Skip to main content
Glama
vmware-skills

vmware-nsx-security

by vmware-skills
OverviewSchemaSourceRelated ServersScoreDiscussionsAdmin
Python
Remote

delete_dfw_rule

Destructive

Permanently delete a Distributed Firewall (DFW) rule from its parent security policy, immediately altering traffic matching. Use when the rule is obsolete; verify rule ID first.

Instructions

[WRITE] Permanently delete one DFW rule from its parent security policy.

Returns {"status": "deleted", "message": ...}, else {"error", "hint"}. Irreversible and immediate: traffic it matched falls through to lower-priority rules or the policy default. Confirm rule_id with list_dfw_rules and check recent hits with get_dfw_rule_stats first; prefer update_dfw_rule with disabled=True when you may need the rule back. To remove a whole policy use delete_dfw_policy — it refuses while rules remain, whereas this tool has no such guard.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
targetNoTarget name from config; default if omitted.
rule_idYesRule id within that policy, from list_dfw_rules.
policy_idYesParent policy id, from list_dfw_policies.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed4 schema fields changedv1.10.0
    • addedInput schema / additionalProperties
      Added value: +false
    • addedInput schema / properties / policy_id / description
      Added value: +"Parent policy id, from list_dfw_policies."
    • addedInput schema / properties / rule_id / description
      Added value: +"Rule id within that policy, from list_dfw_rules."
    • addedInput schema / properties / target / description
      Added value: +"Target name from config; default if omitted."
  2. Addedv1.5.29
  3. Removedv1.5.28
  4. First observedv1.3.2

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark destructiveHint=true, but the description adds critical behavioral context: the delete is irreversible and immediate, traffic falls through to lower-priority rules or the policy default, and there is no guard against deleting rules while a policy still contains them. It also discloses the success and error return shapes, which is valuable since there is no output schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is information-dense yet well organized: action and result first, then irreversibility and consequences, then prerequisite checks and safer alternatives, then sibling differentiation. Every sentence earns its place and no content is wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a destructive, non-idempotent mutation tool with no output schema, this description covers the essential context: return values, irreversibility, impact on traffic, prerequisite verification, safer alternative, and the distinction from the policy-level delete. An agent has enough guidance to call this tool correctly and avoid common mistakes.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Input schema coverage is 100%, so the schema already documents all parameters including origins from list_dfw_rules and list_dfw_policies. The description reinforces rule_id confirmation and policy membership but does not add substantial meaning beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description opens with a specific verb and resource: 'Permanently delete one DFW rule from its parent security policy.' It clearly distinguishes from delete_dfw_policy and update_dfw_rule by name and behavior, so an agent can tell exactly which operation this is.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to use this tool: confirm the rule with list_dfw_rules, check recent hits with get_dfw_rule_stats, and prefer update_dfw_rule with disabled=True when the rule may be needed again. It also contrasts delete_dfw_policy, which refuses while rules remain, versus this tool, which has no such guard.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Install Server

Other Tools