VMware AIops — AI-Powered vCenter/ESXi Operations Skill
Gives AI agents full VM lifecycle control over VMware vSphere/ESXi: power, clone, migrate, deploy, snapshot, cluster and alarm management across 60 MCP tools.
Disclosure is unusually candid: docs state plainly that 43 MCP write tools act on first call with no confirmation or dry-run, that vm_guest_exec is the widest blast radius with root in its own example, that alarm reset has entity-type-wide side effects, that password obfuscation is not encryption, and they recommend read-only vCenter roles, audit logging, and fail-closed guards. Deductions: the MCP path itself has no application-layer confirmation gate, guest commands are unbounded, force_unprotected=True is an override channel, and actual safety depends heavily on correct user-side service-account configuration — risks visible but confirmation/isolation incomplete, so not full marks.
SKILL.md and references are highly self-consistent on CLI/MCP parameters, idempotency, task polling, and failure semantics (teaching errors, truncation envelopes, task_error), with solid troubleshooting. But this is a static review: evals. contains only 4 declarative cases with no committed run results and no evidence of behavior under malformed input; the static cap of 10 applies.
Triggers, non-fit boundaries (routing to vmware-monitor/NSX/storage/vks), CLI vs MCP scenario guidance, and small-model guardrails are all clear; the Chinese README provides a Tsinghua mirror and air-gapped install, showing mainland-China reachability was considered. Deductions: the description's trigger surface is broad ('any VM operations'), and precision of triggering/boundaries partly depends on runtime behavior, so below 15.
Well-layered docs (SKILL.md plus capabilities/cli-reference/setup-guide/guardrails/investigation-protocol), MIT license, non-affiliation disclaimer, version compatibility matrix, and install-source verification advice. Deductions: the SKILL.md ends mid-section ('Plan apply'), no explicit CHANGELOG or version-governance file is shown, and maintenance responsibility rests on individual community members — governance is incomplete.
Workflows (lab deploy, batch clone, migration) include pre-flight checklists, capacity math, TTL conventions, and well-specified outputs (audit db, HTML snapshots, task polling), with clear marginal value over raw pyVmomi scripting. However, static review cannot confirm representative outputs are directly usable, and evals show no execution results; scored 6 within the static cap of 7.
Claims are traceable: issue #31 is cited as a real operator configuration, a gate-inventory comment points to a regression test (test_documented_gates_match_the_registry.py), and a third-party contributor is credited. But the test code and CI do not appear in the provided files, so most capability claims remain author assertions without cross-corroboration; scored 4 within the static cap.
- Over MCP, 43 write tools (including vm_delete, cluster_delete, vm_guest_exec) act on the first call with no confirmation or dry-run; in production use a least-privilege vCenter service account, and a read-only role if read-only behavior is needed.
- vm_guest_exec runs an unbounded command inside the guest with supplied credentials (root in the documented example) — the skill's largest risk surface; do not configure guest credentials unless needed.
- vm_set_ttl schedules unattended auto-delete and reset_vcenter_alarm clears alarms entity-type-wide; treat both as destructive.
- skills.sh / clawhub install paths are not registry-verified; audit the GitHub source and prefer a version-pinned PyPI install.
- This is a static source review only; nothing was executed, and the evals and regression-test claims were not independently reproduced.
What does this skill do, and when should you use it?
vmware-aiops is an open-source (MIT) Claude Code skill plus CLI/MCP toolset that manages vCenter and ESXi via pyVmomi over the vSphere SOAP API. It exposes 60 tools (17 read-only, 43 write) covering VM lifecycle, OVA/template deployment, guest operations, multi-step plan execution with rollback, cluster and HA/DRS management, datastore browsing, and alarm handling. Every call is audited to a SQLite audit database through the vmware-policy decorator; the CLI layer requires double confirmation and --dry-run on destructive commands, while MCP write tools deliberately act on the first call — the real write boundary is the vCenter service account. It is the entry point of an 11-package skill family (vmware-monitor, vmware-storage, vmware-nsx, and more). The project is community-maintained and not affiliated with VMware/Broadcom.
Calls the vSphere SOAP API via pyVmomi to: power on/off, create, reconfigure, clone, migrate, and delete VMs; manage snapshot CRUD, TTL-based auto-delete, and clean-slate reverts; deploy VMs from OVA, templates, linked clones, or YAML batch specs; execute commands and transfer files inside guests (requires VMware Tools and explicit guest credentials); create multi-step plans with rollback (vm_create_plan / vm_apply_plan / vm_rollback_plan); manage clusters, HA/DRS, host membership, and DRS VM-VM rules; browse datastores and scan for ISO/OVA images; list, acknowledge, and reset vCenter alarms; and produce read-only triage and investigation reports (cluster_health_summary, cross_vcenter_attention, VM/host/datastore investigation bundles delegated to vmware-monitor) that render as offline HTML snapshots. Every tool call is logged to ~/.vmware/audit.db; network-write and DRS-rule tools are preview/confirm-gated, and host VMkernel removal is fail-closed.
- Homelab and test-environment users: one-sentence VM power/clone operations, or batch-deploying dated, owner-prefixed lab VMs with TTL auto-cleanup
- Ops engineers triaging incidents: start with cluster_health_summary ('is anything on fire?'), drill into a specific VM/host/datastore with investigation bundles, then act (e.g. migrate) after root-cause evidence
- Batch testing: spin up 10+ linked clones (~100× less storage than full clones) with plan/rollback and TTLs to keep datastores from filling
- Audit-conscious teams: all writes recorded in a SQLite audit trail; run agents read-only by assigning a read-only vCenter role
- Alarm duty: list, acknowledge, and reset triggered vCenter alarms (note reset clears all matching entity-type + status alarms)
- Mixed estates spanning vSphere 6.5 through 9.1/VCF, managed by the same codebase
What are this skill's strengths and limitations?
- Broad coverage: VM lifecycle, deployment, guest ops, cluster, network, and alarms in one skill — 60 tools
- Mandatory SQLite audit on every call, plus preview/confirm gating on network/DRS writes and fail-closed protections on dangerous operations
- Honest security model: documentation explicitly states MCP writes have no confirmation; the real boundary is vCenter account privileges
- Supports vSphere 6.5–9.1/VCF with automatic API version negotiation via pyVmomi
- Fully local operation possible (Aider + Ollama); CLI mode keeps token overhead low for small models
- MIT-licensed, publicly auditable source, with read-only companion vmware-monitor suited for production monitoring
- MCP write tools act on the first call with no confirmation and no dry-run — misuse protection rests entirely on vCenter account configuration
- vm_guest_exec runs arbitrary caller-supplied commands inside guests with the passed credentials (root in the documented example) — wide blast radius
- Read-only triage/investigation features depend on vmware-monitor and are unavailable without it
- " alarm reset uses ClearTriggeredAlarms, clearing ALL matching entity-type + status alarms — no single-alarm clear exists in vSphere
- Community-maintained, not an official VMware/Broadcom product, with no vendor support
How do you install this skill?
Recommended: uv tool install vmware-aiops, or pip install vmware-aiops (Tsinghua mirror supported); alternatively npx skills add vmware-skills/VMware-AIops (Skills.sh) or clawhub install @zw008/vmware-aiops (ClawHub). Then mkdir -p ~/.vmware-aiops && vmware-aiops init to generate config templates; edit config.yaml for targets and set passwords in ~/.vmware-aiops/.env following the VMWARE_<TARGET_UPPER>_PASSWORD pattern with chmod 600. Verify with vmware-aiops doctor. For air-gapped hosts, install from source with pip install . (hatchling build, no setup.py) or pre-build wheels with pip wheel . -w dist and install offline.
How do you use this skill?
CLI examples: vmware-aiops vm power-on <name>, vmware-aiops deploy ova <path> --name <vm> --datastore <ds>, vmware-aiops summary (cluster triage), vmware-aiops investigate vm web-01 --hours 72. In Claude Code, copy skills/vmware-aiops into ~/.claude/skills/vmware-aiops/ and trigger with natural language such as "migrate this VM to esxi-02" or "what needs attention now"; for tool-level access run claude mcp add vmware-aiops -- vmware-aiops mcp. Prefer CLI with small/local models (~2K token context) and MCP with large models or automated pipelines (structured JSON). Also works with Gemini CLI, Codex CLI, Aider, Continue, Trae, Kimi, and any MCP client such as Goose or Cursor.
How does this skill compare with similar options?
The README contrasts this with other open-source VMware MCP servers (e.g. bright8192/esxi-mcp-server, giuliolibrando/vmware-vsphere-mcp-server), characterizing them as single-vCenter VM wrappers that skip networking, storage, Kubernetes, load balancing, and compliance, and lack a unified audit trail. vmware-aiops belongs to an 11-package family where every tool runs through the vmware-policy governed harness (unified audit, policy engine, graduated risk tiers, prompt-injection sanitization). For read-only monitoring needs, the recommended alternative is vmware-monitor, whose codebase contains no destructive functions at all.