VMware NSX Security

Install

Works with Claude Code, Codex, VS Code, Cursor, Windsurf, Claude Desktop. Read the repository before you give any tool access to your data.

npx agentmarket install connector/vmware-skills-vmware-nsx-security

About

Use cases: cloud-management, security-scanning

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list, install config and code. Checked Oct 25, 2026.

Tools

11 read · 7 write · 4 delete

Secrets

None asked for

Install scripts

None found

Runs as

Python package

Tools (22)

Read from the source code; the running server may differ. Descriptions are the server’s own words; hidden characters are shown as [U+…].

• apply_vm_tag

  [WRITE] Apply an NSX tag to a virtual machine. Returns {"status": "applied", "vm_id", "scope", "tag"} — not the VM's tag list. Use list_vm_tags first for the vm_id, and again after to see the result. Additive, so existing tags survive, but note that tag-based group membership shifts as NSX re-evaluates: check with get_group. Args: vm_id: VM external ID (fabric UUID, from list_vm_tags). tag_scope: Tag scope (e.g. 'env', 'tier', 'owner'). tag_value: Tag value (e.g. 'production', 'web'). target: Optional NSX Manager target from config.

• create_dfw_policy

  [WRITE] Create a new DFW security policy. Returns the created policy dict (id, path, category, ...), else {"error", "hint"}. The policy is an empty container — rules must be added afterwards with create_dfw_rule. Args: policy_id: Unique policy id (alphanumerics, hyphens, underscores). display_name: Human-readable name. category: Ethernet, Emergency, Infrastructure, Environment or Application (default Application); sets DFW evaluation order, Ethernet first, Application last. sequence_number: Priority; lower = higher priority (default 10). stateful: Track co…

• create_dfw_rule

  [WRITE] Create a firewall rule under an existing DFW security policy. Returns the created rule dict (id, path, action, ...), else {"error", "hint"}; a bad action/direction/ip_protocol lists the valid values. PUT semantics: reusing a rule_id overwrites that rule, enforced immediately unless disabled=True. Pick policy_id with list_dfw_policies first; prefer update_dfw_rule to edit one and delete_dfw_rule to remove one. Args: policy_id: Parent policy id, from list_dfw_policies. rule_id: Unique rule id within that policy. display_name: Human-readable name. action: ALLOW, DROP, RE…

• create_group

  [WRITE] Create an NSX security group with optional membership criteria. Returns the created group dict (id, path, expression, ...). Criteria are ORed — NSX only permits AND between same-member-type Conditions: tag_scope/tag_value matches VMs carrying that tag, ip_addresses matches IPs or CIDRs, segment_paths every VM on those segments. Use it before create_dfw_rule, which references the group path; confirm members with get_group. Args: group_id: Unique id (alphanumerics, hyphens, underscores). display_name: Human-readable name. description: Optional description. tag_scope: NS…

• delete_dfw_policycan change or delete data

  [WRITE] Delete a DFW security policy; refuses while it still holds rules. Without confirm=True this only previews: it returns blast_radius (the policy's name, category, sequence_number, rule_count and rule_ids, blockers, unmeasured) and deletes nothing. Show that to the user and get their decision. Do not set confirm=True on your own because the user asked to delete earlier: they have not seen the blast radius yet. confirm=True refuses, deleting nothing, while the policy still holds rules — list them with list_dfw_rules and clear each with delete_dfw_rule first — or when its rules could not …

• delete_dfw_rulecan change or delete data

  [WRITE] Permanently delete one DFW rule from its parent security policy. Irreversible and immediate: traffic it matched falls through to lower-priority rules or the policy default. Without confirm=True this only previews: it returns blast_radius (the parent policy, the rule's action, sources, destinations, services, scope, direction, disabled flag, blockers, unmeasured) and deletes nothing. Show that to the user and get their decision. Do not set confirm=True on your own because the user asked to delete earlier: they have not seen the blast radius yet. Check recent hits with get_dfw_rule_stat…

• delete_groupcan change or delete data

  [WRITE] Delete an NSX security group; refuses while anything references it. Use it once get_group shows the group is unwanted. Without confirm=True this only previews: it returns blast_radius (the group's name, path, expression_count, reference_count and references, blockers, unmeasured) and deletes nothing. Show that to the user and get their decision. Do not set confirm=True on your own because the user asked to delete earlier: they have not seen the blast radius yet. confirm=True refuses if anything still references the group (parent groups from NSX's group-associations API; DFW and gatew…

• get_dfw_policyread-only

  [READ] Get full details of a single DFW security policy. Returns one policy object, not an envelope: category, sequence_number, stateful, scope and rule count. Use it once list_dfw_policies has narrowed to one id — never a display name. Then call list_dfw_rules for the rules inside. Args: policy_id: Policy identifier (e.g. 'app-tier-policy'). target: Optional NSX Manager target from config.

• get_dfw_rule_statsread-only

  [READ] Get packet/byte hit-count statistics for a DFW rule. Returns one flat stats object, not an envelope: packet_count, byte_count, session_count, hit_count, popularity_index. Use it before update_dfw_rule or delete_dfw_rule to see if a rule still matches traffic; counters are cumulative and may read zero on a new rule. Ids come from list_dfw_rules. Args: policy_id: Parent policy identifier. rule_id: Rule identifier. target: Optional NSX Manager target from config.

• get_groupread-only

  [READ] Get details of a security group including membership criteria and effective members. Returns one group object: its expression rules, member_count (the group's real size), and members — an envelope holding at most the first 50 effective VirtualMachine members, whose truncated flag says whether more were withheld. Report member_count as the size; counting members.items reports the sample instead. Use it once list_groups has narrowed to one id; membership is evaluated by NSX, so a tag written with apply_vm_tag may take seconds to appear. Args: group_id: Group identifier (e.g. 'web-ti…

• get_idps_statusread-only

  [READ] Get IDPS signature status and global IDS settings. Returns one bundle, not an envelope: 'signature_status' (scalar fields of the signature bundle status, e.g. version/update state — names vary by NSX release) and 'settings' (auto_update, ids_events_to_syslog). Use it first to confirm IDS is on and current, then list_idps_profiles for the profiles. No per-signature or per-event detail, and 'signature_status' may be empty where IDS was never enabled. Args: target: Optional NSX Manager target from config.

• get_traceflow_resultread-only

  [READ] Get the current state and observations of an existing Traceflow. Use this to check a previously initiated traceflow without waiting. Returns operation_state (IN_PROGRESS / FINISHED / FAILED) and observations typed by resource_type; Dropped* ones carry reason and acl_rule_id. Only a traceflow run_traceflow left IN_PROGRESS at its timeout is still on the manager — a completed one is deleted server-side and its id 404s here. Args: traceflow_id: Traceflow ID from a previous run_traceflow call. target: Optional NSX Manager target from config.

• list_dfw_exclusionsread-only

  [READ] List the DFW exclusion list — the members no distributed-firewall rule reaches. Read this before answering any question about a VM being micro-segmented or protected by DFW policy. A VM on this list has no DFW in its datapath: rules that name it, groups that contain it and policies scoped to it all still exist and none of them apply. On a VCF estate the management VMs (vCenter, VCF Operations, NSX managers) are commonly on it. Returns the list envelope. 'items' holds one row per excluded member: the group 'path', its 'id' and 'display_name', the 'virtual_machines' in it and 'vm_count'…

• list_dfw_policiesread-only

  [READ] List DFW security policies in the default domain. Start here. Returns the list envelope: 'items' holds each policy's id, display_name, category, sequence_number, stateful flag and rule count; 'returned'/'limit'/'total'/'truncated'/'hint' say whether the page is the whole answer — never read a full page as complete, narrow with name_filter or page with offset. Then get_dfw_policy for one policy's detail, or list_dfw_rules for the rules inside. Page with 'next_offset': pass the value back as 'offset' and stop when it is null. Do not loop on 'truncated' — that says this page is not the w…

• list_dfw_rulesread-only

  [READ] List rules in a DFW security policy. Returns the list envelope: 'items' holds each rule's id, display_name, action, sources, destinations, services, direction, disabled flag and sequence number; 'returned'/'limit'/'truncated'/'hint' say whether the page is complete. 'total' is always null here — a full page reports truncated=true and must be paged with offset; one Application policy can hold thousands of rules. Get policy_id from list_dfw_policies; then get_dfw_rule_stats for a rule's hit counts. Page with 'next_offset': pass the value back as 'offset' and stop when it is null. Do not…

Signals

Stars

4

Forks

0

Open issues

0

Weekly downloads

375

Last commit

Oct 18, 2026 (13 days ago)

Last release

Oct 18, 2026 (13 days ago)

Last package publish

Oct 18, 2026 (13 days ago)

From GitHub (fetched Oct 24, 2026) and the package registry.

Details

Registry name

io.github.vmware-skills/vmware-nsx-security

Version

1.17.1

Auth

No auth

Packages

pypi vmware-nsx-security

License

MIT

Repository

github.com/vmware-skills/VMware-NSX-Security

First seen

Oct 24, 2026

Last checked

Oct 24, 2026

Source

Official MCP Registrygithub-graphql