[READ] List virtual machines with optional filtering, sorting, and field selection.

Returns a dict: {total, mode, vms, hint}. Each VM entry includes a folder_path field showing the vCenter inventory folder path (e.g. /Colocation/Colo - ISER).

Auto-compact: when no limit/fields are set and inventory exceeds 50 VMs, returns compact fields (name, power_state, cpu, memory_mb, folder_path) to keep context manageable. Set limit or fields to override.

Args: target: Optional vCenter/ESXi target name from config. Uses default if omitted. limit: Max number of VMs to return (None = all). sort_by: Sort field: "name" | "cpu" | "memory_mb" | "power_state" | "folder_path". power_state: Filter by power state: "poweredOn" | "poweredOff" | "suspended". fields: Return only these fields (None = auto-select based on inventory size). Available: name, power_state, cpu, memory_mb, guest_os, ip_address, host, uuid, tools_status, folder_path. folder_filter: Case-insensitive substring match against folder_path. Example: folder_filter="Colocation" returns VMs anywhere under a Colocation folder, including nested subfolders.

[READ] List ESXi hosts with CPU cores, memory, version, VM count, and uptime.

Args: target: Optional vCenter/ESXi target name from config. Uses default if omitted. limit: Max number of hosts to return (None = all).

[READ] List datastores with capacity, free space, type, and VM count.

Args: target: Optional vCenter/ESXi target name from config. Uses default if omitted. limit: Max number of datastores to return (None = all).

[READ] List clusters with host count, DRS/HA status, and resource totals.

Args: target: Optional vCenter/ESXi target name from config. Uses default if omitted. limit: Max number of clusters to return (None = all).

[READ] One-glance health rollup for every cluster — "is anything on fire?".

Aggregates hosts, VM power state, live CPU/memory pressure, and triggered alarms per cluster in three batched server-side passes (not one call per object), assigns each cluster an opinionated status ("ok"/"warn"/"critical"), AND flattens the individual anomalies into a ranked top_issues focus list — the headline for large environments where scanning every cluster row is too slow. Use this FIRST for a cross-cluster triage view instead of stitching list_all_clusters + list_esxi_hosts + get_alarms yourself; then drill into those tools for detail on whatever top_issues points at.

Returns {totals, top_issues, issues_total, clusters, snapshot, customization_hint}. Lead with top_issues (the top N things wrong right now, worst first), show the clusters table as context, and always echo customization_hint as the closing line. issues_total reveals how many anomalies existed before the top_n cap. Point-in-time snapshot — no trending.

Args: target: Optional vCenter/ESXi target name from config. Uses default if omitted. cluster_filter: Case-insensitive substring to show only matching clusters (None = all clusters plus a standalone-hosts row). include_vms: Roll up VM total/powered-on counts (default True). Set False to skip the VM inventory pass on very large fleets when you only need host/alarm/capacity signals. top_n: Cap the top_issues focus list at this many entries (default 10). Use 5 for an even tighter view, or 0 to omit the list.

[READ] "What is happening around this VM?" — one correlated drill-down.

Collects and correlates everything around a single VM so you don't stitch get_vm_info + list_snapshots + get_alarms + get_vm_performance + get_recent_events yourself (which a smaller model often mis-orders): the VM's state, the host it runs on, its cluster context, the datastores backing it, its snapshots and triggered alarms, live performance, and a merged event timeline correlating recent events from the VM, host, cluster and datastores (newest first). All cross-object reads are batched — cheap even on large fleets. Aggregation happens in the tool; explain the result in operational language, do not dump it raw.

Use this AFTER cluster_health_summary points at a problem VM, or whenever the operator asks "what's going on with ?". Point-in-time snapshot — no trending.

Args: vm_name: Exact VM name. Unknown names return a teaching error naming how to list VMs. Get the name from list_vms or cluster_health_summary first. target: Optional vCenter/ESXi target name from config (default target if omitted). hours: Event-timeline look-back window in hours (default 24).

[READ] "What is happening around this ESXi host?" — one correlated drill-down.

Collects and correlates everything around a single host: its state (connection, CPU/memory pressure, ESXi version, uptime), its cluster context, a rollup of the VMs it runs (total / powered-on + a sample), the datastores it mounts, triggered alarms across host/cluster/datastore, live performance, and a merged event timeline correlating recent events from the host, cluster and datastores. All reads are batched. Aggregation happens in the tool; explain it in operational language, do not dump it raw.

Use this AFTER cluster_health_summary flags a host, or when the operator asks "what's going on with host ?". Point-in-time snapshot — no trending.

Args: host_name: Exact ESXi host name. Unknown names return a teaching error. Get the name from list_esxi_hosts or cluster_health_summary first. target: Optional vCenter/ESXi target name from config (default if omitted). hours: Event-timeline look-back window in hours (default 24).

[READ] "What is happening around this datastore?" — one correlated drill-down.

Collects and correlates everything around a single datastore: its capacity / free space / accessibility, the hosts that mount it, a rollup of the VMs it backs (total / powered-on + a sample), triggered alarms across datastore/host, and a merged event timeline correlating recent events from the datastore and its hosts. All reads are batched. Aggregation happens in the tool; explain it in operational language, do not dump it raw. (Per-datastore latency is a separate perf report, not included here.)

Use this AFTER cluster_health_summary flags storage pressure, or when the operator asks "what's going on with datastore ?". Point-in-time snapshot — no trending.

Args: datastore_name: Exact datastore name. Unknown names return a teaching error. Get the name from list_all_datastores or datastore_capacity first. target: Optional vCenter/ESXi target name from config (default if omitted). hours: Event-timeline look-back window in hours (default 24).

[READ] "What needs attention now?" across EVERY configured vCenter — one list.

Rolls every configured target's cluster-health summary into a single, globally ranked top_issues list (worst first, each tagged with its vcenter) plus a per-target rollup — the "where do I look first, anywhere in the estate?" view. Use this instead of calling cluster_health_summary once per target and merging yourself. Aggregation happens in the tool; lead with top_issues and explain in operational language.

Degrades gracefully: a target that cannot be reached (or errors mid-summary) is listed under unreachable with a reason, and the rest still aggregate — so a single dead vCenter never sinks the view. Point-in-time snapshot — no trending.

Args: cluster_filter: Case-insensitive cluster substring applied to every target (None = all clusters). top_n: Cap the merged top_issues focus list (default 10). issues_total reports the pre-cap count.

[READ] List networks with name, attached VM count, and accessibility.

Args: target: Optional vCenter/ESXi target name from config. Uses default if omitted. limit: Max number of networks to return (None = all).

[READ] Get active/triggered alarms across the VMware inventory.

Each alarm includes suggested_actions with ready-to-use hints pointing to the correct companion skill and tool for remediation.

Args: target: Optional vCenter/ESXi target name from config. Uses default if omitted. limit: Max number of alarms to return (None = all). Use when many alarms are active.

[READ] Get recent vCenter/ESXi events filtered by severity.

Args: hours: How many hours back to query (default 24). severity: Minimum severity level: "critical", "warning", or "info". target: Optional vCenter/ESXi target name from config. Uses default if omitted.

[READ] Get hardware sensor status (temperature, voltage, fan, ...) for all hosts.

Each entry includes host, sensor_name, type, reading, unit, and status (green/yellow/red from healthState.key). Use to spot failing hardware before it causes an outage. Returns an empty list when no host exposes sensor data (e.g. nested ESXi).

Args: target: Optional vCenter/ESXi target name from config. Uses default if omitted. limit: Max number of sensor rows to return (None = all).

[READ] Get host service status (running state and startup policy).

Each entry includes host, service key, label, running (bool), and policy (on/off/automatic). Use to check whether SSH, NTP, or the firewall service is in the expected state.

Args: host_name: Filter to a single host by exact name (None = all hosts). target: Optional vCenter/ESXi target name from config. Uses default if omitted.

[READ] Scan recent ESXi host syslog lines for error/warning patterns.

Reads the last lines entries of the hostd/vmkernel/vpxa logs on each host via the diagnostic system and returns only the lines matching known trouble patterns (error, fail, critical, panic, lost access, timeout, …). Each entry has severity, source (host_log:<key>), message, time, and entity (host name). Returns an empty list when no matching lines are found.

Only errors/warnings are returned, not the full log, so output stays small even on large clusters. Filter to one host with host_name to keep the scan fast on environments with many hosts.

Args: host_name: Filter to a single host by exact name (None = all hosts). lines: How many recent lines per log to scan (default 500). target: Optional vCenter/ESXi target name from config. Uses default if omitted.

[READ] Get detailed information about a specific VM (CPU, memory, disks, NICs, snapshots).

Args: vm_name: Exact name of the virtual machine. target: Optional vCenter/ESXi target name from config. Uses default if omitted.

[READ] List all snapshots of a VM, including the nesting hierarchy.

Returns one entry per snapshot with name, description, created timestamp, state, and level (0 = root; children are level+1). Returns an empty list when the VM has no snapshots. Read-only — this skill cannot create, revert, or delete snapshots (use vmware-aiops for those operations). Exposes the same data as the CLI command vmware-monitor vm snapshot-list (was missing from MCP until 2026-06-08 — CLI/MCP parity, 踩坑 #34).

Args: vm_name: Exact name of the virtual machine. target: Optional vCenter/ESXi target name from config. Uses default if omitted.

[READ] Real-time CPU/memory/disk/network utilisation per ESXi host.

Unlike list_esxi_hosts (static config: cores, total GB), this returns LIVE utilisation from the 20-second PerfManager interval: cpu_usage_pct, mem_usage_pct, mem_consumed_mb, disk_kbps, net_kbps. Busiest hosts first. Disconnected hosts and hosts without a real-time provider are skipped (not reported as zero). Point-in-time only — no historical trend is retained.

Args: host_name: Filter to a single host by exact name (None = all hosts). target: Optional vCenter/ESXi target name from config. Uses default if omitted. limit: Max number of host rows to return (None = all).

[READ] Real-time CPU/memory/disk/network utilisation per virtual machine.

LIVE utilisation (cpu_usage_pct, mem_usage_pct, mem_consumed_mb, disk_read_kbps, disk_write_kbps, net_kbps), busiest VMs first. Only powered-on VMs have a real-time provider; powered-off VMs are skipped. Defaults to the top 25 — pass limit=None for the full fleet. Point-in-time only; for trends use a metrics store.

Args: vm_name: Filter to a single VM by exact name (None = all powered-on VMs). target: Optional vCenter/ESXi target name from config. Uses default if omitted. limit: Max number of VM rows to return (default 25; None = all).

[READ] Sweep ALL VMs for snapshots and flag old / sprawling ones.

Where vm_list_snapshots covers one VM, this scans the whole inventory and judges age. Returns {total_snapshots, old_snapshots, vms_with_snapshots, threshold_days, snapshots[], hint}. Each row has age_days, is_old, and an est_size_mb lower-bound (snapshotData+snapshotMemory; delta-disk growth is not separable per-snapshot via the API). Read-only — delete snapshots via vmware-aiops.

Args: age_threshold_days: Age above which a snapshot is flagged "old" (default 30). only_old: When True, return only snapshots older than the threshold. target: Optional vCenter/ESXi target name from config. Uses default if omitted. limit: Max number of snapshot rows to return (None = all).

[READ] Per-host ESXi management certificate expiry.

An expired ESXi cert drops host management — this surfaces it before the outage. Returns host, not_after, days_until_expiry, and an expiring flag (within warn_days or already expired), soonest-to-expire first. Uses the API-native certificateInfo (no PEM parsing).

Args: warn_days: Flag certs expiring within this many days (default 30). target: Optional vCenter/ESXi target name from config. Uses default if omitted. limit: Max number of host rows to return (None = all).

[READ] vCenter/ESXi license inventory with usage and expiry.

Returns one row per license: name, edition_key, total/used units, unlimited flag (total==0), and expiration. Use to catch over-allocation or an approaching license expiry.

Args: target: Optional vCenter/ESXi target name from config. Uses default if omitted.

[READ] Per-host NTP configuration health (servers + ntpd service state).

Returns host, ntp_servers, ntpd_running, ntpd_policy, and a healthy flag (servers configured AND ntpd running). NOTE: the SOAP API does not expose the live clock offset/stratum — this reports configuration health only (the actionable signal). For actual offset use esxcli on the host.

Args: host_name: Filter to a single host by exact name (None = all hosts). target: Optional vCenter/ESXi target name from config. Uses default if omitted.

[READ] Per-datastore capacity with thin-provisioning over-commit.

Adds the risk signal list_all_datastores lacks: overcommit_pct (provisioned / capacity * 100). Over 100% means more space is promised to VMs than physically exists — a thin datastore can fill up while still showing free space. Returns capacity_gb, free_gb, committed_gb, provisioned_gb, used_pct, overcommit_pct; riskiest first. Point-in-time.

Args: target: Optional vCenter/ESXi target name from config. Uses default if omitted. limit: Max number of datastore rows to return (None = all).

[READ] Per-resource-pool CPU/memory reservation, limit, and current usage.

Returns name, cpu_reservation_mhz, cpu_limit_mhz, cpu_usage_mhz, mem_reservation_mb, mem_limit_mb, mem_usage_mb. A limit of -1 means unlimited. Use to spot pools near their reservation/limit. Sorted by memory usage descending.

Args: target: Optional vCenter/ESXi target name from config. Uses default if omitted. limit: Max number of pool rows to return (None = all).

[READ] In-flight (and optionally just-completed) vCenter tasks.

Answers "why is the cluster busy?". Returns name, entity, state, progress_pct, start_time, user, active flag, and error (for failed recent tasks). Running/queued first. Read-only — cancel tasks via vmware-aiops.

Args: include_recent: Also include recently completed/failed tasks (default True). target: Optional vCenter/ESXi target name from config. Uses default if omitted. limit: Max number of task rows to return (None = all).

[READ] Currently authenticated vCenter/ESXi sessions (who is logged in).

Returns user_name, full_name, login_time, last_active, ip_address, and a current flag for this skill's own session. Requires Sessions privilege; low-privilege accounts get a single explanatory row instead of a traceback. Read-only — terminating sessions is not supported here.

Args: target: Optional vCenter/ESXi target name from config. Uses default if omitted. limit: Max number of session rows to return (None = all).