list_drift_events
Retrieve change events from the latest snapshot to identify drift from compliance baselines in VMware vSphere.
Instructions
[READ] Latest snapshot's change events.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |
Implementation Reference
- vmware_harden/mcp/tools.py:106-135 (handler)The actual tool implementation: queries the latest snapshot's change events from the Twin store and returns a list of drift events (node_id, field, old_value, new_value, detected_at).
@vmware_tool(risk_level="low") def list_drift_events(limit: int = 50) -> list[dict]: """[READ] Latest snapshot's change events.""" from vmware_harden.store.twin import Twin twin = Twin(_resolve_db()) try: latest = twin.conn.execute( "SELECT id FROM snapshots ORDER BY scan_started_at DESC LIMIT 1" ).fetchone() if not latest: return [] rows = twin.conn.execute( "SELECT node_id, field, old_value, new_value, detected_at " "FROM change_event WHERE snapshot_id = ? " "ORDER BY node_id, field LIMIT ?", [latest[0], limit], ).fetchall() return [ { "node_id": r[0], "field": r[1], "old_value": r[2], "new_value": r[3], "detected_at": str(r[4]) if r[4] else None, } for r in rows ] finally: twin.close() - mcp_server/server.py:34-37 (registration)Registers the tool as 'list_drift_events' on the FastMCP server, wiring it to the implementation via server.tool() decorator.
@server.tool(name="list_drift_events") def _list_drift_events_impl(limit: int = 50) -> list[dict]: """[READ] Latest snapshot's change events.""" return t.list_drift_events(limit) - vmware_harden/mcp/tools.py:17-19 (helper)Helper function _resolve_db() used by the handler to locate the DuckDB database path.
def _resolve_db() -> Path: """Return the configured DB path, defaulting to user dir.""" return _DB_PATH or Path(os.path.expanduser("~/.vmware-harden/twin.duckdb"))