VMware Harden

Install

Works with Claude Code, Codex, VS Code, Cursor, Windsurf, Claude Desktop. Read the repository before you give any tool access to your data.

npx agentmarket install connector/vmware-skills-vmware-harden

About

Use cases: security-scanning

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list, install config and code. Checked Oct 25, 2026.

Tools

8 read · 0 write · 0 deleteRead-only

Secrets

None asked for

Install scripts

None found

Runs as

Python package

Tools (8)

Read from the source code; the running server may differ. Descriptions are the server’s own words; hidden characters are shown as [U+…].

• describe_stig_content_syncread-only

  [READ] Explain harden's vSphere STIG integration and route continuous enforcement. Takes no parameters. Returns {compliance_api_available (always false — VCF Operations ACC/SPM exposes no public compliance REST API), why_no_api, content_sources (the open-source MITRE InSpec/Cinc STIG repos harden syncs against), mechanism (how upstream controls become harden rules), routing_note (use VCF Operations SPM/ACC UI for fleet-wide continuous enforcement; harden is the API-scriptable point-in-time scanner), importer_status}. Read-only, local static content — no database, network, or API call. Call thi…

• get_baseline_rulesread-only

  [READ] Return every rule in one compliance baseline. Returns the family list envelope {items, returned, limit, total, truncated, hint}; each item is {id, title, severity, category}, where severity is one of 'critical', 'high', 'medium', 'low', 'info'. The whole baseline is returned, so truncated is always false and total is the exact rule count. Read-only — parses local baseline YAML only, no database or network access. Use after list_baselines to preview what scan_target will check; use list_violations for actual scan findings. Args: baseline_id: A baseline id exactly as returned by list…

• get_remediationread-only

  [READ] Fetch the persisted LLM-generated remediation Suggestion for one violation. Returns {summary, execution_plan.steps, impact_prediction (workload impact, maintenance window, rollback plan), confidence (0.0-1.0), human_review_required}, or None when no advisor suggestion has been generated for that violation yet (generate one via the vmware-harden CLI advisor). Read-only lookup in the local twin DB (~/.vmware-harden/twin.duckdb); no network calls and nothing is executed — suggestions are advisory only. Args: violation_id: The 'id' field of a row returned by list_violations (th…

• list_baselinesread-only

  [READ] List all available compliance baselines: built-in (CIS ESXi 8.0, vSphere SCG v8, PCI-DSS 4.0, DengBao 2.0 L3, EU NIS2, BSI ITGS) plus any user-imported YAML baselines from ~/.vmware-harden/baselines/. Takes no parameters. Returns the family list envelope {items, returned, limit, total, truncated, hint}; each item is {id, name, version, applies_to (node types covered), rule_count}, and entries that fail to load carry an 'error' field instead. Every baseline is listed, so truncated is always false and total is exact — this is the complete set, not a page of it. Read-only — parses local ba…

• list_drift_eventsread-only

  [READ] List configuration drift events from the most recent scan snapshot — fields whose values changed since the prior scan of the same target. Returns the family list envelope {items, returned, limit, total, truncated, hint}; each item is {node_id, field, old_value, new_value, detected_at}. total is the snapshot's exact change-event count, so truncated tells you definitively whether rows were left behind — raise limit when it is true. Returns an empty envelope (total 0) when no snapshot exists or there was no prior snapshot to diff against (a target must be scanned at least twice). Read-only…

• list_stig_controlsread-only

  [READ] List the built-in vSphere 9 / VCF 9 STIG-aligned host baseline's controls (baseline id 'vsphere-stig-v9-subset'). Returns the family list envelope {items, returned, limit, total, truncated, hint}; each item is {id, title, severity (one of critical/high/medium/low/info), category, advanced_setting} where advanced_setting names the ESXi advanced setting the control governs (e.g. 'Security.AccountLockFailures'). total is the exact catalog size, so truncated tells you definitively whether to raise offset. Read-only — parses local baseline YAML only, no database, network, or compliance API (…

• list_violationsread-only

  [READ] List compliance violations recorded by the most recent scan snapshot in the local twin DB (~/.vmware-harden/twin.duckdb). Returns an envelope {violations: [...], total, limit, offset, has_more, coverage, note}; each violation is {id, rule_id, node_id, severity, baseline_id, evidence}, sorted severity-descending then rule_id. `total` is the full matching count (unbounded by limit) so nothing is hidden — page by raising offset while has_more is true. AN EMPTY LIST IS NOT A COMPLIANCE VERDICT: rules whose data no collector gathers are not executed and count as undetermined, never as passin…

• scan_target

  [READ] Run a compliance scan of a vCenter target against a baseline and persist results locally. Makes read-only vCenter API calls (inventory collection only — never modifies VMware infrastructure) and writes a new snapshot, violations, and drift events (vs the prior scan of the same target) to the local twin DB (~/.vmware-harden/twin.duckdb). Returns summary counts {snapshot_id, target, baseline, hosts, violations, coverage, note}; inspect details via list_violations and list_drift_events. `violations` is meaningful only together with `coverage`: rules whose data no collector gathers are not …

Signals

Stars

4

Forks

0

Open issues

0

Weekly downloads

614

Last commit

Oct 24, 2026 (5 days ago)

Last release

Oct 19, 2026 (9 days ago)

Last package publish

Oct 19, 2026 (9 days ago)

From GitHub (fetched Oct 24, 2026) and the package registry.

Details

Registry name

io.github.vmware-skills/vmware-harden

Version

1.17.0

Auth

No auth

Packages

pypi vmware-harden

License

MIT

Repository

github.com/vmware-skills/VMware-Harden

First seen

Oct 24, 2026

Last checked

Oct 24, 2026

Source

Official MCP Registrygithub-graphql