorldHint and destructiveHint=false, so '[READ]'/'Read-only' adds little beyond structured data. However, the description does add genuine value: with no output schema present, it discloses the return shape {version, release_name, build} and the diagnostic intent, which goes beyond the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with purpose, then return shape, then usage — a sensible ordering with no filler sentences. The trailing 'Read-only.' and the '[READ]' prefix duplicate the annotations and each other, a small redundancy against an otherwise tight description.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-required-parameter, single-parameter read tool with no output schema, the description covers purpose, return fields, and when to reach for it. It is essentially complete; only minor details (e.g., whether the call requires working credentials in all cases) are left to the schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and the single 'target' parameter is thoroughly documented in the schema itself (config file location, default_target fallback, error behavior, credential check). The description adds nothing about the parameter, so the baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Return the Log Insight appliance version/build') plus the diagnostic purpose, and explicitly differentiates from siblings by naming search_logs as the query tool this one supports. The agent can tell immediately this is a version/metadata lookup, not a log search.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives a concrete trigger condition ('Use this first when a query behaves unexpectedly... to confirm the appliance version before trusting search_logs') and names the sibling it complements. It stops short of explicit when-not-to-use guidance (e.g., avoiding it for routine log retrieval), so it is clear context but not a full routing rule.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_log_alertsA
Read-onlyIdempotent

[READ] List defined Log Insight alerts.

Returns the family list envelope {items, returned, limit, total, truncated, hint}; each item is {id, name, enabled, info}. Start here, then pass an id to get_log_alert or get_log_alert_history. total is the real count matching name_filter, so truncated answers whether more exist; raise limit or narrow name_filter when true. Read-only — this skill never creates/edits/deletes alerts.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMaximum items in the page (default 50). It slices the matches after filtering; 'total' still reports every match, so a small limit never hides how many alerts exist.
targetNoLog Insight target name as spelled in ~/.vmware-log-insight/config.yaml. Omit to use that file's default_target — with no default configured, omitting it is an error that lists the configured names.
name_filterNoCase-insensitive substring matched against the alert's name only (not its id or description). Omit to list every defined alert. The appliance returns the whole collection either way and the filter runs locally, so filtering costs nothing extra.

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, non-destructive, but the description adds real context beyond them: the exact return envelope shape ({items, returned, limit, total, truncated, hint}), the per-item fields, and the meaning of total/truncated for pagination. The read-only restatement is redundant with annotations but harmless reinforcement.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads the purpose, then the return shape, then the routing advice, in four compact sentences. Slight redundancy between the description's envelope details and the schema's limit description, but nothing is wasted or buried.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description fully carries the burden by documenting the envelope, item shape, and truncation semantics, and the schema covers target defaults and filter behavior. An agent has everything needed to call and interpret this correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3; the description goes further by tying limit and name_filter together behaviorally — total reflects all matches after name_filter, small limits don't hide the count, and filtering happens locally on the full collection. That is useful action-level meaning beyond the parameter definitions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource — 'List defined Log Insight alerts' — and immediately distinguishes itself from siblings by naming get_log_alert and get_log_alert_history as the follow-on calls. An agent knows this is the enumeration entry point without opening any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives clear routing guidance ('Start here, then pass an id to get_log_alert or get_log_alert_history') and a concrete follow-up rule for the truncated case (raise limit or narrow name_filter). It does not explicitly say when not to use it (e.g., versus search_logs/aggregate_logs for log events rather than alert definitions), so it stops short of full when/when-not coverage.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_log_fieldsA
Read-onlyIdempotent

[READ] List the fields this appliance knows (static and extracted).

Use this to pick a 'field' for aggregate_logs, or to learn what a key in a search_logs event's 'fields' means. Returns the family list envelope {items, returned, limit, total, truncated, hint}; each item is {name, internal_name, type}; a content-pack field adds 'display_name' and 'content_pack', and its 'name' is qualified ("com.vmware.vsphere:"); 'unresolved': true (with a 'note') means its pack's namespace is unknown, so that name will match nothing. 'name' is what aggregate_logs takes; 'type' (STRING, NUMBER, ...) says which functions apply. No limit — every matching field is returned. An 8.18.7 appliance with the default content packs has ~340 fields (~15k tokens unfiltered), so pass name_filter. Read-only.

ParametersJSON Schema
NameRequiredDescriptionDefault
targetNoLog Insight target name as spelled in ~/.vmware-log-insight/config.yaml. Omit to use that file's default_target — with no default configured, omitting it is an error that lists the configured names.
name_filterNoCase-insensitive substring matched against 'name' — for a content-pack field the qualified name, so "vsphere" matches every vSphere-pack field. Omit to return every field this appliance extracts. Field extraction is deployment-specific, so a name absent here does not exist for this target no matter what it is called elsewhere.

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnly/idempotent annotations, it discloses the exact return envelope shape, item structure, the content-pack qualification rule, the 'unresolved' failure mode, and the cardinality cost (~340 fields, ~15k tokens) with the mitigation (pass name_filter). This is unusually rich behavioral context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Dense but front-loaded: the purpose sentence comes first, then usage, then return shape and caveats. Nearly every sentence earns its place, though the return-envelope detail is somewhat lengthy given no output schema exists.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description carries the return-format burden and does so fully (envelope fields, item fields, edge cases). For a 2-param read tool with rich annotations, nothing an agent needs to call it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so a 3 is the baseline; the description adds real value by explaining that name_filter matches the qualified content-pack name and that omission returns everything, plus the practical warning to use it. It adds meaning beyond the schema text.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Opens with a specific verb+resource ('[READ] List the fields this appliance knows') and immediately scopes it as static and extracted. It clearly distinguishes itself from siblings by naming what it feeds (aggregate_logs) and what it explains (search_logs 'fields').

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

States two concrete use cases: picking a 'field' value for aggregate_logs, and interpreting a key in a search_logs event's 'fields'. Names the sibling tools explicitly so the agent can route without opening schemas.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_logsA
Read-onlyIdempotent

[READ] Search Log Insight events within a time window.

WHEN: to find the actual log lines behind an incident (e.g. what vmkernel logged during a storage event). For "where did logs burst?" use aggregate_logs instead; for vCenter alarms use vmware-monitor.

RETURNS: {count, complete (False if truncated), constraints, events: [{timestamp_ms, text, fields}]}, plus 'note' when limit was lowered. 'fields' is a flat {name: value} dict — hostname, appname, procid, source, facility and the other static fields the appliance attached (content-pack fields are not included: the query does not ask for them). Feed events to vmware-debug build_incident_timeline to correlate across sources. Read-only.

ParametersJSON Schema
NameRequiredDescriptionDefault
lastNoRelative window ending now, as a quantity plus a unit suffix — s, m, h or d ("30m", "2h", "7d") — or a bare number of seconds. Anything else raises a ValueError naming the accepted forms. Cannot be combined with begin_ms/end_ms; passing both is refused. Omit all three and the query defaults to the last hour, so it is never unbounded. Windows longer than ~24.8 days are sent as an absolute start time, because the appliance's LAST operator overflows there.
textNoWord(s) matched against the event message with the CONTAINS operator. Log Insight matches whole words, not substrings: "localhost" finds "localhost.localdomain", "localdom" finds nothing, "localdom*" finds it again (`*` is a wildcard; verified on 8.18.7). When a text search matches nothing, 'note' says so — 0 events for a partial word is not evidence the logs do not exist. Not a regex and not a query expression. Omit to match every event in the window. This tool has no field-filter parameter; filter on a field's value by reading 'fields' in the result.
limitNoMaximum events returned, 1..200, default 50. A larger value is lowered to 200 and the result's 'note' says so. Each event is ~650 characters, so 50 is already ~8k tokens: narrow the window or the text rather than raising this.
end_msNoAbsolute window end as epoch milliseconds (not seconds). May be given without begin_ms, which then means "everything up to this instant". Cannot be combined with last.
targetNoLog Insight target name as spelled in ~/.vmware-log-insight/config.yaml. Omit to use that file's default_target — with no default configured, omitting it is an error that lists the configured names.
begin_msNoAbsolute window start as epoch milliseconds (not seconds — a value that looks like seconds is refused). May be given without end_ms, which then means "from this instant onwards". Must be before end_ms. Cannot be combined with last.

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint/idempotentHint/destructiveHint=false, and the description adds substantial context beyond them: truncation signalled by 'complete', a 'note' when limit was lowered, whole-word CONTAINS matching semantics with wildcard behavior, the absence of a field-filter parameter, and ValueError on malformed windows. This is exactly the extra behavioral detail the annotations cannot carry.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with a [READ] tag and WHEN/RETURNS headings; each sentence carries load. The RETURNS block is long but justified because no output schema exists to carry that information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description fully specifies the return shape (count, complete, constraints, events with timestamp_ms/text/fields), explains the fields dict contents and the content-pack exclusion, and warns about token cost. Nothing needed to call or interpret the result is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the rich per-parameter docs (window formats, mutual exclusion, epoch-vs-seconds) are already in the schema and the description earns no extra credit for them. The description adds only the meta-point that there is no field-filter parameter. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Search Log Insight events within a time window') and explicitly differentiates from siblings by naming aggregate_logs for burst questions and vmware-monitor for vCenter alarms. An agent can route correctly without opening any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The WHEN section gives a concrete use case ('find the actual log lines behind an incident') plus explicit when-not conditions pointing to two named alternatives. It also names a downstream consumer (vmware-debug build_incident_timeline), so the agent knows how this tool fits a workflow.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 14 tool updatesv2.4.1
    • Addedaggregate_logs
    • Removedalert_get
    • Removedalert_history
    • Removedalert_list
    • Addedget_log_alert
    • Addedget_log_alert_history
    • Addedget_log_insight_version
    • Addedlist_log_alerts
    • Addedlist_log_fields
    • Removedlog_aggregate
    • Removedlog_fields
    • Removedlog_search
    • Removedlog_version
    • Addedsearch_logs
  2. 7 tool updatesv1.8.14
    • Changedalert_get3 fields changed
      • addedInput schema / additionalProperties
        Added value: +false
      • addedInput schema / properties / alert_id / description
        Added value: +"The alert id exactly as returned in an alert_list row's 'id' field (not the alert's name). An empty string is refused with a message telling you to run alert_list; a well-formed but unknown id comes back as a 404 from the appliance."
      • addedInput schema / properties / target / description
        Added value: +"Log Insight target name as spelled in ~/.vmware-log-insight/config.yaml. Omit to use that file's default_target — with no default configured, omitting it is an error that lists the configured names."
    • Changedalert_history4 fields changed
      • addedInput schema / additionalProperties
        Added value: +false
      • addedInput schema / properties / alert_id / description
        Added value: +"The alert id exactly as returned in an alert_list row's 'id' field (not the alert's name). An empty string is refused with a message telling you to run alert_list first."
      • addedInput schema / properties / limit / description
        Added value: +"Maximum history records returned, most recent first as the appliance orders them (default 50). There is no offset — the appliance hands back the whole history in one call and this slices it, so when truncated is true the only way to reach older records is a larger limit."
      • addedInput schema / properties / target / description
        Added value: +"Log Insight target name as spelled in ~/.vmware-log-insight/config.yaml. Omit to use that file's default_target — with no default configured, omitting it is an error that lists the configured names."
    • Changedalert_list4 fields changed
      • addedInput schema / additionalProperties
        Added value: +false
      • addedInput schema / properties / limit / description
        Added value: +"Maximum items in the page (default 50). It slices the matches after filtering; 'total' still reports every match, so a small limit never hides how many alerts exist."
      • addedInput schema / properties / name_filter / description
        Added value: +"Case-insensitive substring matched against the alert's name only (not its id or description). Omit to list every defined alert. The appliance returns the whole collection either way and the filter runs locally, so filtering costs nothing extra."
      • addedInput schema / properties / target / description
        Added value: +"Log Insight target name as spelled in ~/.vmware-log-insight/config.yaml. Omit to use that file's default_target — with no default configured, omitting it is an error that lists the configured names."
    • Changedlog_aggregate8 fields changed
      • addedInput schema / additionalProperties
        Added value: +false
      • addedInput schema / properties / aggregation / description
        Added value: +"The function applied within each bin — exactly one of COUNT, UCOUNT, AVG, MIN, MAX, SUM, STDDEV, VARIANCE, SAMPLE (lower case is accepted and upper-cased). Anything else raises a ValueError listing the nine. Default COUNT, which answers \"how many events per bin\" and is what spike detection is normally run on."
      • addedInput schema / properties / begin_ms / description
        Added value: +"Absolute window start as epoch milliseconds. Usable on its own; cannot be combined with last."
      • addedInput schema / properties / bin_width_ms / description
        Added value: +"Width of each time bin in milliseconds, must be positive (default 60000 = one minute). It sets the resolution of both the series and the spike test: bins much wider than the burst average it away, bins much narrower make every quiet minute look like noise."
      • addedInput schema / properties / end_ms / description
        Added value: +"Absolute window end as epoch milliseconds. Usable on its own; cannot be combined with last."
      • addedInput schema / properties / last / description
        Added value: +"Relative window ending now — \"30m\", \"2h\", \"7d\" (units s/m/h/d) or a bare number of seconds. Cannot be combined with begin_ms/end_ms. Omit all three and the window defaults to the last hour."
      • addedInput schema / properties / target / description
        Added value: +"Log Insight target name as spelled in ~/.vmware-log-insight/config.yaml. Omit to use that file's default_target — with no default configured, omitting it is an error that lists the configured names."
      • addedInput schema / properties / text / description
        Added value: +"Free-text substring matched with CONTAINS, exactly as in log_search. Omit to aggregate every event in the window."
    • Changedlog_fields3 fields changed
      • addedInput schema / additionalProperties
        Added value: +false
      • addedInput schema / properties / name_filter / description
        Added value: +"Case-insensitive substring matched against the field name. Omit to return every field this appliance extracts. Field extraction is deployment-specific, so a name absent here does not exist for this target no matter what it is called elsewhere."
      • addedInput schema / properties / target / description
        Added value: +"Log Insight target name as spelled in ~/.vmware-log-insight/config.yaml. Omit to use that file's default_target — with no default configured, omitting it is an error that lists the configured names."
    • Changedlog_search7 fields changed
      • addedInput schema / additionalProperties
        Added value: +false
      • addedInput schema / properties / begin_ms / description
        Added value: +"Absolute window start as epoch milliseconds (not seconds). May be given without end_ms, which then means \"from this instant onwards\". Cannot be combined with last."
      • addedInput schema / properties / end_ms / description
        Added value: +"Absolute window end as epoch milliseconds (not seconds). May be given without begin_ms, which then means \"everything up to this instant\". Cannot be combined with last."
      • addedInput schema / properties / last / description
        Added value: +"Relative window ending now, as a quantity plus a unit suffix — s, m, h or d (\"30m\", \"2h\", \"7d\") — or a bare number of seconds. Anything else raises a ValueError naming the accepted forms. Cannot be combined with begin_ms/end_ms; passing both is refused. Omit all three and the query defaults to the last hour, so it is never unbounded."
      • addedInput schema / properties / limit / description
        Added value: +"Maximum events returned, 1..20000, default 50. Out-of-range values are silently clamped into that range rather than refused. Narrow the window or the text rather than raising this — raw events are the largest thing this skill can put in context."
      • addedInput schema / properties / target / description
        Added value: +"Log Insight target name as spelled in ~/.vmware-log-insight/config.yaml. Omit to use that file's default_target — with no default configured, omitting it is an error that lists the configured names."
      • addedInput schema / properties / text / description
        Added value: +"Free-text substring matched against the event message with the CONTAINS operator — not a regex and not a full query expression. Omit to match every event in the window. To filter on an extracted field instead, discover names with log_fields; this tool exposes no field-filter parameter."
    • Changedlog_version2 fields changed
      • addedInput schema / additionalProperties
        Added value: +false
      • addedInput schema / properties / target / description
        Added value: +"Log Insight target name as spelled in ~/.vmware-log-insight/config.yaml. Omit to use that file's default_target — with no default configured, omitting it is an error that lists the configured names. This is also the cheapest way to prove a given target's credentials work at all."
  3. 7 tool updatesv1.8.9
    • First observedalert_get
    • First observedalert_history
    • First observedalert_list
    • First observedlog_aggregate
    • First observedlog_fields
    • First observedlog_search
    • First observedlog_version

TDQS

A4.4/5.0

Scored across 7 tools

Disambiguation5/5

Each tool has a clearly distinct purpose: alert listing vs. alert definition vs. alert history vs. raw log search vs. aggregation vs. field catalog vs. version. The descriptions explicitly cross-reference each other to steer selection, so overlap is minimal.

Naming Consistency5/5

All seven names use snake_case with consistent verb_noun phrasing (list_/get_/search_/aggregate_), and the alert tools share the log_alert prefix predictably.

Tool Count5/5

Seven tools is well-scoped for a read-only Log Insight query/inspection server; each tool covers a distinct need and none feel redundant.

Completeness4/5

The read-only surface covers the core workflow (alerts, history, search, aggregate, fields, version), but get_log_alert returns only raw key names rather than full definition values, and there is no way to inspect alert definitions beyond a sanitized projection. Minor gaps remain for deep alert-definition analysis, though the main query paths are covered.

Maintenance

ActivityActive
ResponsivenessWithin a week

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    D
    maintenance
    MCP server for querying and analyzing logs from VMware Aria Operations for Logs, enabling log search, incident detection, and vROps correlation.
    6
    4
    MIT
  • A
    license
    Not graded
    quality
    F
    maintenance
    A read-only MCP server that exposes Quickwit log search and aggregations to LLM clients, enabling natural language log investigation.
    Apache 2.0
  • A
    license
    A
    quality
    D
    maintenance
    Read-only MCP server for exploring and searching OpenSearch clusters, enabling log analysis, index exploration, and query execution.
    8
    MIT
  • A
    license
    A
    quality
    C
    maintenance
    A read-only MCP server that enables AI assistants to search, aggregate, and explore OpenSearch log data through 12 tools for connectivity, index discovery, search, and aggregations.
    17
    MIT