VMware Monitor (Read-Only)
Disclaimer: This is a community-maintained open-source project and is not affiliated with, endorsed by, or sponsored by VMware, Inc. or Broadcom Inc. "VMware" and "vSphere" are trademarks of Broadcom. Source code is publicly auditable at github.com/zw008/VMware-Monitor under the MIT license.
Read-only VMware vCenter/ESXi monitoring — 8 MCP tools, zero destructive code.
Code-level safety: This skill contains NO power, create, delete, snapshot, or modify operations. Not disabled — they don't exist in the codebase.
Companion skills: vmware-aiops (VM lifecycle), vmware-storage (iSCSI/vSAN), vmware-vks (Tanzu Kubernetes), vmware-nsx (NSX networking), vmware-nsx-security (DFW/firewall), vmware-aria (metrics/alerts/capacity), vmware-avi (AVI/ALB/AKO), vmware-harden (compliance baselines).
| vmware-pilot (workflow orchestration) | vmware-policy (audit/policy)
What This Skill Does
| Category |
Capabilities |
| Inventory |
List VMs, ESXi hosts, datastores, clusters |
| Health |
Active alarms, recent events (filter by severity/time) |
| VM Details |
CPU, memory, disks, NICs, snapshots, guest OS, IP |
| Scanning |
Scheduled alarm/log scanning with Slack/Discord webhooks |
Quick Install
uv tool install vmware-monitor
vmware-monitor doctor
When to Use This Skill
- List or search VMs, hosts, datastores, clusters
- Check active alarms or recent events
- Get detailed info about a specific VM
- Set up scheduled monitoring with webhook alerts
- Any read-only VMware query where safety is paramount
Alarm/Event Output: suggested_actions Field
get_alarms and get_events results include a suggested_actions list.
Each item is a ready-to-use hint pointing to the correct companion skill and tool:
{
"alarm_name": "VM CPU Ready High",
"entity_name": "prod-db-01",
"suggested_actions": [
"vmware-aiops: acknowledge_vcenter_alarm(entity_name='prod-db-01', alarm_name='VM CPU Ready High')",
"vmware-aiops: reset_vcenter_alarm(entity_name='prod-db-01', alarm_name='VM CPU Ready High')"
]
}
AI agents (especially smaller local models) can read these hints directly to determine which skill and tool to call next, without needing to reason about skill routing themselves.
Use companion skills for:
- Power on/off, deploy, clone, migrate -->
vmware-aiops
- iSCSI, vSAN, datastore management -->
vmware-storage
- Tanzu Kubernetes clusters -->
vmware-vks
- Load balancing, AVI/ALB, AKO, Ingress -->
vmware-avi
Related Skills — Skill Routing
| User Intent |
Recommended Skill |
| Read-only vSphere monitoring, zero risk |
vmware-monitor ← this skill |
| Storage: iSCSI, vSAN, datastores |
vmware-storage |
| VM lifecycle, deployment, guest ops |
vmware-aiops |
| Tanzu Kubernetes (vSphere 8.x+) |
vmware-vks |
| NSX networking: segments, gateways, NAT |
vmware-nsx |
| NSX security: DFW rules, security groups |
vmware-nsx-security |
| Aria Ops: metrics, alerts, capacity planning |
vmware-aria |
| Multi-step workflows with approval |
vmware-pilot |
| Compliance baselines (CIS / 等保 / PCI-DSS), drift detection, LLM remediation advisor |
vmware-harden (uv tool install vmware-harden) |
| Load balancer, AVI, ALB, AKO, Ingress |
vmware-avi (uv tool install vmware-avi) |
| Audit log query |
vmware-policy (vmware-audit CLI) |
Common Workflows
Diagnostic investigations: Before running any "why is X failing / down / abnormal" workflow, follow references/investigation-protocol.md. It enforces the four root-cause completeness criteria (falsifiability / sufficiency / necessity / mechanism) and the up-to-three-rounds deepening loop. Since vmware-monitor is read-only, it serves as the data source — actuation belongs to companion skills like vmware-aiops.
Daily Health Check
Judgment: alarms tell you what vCenter has decided is wrong, events tell you what happened. They diverge — an event burst with no alarms often signals a metric threshold miscalibration, not "everything is fine." Read both.
- Check alarms -->
vmware-monitor health alarms --target prod-vcenter — focus on Red severity AND alarms older than 1 hour (transient ones self-clear)
- Review recent events -->
vmware-monitor health events --hours 24 --severity warning — look for repeated events from the same entity (a single event is noise; 50 events in an hour is a pattern)
- List hosts -->
vmware-monitor inventory hosts — flag hosts disconnected, in maintenance mode unexpectedly, or memory > 90%
- If connection fails --> run
vmware-monitor doctor to diagnose config/network issues
Investigate a Specific VM
- Find the VM -->
vmware-monitor inventory vms --power-state poweredOff
- Get details -->
vmware-monitor vm info problem-vm
- Check related events -->
vmware-monitor health events --hours 48
- If VM not found --> verify VM name with
vmware-monitor inventory vms --limit 100 or check target with --target <other-vcenter>
Set Up Continuous Monitoring
- Configure webhook in
~/.vmware-monitor/config.yaml
- Start daemon -->
vmware-monitor daemon start
- Daemon scans every 15 min, sends alerts to Slack/Discord
Usage Mode
| Scenario |
Recommended |
Why |
| Local/small models (Ollama, Qwen) |
CLI |
~2K tokens vs ~8K for MCP |
| Cloud models (Claude, GPT-4o) |
Either |
MCP gives structured JSON I/O |
| Automated pipelines |
MCP |
Type-safe parameters, structured output |
MCP Tools (8 — all read-only)
| Tool |
Description |
list_virtual_machines |
List VMs with filtering (power state, sort, limit, folder_filter for case-insensitive folder-tree search); each VM includes folder_path |
list_esxi_hosts |
ESXi hosts with CPU, memory, version, uptime |
list_all_datastores |
Datastores with capacity, free space, type |
list_all_clusters |
Clusters with host count, DRS/HA status |
get_alarms |
All active/triggered alarms — includes suggested_actions remediation hints |
get_events |
Recent events filtered by severity and time — includes suggested_actions hints |
vm_info |
Detailed VM info (CPU, memory, disks, NICs, snapshots) |
vm_list_snapshots |
Snapshot list for one VM with nesting hierarchy (read-only) |
All tools are read-only. No tool can modify, create, or delete any resource.
CLI Quick Reference
vmware-monitor inventory vms [--target <t>] [--limit 20] [--power-state poweredOn]
vmware-monitor inventory hosts [--target <t>]
vmware-monitor inventory datastores [--target <t>]
vmware-monitor inventory clusters [--target <t>]
vmware-monitor health alarms [--target <t>]
vmware-monitor health events [--hours 24] [--severity warning]
vmware-monitor vm info <vm-name> [--target <t>]
vmware-monitor scan now [--target <t>]
vmware-monitor daemon start|stop|status
vmware-monitor doctor [--skip-auth]
Full CLI reference: see references/cli-reference.md
Troubleshooting
Alarms returns empty but vCenter shows alarms
The get_alarms tool queries triggered alarms at the root folder level. Some alarms are entity-specific — try checking events instead: get_events --hours 1 --severity info.
"Connection refused" error
- Run
vmware-monitor doctor to diagnose
- Verify target hostname/IP and port (443) in config.yaml
- For self-signed certs: set
disableSslCertValidation: true
Events returns too many results
Use severity filter: --severity warning (default) filters out info-level events. Use --hours 4 to narrow time range.
VM info shows "guest_os: unknown"
VMware Tools not installed or not running in the guest. Install/start VMware Tools for guest OS detection, IP address, and guest family info.
Doctor passes but commands fail with timeout
vCenter may be under heavy load. Try targeting a specific ESXi host directly instead of vCenter, or increase connection timeout in config.yaml.
Setup
uv tool install vmware-monitor
mkdir -p ~/.vmware-monitor
vmware-monitor init
chmod 600 ~/.vmware-monitor/.env # if using webhooks
All tools are automatically audited via vmware-policy. Audit logs: vmware-audit log --last 20
Full setup guide, security details, and AI platform compatibility: see references/setup-guide.md
Audit & Safety
All operations are automatically audited via vmware-policy (@vmware_tool decorator):
- Every tool call logged to
~/.vmware/audit.db (SQLite, framework-agnostic)
- Policy rules enforced via
~/.vmware/rules.yaml (deny rules, maintenance windows, risk levels)
- Risk classification: each tool tagged as low/medium/high/critical
- View recent operations:
vmware-audit log --last 20
- View denied operations:
vmware-audit log --status denied
vmware-policy is automatically installed as a dependency — no manual setup needed.
License
MIT — github.com/zw008/VMware-Monitor
1---2name: vmware-monitor3description: Use this skill for safe, risk-free queries of VMware infrastructure — code-level enforced safety means no destructive operations exist in the codebase. Directly handles: list VMs/hosts/datastores/clusters, check active alarms with remediation hints, view recent events, get VM details (CPU/memory/disks/NICs/snapshots). Always use vmware-monitor when the user asks to "list VMs", "check vSphere alarms", "show host status", "get VM details", "what vSphere events happened", or needs read-only VMware information before making changes. Do NOT use for any write operations — this skill is code-level read-only and cannot modify, create, or delete any resource. For VM modifications use vmware-aiops, for networking use vmware-nsx, for metrics/capacity use vmware-aria. For load balancing/AVI/AKO use vmware-avi.4---56# VMware Monitor (Read-Only)78> **Disclaimer**: This is a community-maintained open-source project and is **not affiliated with, endorsed by, or sponsored by VMware, Inc. or Broadcom Inc.** "VMware" and "vSphere" are trademarks of Broadcom. Source code is publicly auditable at [github.com/zw008/VMware-Monitor](https://github.com/zw008/VMware-Monitor) under the MIT license.910Read-only VMware vCenter/ESXi monitoring — 8 MCP tools, zero destructive code.1112> **Code-level safety**: This skill contains NO power, create, delete, snapshot, or modify operations. Not disabled — they don't exist in the codebase.13> **Companion skills**: [vmware-aiops](https://github.com/zw008/VMware-AIops) (VM lifecycle), [vmware-storage](https://github.com/zw008/VMware-Storage) (iSCSI/vSAN), [vmware-vks](https://github.com/zw008/VMware-VKS) (Tanzu Kubernetes), [vmware-nsx](https://github.com/zw008/VMware-NSX) (NSX networking), [vmware-nsx-security](https://github.com/zw008/VMware-NSX-Security) (DFW/firewall), [vmware-aria](https://github.com/zw008/VMware-Aria) (metrics/alerts/capacity), [vmware-avi](https://github.com/zw008/VMware-AVI) (AVI/ALB/AKO), [vmware-harden](https://github.com/zw008/VMware-Harden) (compliance baselines).14> | [vmware-pilot](../vmware-pilot/SKILL.md) (workflow orchestration) | [vmware-policy](../vmware-policy/SKILL.md) (audit/policy)1516## What This Skill Does1718| Category | Capabilities |19|----------|-------------|20| **Inventory** | List VMs, ESXi hosts, datastores, clusters |21| **Health** | Active alarms, recent events (filter by severity/time) |22| **VM Details** | CPU, memory, disks, NICs, snapshots, guest OS, IP |23| **Scanning** | Scheduled alarm/log scanning with Slack/Discord webhooks |2425## Quick Install2627```bash28uv tool install vmware-monitor29vmware-monitor doctor30```3132## When to Use This Skill3334- List or search VMs, hosts, datastores, clusters35- Check active alarms or recent events36- Get detailed info about a specific VM37- Set up scheduled monitoring with webhook alerts38- Any read-only VMware query where safety is paramount3940### Alarm/Event Output: `suggested_actions` Field4142`get_alarms` and `get_events` results include a `suggested_actions` list.43Each item is a ready-to-use hint pointing to the correct companion skill and tool:4445```json46{47 "alarm_name": "VM CPU Ready High",48 "entity_name": "prod-db-01",49 "suggested_actions": [50 "vmware-aiops: acknowledge_vcenter_alarm(entity_name='prod-db-01', alarm_name='VM CPU Ready High')",51 "vmware-aiops: reset_vcenter_alarm(entity_name='prod-db-01', alarm_name='VM CPU Ready High')"52 ]53}54```5556AI agents (especially smaller local models) can read these hints directly to determine which skill and tool to call next, without needing to reason about skill routing themselves.5758**Use companion skills for**:59- Power on/off, deploy, clone, migrate --> `vmware-aiops`60- iSCSI, vSAN, datastore management --> `vmware-storage`61- Tanzu Kubernetes clusters --> `vmware-vks`62- Load balancing, AVI/ALB, AKO, Ingress --> `vmware-avi`6364## Related Skills — Skill Routing6566| User Intent | Recommended Skill |67|-------------|------------------|68| Read-only vSphere monitoring, zero risk | **vmware-monitor** ← this skill |69| Storage: iSCSI, vSAN, datastores | **vmware-storage** |70| VM lifecycle, deployment, guest ops | **vmware-aiops** |71| Tanzu Kubernetes (vSphere 8.x+) | **vmware-vks** |72| NSX networking: segments, gateways, NAT | **vmware-nsx** |73| NSX security: DFW rules, security groups | **vmware-nsx-security** |74| Aria Ops: metrics, alerts, capacity planning | **vmware-aria** |75| Multi-step workflows with approval | **vmware-pilot** |76| Compliance baselines (CIS / 等保 / PCI-DSS), drift detection, LLM remediation advisor | **vmware-harden** (`uv tool install vmware-harden`) |77| Load balancer, AVI, ALB, AKO, Ingress | **vmware-avi** (`uv tool install vmware-avi`) |78| Audit log query | **vmware-policy** (`vmware-audit` CLI) |7980## Common Workflows8182> **Diagnostic investigations**: Before running any "why is X failing / down / abnormal" workflow, follow [`references/investigation-protocol.md`](references/investigation-protocol.md). It enforces the four root-cause completeness criteria (falsifiability / sufficiency / necessity / mechanism) and the up-to-three-rounds deepening loop. Since vmware-monitor is read-only, it serves as the data source — actuation belongs to companion skills like vmware-aiops.8384### Daily Health Check8586**Judgment**: alarms tell you what vCenter has decided is wrong, events tell you what happened. They diverge — an event burst with no alarms often signals a metric threshold miscalibration, not "everything is fine." Read both.87881. Check alarms --> `vmware-monitor health alarms --target prod-vcenter` — focus on Red severity AND alarms older than 1 hour (transient ones self-clear)892. Review recent events --> `vmware-monitor health events --hours 24 --severity warning` — look for repeated events from the same entity (a single event is noise; 50 events in an hour is a pattern)903. List hosts --> `vmware-monitor inventory hosts` — flag hosts disconnected, in maintenance mode unexpectedly, or memory > 90%914. **If connection fails** --> run `vmware-monitor doctor` to diagnose config/network issues9293### Investigate a Specific VM941. Find the VM --> `vmware-monitor inventory vms --power-state poweredOff`952. Get details --> `vmware-monitor vm info problem-vm`963. Check related events --> `vmware-monitor health events --hours 48`974. **If VM not found** --> verify VM name with `vmware-monitor inventory vms --limit 100` or check target with `--target <other-vcenter>`9899### Set Up Continuous Monitoring1001. Configure webhook in `~/.vmware-monitor/config.yaml`1012. Start daemon --> `vmware-monitor daemon start`1023. Daemon scans every 15 min, sends alerts to Slack/Discord103104## Usage Mode105106| Scenario | Recommended | Why |107|----------|:-----------:|-----|108| Local/small models (Ollama, Qwen) | **CLI** | ~2K tokens vs ~8K for MCP |109| Cloud models (Claude, GPT-4o) | Either | MCP gives structured JSON I/O |110| Automated pipelines | **MCP** | Type-safe parameters, structured output |111112## MCP Tools (8 — all read-only)113114| Tool | Description |115|------|------------|116| `list_virtual_machines` | List VMs with filtering (power state, sort, limit, `folder_filter` for case-insensitive folder-tree search); each VM includes `folder_path` |117| `list_esxi_hosts` | ESXi hosts with CPU, memory, version, uptime |118| `list_all_datastores` | Datastores with capacity, free space, type |119| `list_all_clusters` | Clusters with host count, DRS/HA status |120| `get_alarms` | All active/triggered alarms — includes `suggested_actions` remediation hints |121| `get_events` | Recent events filtered by severity and time — includes `suggested_actions` hints |122| `vm_info` | Detailed VM info (CPU, memory, disks, NICs, snapshots) |123| `vm_list_snapshots` | Snapshot list for one VM with nesting hierarchy (read-only) |124125All tools are **read-only**. No tool can modify, create, or delete any resource.126127## CLI Quick Reference128129```bash130vmware-monitor inventory vms [--target <t>] [--limit 20] [--power-state poweredOn]131vmware-monitor inventory hosts [--target <t>]132vmware-monitor inventory datastores [--target <t>]133vmware-monitor inventory clusters [--target <t>]134vmware-monitor health alarms [--target <t>]135vmware-monitor health events [--hours 24] [--severity warning]136vmware-monitor vm info <vm-name> [--target <t>]137vmware-monitor scan now [--target <t>]138vmware-monitor daemon start|stop|status139vmware-monitor doctor [--skip-auth]140```141142> Full CLI reference: see `references/cli-reference.md`143144## Troubleshooting145146### Alarms returns empty but vCenter shows alarms147The `get_alarms` tool queries triggered alarms at the root folder level. Some alarms are entity-specific — try checking events instead: `get_events --hours 1 --severity info`.148149### "Connection refused" error1501. Run `vmware-monitor doctor` to diagnose1512. Verify target hostname/IP and port (443) in config.yaml1523. For self-signed certs: set `disableSslCertValidation: true`153154### Events returns too many results155Use severity filter: `--severity warning` (default) filters out info-level events. Use `--hours 4` to narrow time range.156157### VM info shows "guest_os: unknown"158VMware Tools not installed or not running in the guest. Install/start VMware Tools for guest OS detection, IP address, and guest family info.159160### Doctor passes but commands fail with timeout161vCenter may be under heavy load. Try targeting a specific ESXi host directly instead of vCenter, or increase connection timeout in config.yaml.162163## Setup164165```bash166uv tool install vmware-monitor167mkdir -p ~/.vmware-monitor168vmware-monitor init169chmod 600 ~/.vmware-monitor/.env # if using webhooks170```171172> All tools are automatically audited via vmware-policy. Audit logs: `vmware-audit log --last 20`173174> Full setup guide, security details, and AI platform compatibility: see `references/setup-guide.md`175176## Audit & Safety177178All operations are automatically audited via vmware-policy (`@vmware_tool` decorator):179- Every tool call logged to `~/.vmware/audit.db` (SQLite, framework-agnostic)180- Policy rules enforced via `~/.vmware/rules.yaml` (deny rules, maintenance windows, risk levels)181- Risk classification: each tool tagged as low/medium/high/critical182- View recent operations: `vmware-audit log --last 20`183- View denied operations: `vmware-audit log --status denied`184185vmware-policy is automatically installed as a dependency — no manual setup needed.186187## License188189MIT — [github.com/zw008/VMware-Monitor](https://github.com/zw008/VMware-Monitor)
Lord1Egypt