[READ] List DFW security policies in the default domain.

Start here. Returns the list envelope: 'items' holds each policy's id, display_name, category, sequence_number, stateful flag and rule count; 'returned'/'limit'/'total'/'truncated'/'hint' say whether the page is the whole answer — never read a full page as complete, narrow with name_filter or page with offset. Then get_dfw_policy for one policy's detail, or list_dfw_rules for the rules inside.

Args: target: NSX Manager target name from config; default if omitted. name_filter: Substring/glob match on policy display_name. limit: Max policies to return (default 50). offset: Matched policies to skip (pagination).

[READ] Get full details of a single DFW security policy.

Returns one policy object, not an envelope: category, sequence_number, stateful, scope and rule count. Use it once list_dfw_policies has narrowed to one id — never a display name. Then call list_dfw_rules for the rules inside.

Args: policy_id: Policy identifier (e.g. 'app-tier-policy'). target: Optional NSX Manager target from config.

[WRITE] Create a new DFW security policy.

Returns the created policy dict (id, path, category, ...), else {"error", "hint"}. The policy is an empty container — rules must be added afterwards with create_dfw_rule.

Args: policy_id: Unique policy id (alphanumerics, hyphens, underscores). display_name: Human-readable name. category: Ethernet, Emergency, Infrastructure, Environment or Application (default Application); sets DFW evaluation order, Ethernet first, Application last. sequence_number: Priority; lower = higher priority (default 10). stateful: Track connection state (default True). description: Optional description. target: Optional NSX Manager target from config.

[WRITE] Partially update a DFW security policy (PATCH — only provided fields change).

Returns the updated policy dict; omitted arguments keep their values, so read them with get_dfw_policy first. Use it to rename or re-prioritise the policy itself — to change a rule inside use update_dfw_rule.

Args: policy_id: ID of the policy to update. display_name: New display name. description: New description. sequence_number: New sequence number. stateful: New stateful flag. target: Optional NSX Manager target from config.

[WRITE] Delete a DFW security policy.

Returns {"status": "deleted", "message": ...}, else {"error", "hint"}. Refuses if the policy still holds active rules: list them with list_dfw_rules and clear each with delete_dfw_rule first.

Args: policy_id: ID of the policy to delete. target: Optional NSX Manager target from config.

[READ] List rules in a DFW security policy.

Returns the list envelope: 'items' holds each rule's id, display_name, action, sources, destinations, services, direction, disabled flag and sequence number; 'returned'/'limit'/'truncated'/'hint' say whether the page is complete. 'total' is always null here — a full page reports truncated=true and must be paged with offset; one Application policy can hold thousands of rules. Get policy_id from list_dfw_policies; then get_dfw_rule_stats for a rule's hit counts.

Args: policy_id: Parent policy identifier. target: Optional NSX Manager target from config. limit: Max rules to return (default 50). offset: Number of rules to skip (pagination).

[READ] Get packet/byte hit-count statistics for a DFW rule.

Returns one flat stats object, not an envelope: packet_count, byte_count, session_count, hit_count, popularity_index. Use it before update_dfw_rule or delete_dfw_rule to see if a rule still matches traffic; counters are cumulative and may read zero on a new rule. Ids come from list_dfw_rules.

Args: policy_id: Parent policy identifier. rule_id: Rule identifier. target: Optional NSX Manager target from config.

[WRITE] Create a firewall rule under an existing DFW security policy.

Returns the created rule dict (id, path, action, ...), else {"error", "hint"}; a bad action/direction/ip_protocol lists the valid values. PUT semantics: reusing a rule_id overwrites that rule, enforced immediately unless disabled=True. Pick policy_id with list_dfw_policies first; prefer update_dfw_rule to edit one and delete_dfw_rule to remove one.

Args: policy_id: Parent policy id, from list_dfw_policies. rule_id: Unique rule id within that policy. display_name: Human-readable name. action: ALLOW, DROP, REJECT or JUMP_TO_APPLICATION (default ALLOW); JUMP_TO_APPLICATION needs an Environment policy. sources: Source group paths like ['/infra/domains/default/groups/web']; omit for any. destinations: Destination group paths; omit for any. services: Service paths; omit for all. scope: Applied-to group/segment paths; omit for the whole DFW. direction: IN, OUT or IN_OUT (default IN_OUT). ip_protocol: IPV4, IPV6 or IPV4_IPV6 (default IPV4_IPV6). logged: Log matched traffic (default False). disabled: Create the rule unenforced (default False). sequence_number: Priority; lower matches first (default 10). description: Optional free text. target: Target name from config; default if omitted.

[WRITE] Partially update a DFW rule (PATCH — only provided fields change).

Returns the updated rule dict; omitted arguments keep their values, so read them with list_dfw_rules first. Use it to retarget, re-prioritise or disable a rule — to add one use create_dfw_rule, to remove one delete_dfw_rule.

Args: policy_id: Parent policy identifier. rule_id: Rule identifier to update. display_name: New name. action: New firewall action. sources: New source groups. destinations: New destination groups. services: New services. logged: New logged flag. disabled: New disabled flag. sequence_number: New sequence number. description: New description. target: Optional NSX Manager target from config.

[WRITE] Permanently delete one DFW rule from its parent security policy.

Returns {"status": "deleted", "message": ...}, else {"error", "hint"}. Irreversible and immediate: traffic it matched falls through to lower-priority rules or the policy default. Confirm rule_id with list_dfw_rules and check recent hits with get_dfw_rule_stats first; prefer update_dfw_rule with disabled=True when you may need the rule back. To remove a whole policy use delete_dfw_policy — it refuses while rules remain, whereas this tool has no such guard.

Args: policy_id: Parent policy id, from list_dfw_policies. rule_id: Rule id within that policy, from list_dfw_rules. target: Target name from config; default if omitted.

[READ] List NSX security groups in the default domain.

Returns the list envelope: 'items' holds each group's id, display_name, description and expression count; 'returned'/'limit'/'total'/ 'truncated'/'hint' say whether the page is the whole answer — never read a full page as complete, narrow with name_filter or page with offset. Then get_group for one group's criteria and effective members.

Args: target: Optional NSX Manager target from config. name_filter: Substring/glob match on group display_name. limit: Max groups to return (default 50). offset: Matched groups to skip (pagination).

[READ] Get details of a security group including membership criteria and effective members.

Returns one group object: its expression rules, member_count (the group's real size), and members — an envelope holding at most the first 50 effective VirtualMachine members, whose truncated flag says whether more were withheld. Report member_count as the size; counting members.items reports the sample instead. Use it once list_groups has narrowed to one id; membership is evaluated by NSX, so a tag written with apply_vm_tag may take seconds to appear.

Args: group_id: Group identifier (e.g. 'web-tier-vms'). target: Optional NSX Manager target from config.

[WRITE] Create an NSX security group with optional membership criteria.

Returns the created group dict (id, path, expression, ...). Criteria are ORed — NSX only permits AND between same-member-type Conditions: tag_scope/tag_value matches VMs carrying that tag, ip_addresses matches IPs or CIDRs, segment_paths every VM on those segments. Use it before create_dfw_rule, which references the group path; confirm members with get_group.

Args: group_id: Unique id (alphanumerics, hyphens, underscores). display_name: Human-readable name. description: Optional description. tag_scope: NSX tag scope for membership (e.g. 'env'). tag_value: NSX tag value for membership (e.g. 'production'). ip_addresses: IP addresses or CIDRs (e.g. ['10.0.1.0/24']). segment_paths: NSX segment policy paths. target: Optional NSX Manager target from config.

[WRITE] Delete an NSX security group.

Returns {"status": "deleted", "message": ...}, else {"error", "hint"}. Use it once get_group shows the group is unwanted. Refuses if anything still references it (NSX's group-associations API covers DFW rules and policies, gateway firewall, nested groups, service insertion), and refuses if that check itself fails (fail-safe). When the refusal names a DFW rule, retarget it with update_dfw_rule or drop it with delete_dfw_rule first.

Args: group_id: ID of the group to delete. target: Optional NSX Manager target from config.

[READ] List IDPS profiles configured in NSX.

Returns the list envelope: 'items' holds each profile's id, display_name, profile_severity (comma-joined), criteria (filter_name/filter_value pairs, e.g. ATTACK_TYPE or CVSS) and overridden signature count; 'returned'/'limit'/'total'/'truncated'/ 'hint' say whether the page is the whole answer — never read a full page as complete, narrow with name_filter or page with offset. Then get_idps_status for the signature-bundle version and IDS settings.

Args: target: Optional NSX Manager target from config. name_filter: Substring/glob match on profile display_name. limit: Max profiles to return (default 50). offset: Matched profiles to skip (pagination).

[READ] Get IDPS signature status and global IDS settings.

Returns one bundle, not an envelope: 'signature_status' (scalar fields of the signature bundle status, e.g. version/update state — names vary by NSX release) and 'settings' (auto_update, ids_events_to_syslog). Use it first to confirm IDS is on and current, then list_idps_profiles for the profiles. No per-signature or per-event detail, and 'signature_status' may be empty where IDS was never enabled.

Args: target: Optional NSX Manager target from config.

[READ] List all NSX tags applied to a virtual machine.

Returns the list envelope: 'items' holds the VM's scope/tag pairs and 'vm_id' the fabric UUID apply_vm_tag and remove_vm_tag require — call this first to get it. Tags always arrive in one response, so 'truncated' is always false and empty 'items' means the VM really has no tags. 'tags' is a deprecated pre-1.8.0 alias of 'items', removed in 2.0 — read 'items'. Returns {"error", "hint"} if no VM matches, or several do.

Args: vm_display_name: Exact vCenter display name (case-sensitive, no wildcards). This skill does not enumerate VMs — run vmware-monitor's list_virtual_machines to get one. target: Optional NSX Manager target from config.

[WRITE] Apply an NSX tag to a virtual machine.

Returns {"status": "applied", "vm_id", "scope", "tag"} — not the VM's tag list. Use list_vm_tags first for the vm_id, and again after to see the result. Additive, so existing tags survive, but note that tag-based group membership shifts as NSX re-evaluates: check with get_group.

Args: vm_id: VM external ID (fabric UUID, from list_vm_tags). tag_scope: Tag scope (e.g. 'env', 'tier', 'owner'). tag_value: Tag value (e.g. 'production', 'web'). target: Optional NSX Manager target from config.

[WRITE] Remove an NSX tag from a virtual machine.

Returns {"status": "removed", "vm_id", "scope", "tag"}, not the VM's remaining tags. Only the exact scope/value pair is removed — other tags survive. Removing a tag changes dynamic group membership immediately — groups with tag Conditions stop matching the VM — so re-check with get_group. Use list_vm_tags first to confirm the pair.

Args: vm_id: VM external ID (fabric UUID, from list_vm_tags). tag_scope: Scope of the tag to remove (e.g. 'env'). tag_value: Value of the tag to remove (e.g. 'production'). target: Optional NSX Manager target from config.

[WRITE] Run a Traceflow to trace a packet's path through the NSX overlay.

Injects a synthetic probe from the source port. Returns traceflow_id, operation_state (IN_PROGRESS / FINISHED / FAILED) and hop-by-hop observations typed by resource_type; Dropped* ones carry reason and acl_rule_id. Use it to find which DFW rule drops a flow, then get_dfw_rule_stats on that rule. A FINISHED traceflow is deleted server-side and its id 404s; only one still IN_PROGRESS at timeout_seconds survives for get_traceflow_result to poll.

Args: src_lport_id: Source logical port ID — the VM NIC attachment UUID. This skill does not enumerate ports; run vmware-nsx's get_segment_port_for_vm to obtain one. src_ip: Probe source IP. dst_ip: Destination IP. protocol: TCP, UDP or ICMP (default TCP). dst_port: Destination port for TCP/UDP (default 80). src_port: Source port for TCP/UDP (default 1234). ttl: IP TTL (default 64). timeout_seconds: Max seconds to wait (default 20). target: Optional NSX Manager target from config.

[READ] Get the current state and observations of an existing Traceflow.

Use this to check a previously initiated traceflow without waiting. Returns operation_state (IN_PROGRESS / FINISHED / FAILED) and observations typed by resource_type; Dropped* ones carry reason and acl_rule_id. Only a traceflow run_traceflow left IN_PROGRESS at its timeout is still on the manager — a completed one is deleted server-side and its id 404s here.

Args: traceflow_id: Traceflow ID from a previous run_traceflow call. target: Optional NSX Manager target from config.