Skip to content
Agentmart
Submit a tool

VMware Debug

Read-only VMware incident correlation: timeline, spikes, root-cause routing.

Connector by zw008 · GitHub account verified by the MCP Registry

IndexedMITLocal (stdio)★ 1
Write a review

Install

Works with Claude Code, Codex, VS Code, Cursor, Windsurf, Claude Desktop. Read the repository before you give any tool access to your data.

npx agentmarket install connector/zw008-vmware-debug

Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.

Get the weekly diff

The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.

We use your email only for this newsletter. Privacy

About

Read-only VMware incident correlation: timeline, spikes, root-cause routing. 2 MCP tools.

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list, install config and code. Checked Oct 25, 2026.

Tools
7 read · 7 write · 0 delete
Secrets
None asked for
Install scripts
None found
Runs as
Python package

Tools by what they do 14

Read from the source code; the running server may list different tools.

Read 7 · Look things up without changing anything.

  • build_incident_timeline
  • get_case
  • get_case_knowledge
  • get_case_readiness
  • list_cases
  • list_symptom_categories
  • plan_case

Write 7 · Create, change, send or run things.

  • close_case
  • grade_case
  • open_case
  • record_case_gap
  • record_case_hypothesis
  • record_case_timeline
  • submit_case_evidence

Network hosts it talks to 2

  • anthropic.com · found in code
  • github.com · found in code

Files it touches

  • ~/.vmware/knowledge/kb

Tools (14)

Read from the source code; the running server may differ. Descriptions are the server’s own words; hidden characters are shown as [U+…].

  • build_incident_timelineread-only

    [READ] Correlate already-fetched VMware events into one incident view. WHEN: use this after you've pulled events for an incident from the data-source skills (vmware-monitor get_events/get_alarms, vmware-aria list_alerts/list_anomalies, vmware-log-insight search_logs/aggregate_logs, vmware-nsx) — feed them here to find what correlates and where to look next. Not sure which events to pull? Run list_symptom_categories first. This tool does NOT fetch anything itself. RETURNS: {event_count, window, binning, classification, spikes (strongest anomalous bins), spikes_total, hypotheses (ranked root-c…

  • close_case

    [WRITE] Record the final grade and archive the case — step 08. WHEN: when the investigation is finished, or is being handed over. Closing turns a working folder into a record other people rely on, so it computes and records the grade rather than accepting one. RETURNS: {case_id, state, grade, open_gaps, path, note}. `open_gaps` names anything still blocking a hypothesis at the moment of closing — stated here rather than left in the file for someone to find. GOTCHAS: a closed case is not closed again and its record is never rewritten. To reopen the question, open a new case that cites this o…

  • get_caseread-only

    [READ] One case: its scope, its ledger sizes, and its grade history. WHEN: to pick up an investigation, or to see why a case sits at the grade it does. Returns counts and identifiers rather than the whole ledger — read the case folder itself (the `path` from open_case) for full evidence bodies. RETURNS: {case_id, path, state, grade, opened_at, scope, evidence_count, sources, gap_count, blocking_gaps, grade_history}. `sources` is the distinct skills evidence came from, which is what corroboration is counted in. Args: case_id: The case id returned by open_case, or listed by list_cases. …

  • get_case_knowledgeread-only

    [READ] What the knowledge layer accepts, and what is mounted. WHEN: when someone asks what can be added to make conclusions stronger, or when a case will not reach Confirmed and you need to say why in terms they can act on. This is the answer to "which knowledge formats do you take" — the first question anyone mounting a library asks. RETURNS: {root, sections, entries, with_applies_to, by_source, unreadable, unsupported, formats, needs_conversion, note} — plus {applicable, decisive_here} when a case_id is given. `formats` lists every extension read and how each carries its metadata: Markdow…

  • get_case_readinessread-only

    [READ] What strength of conclusion can this environment reach? WHEN: before starting an investigation, or when a case will not go higher and you want to know whether that is fixable. Answering this first is worth far more than discovering it halfway through. RETURNS: {classes, categories, unrecognised_skills, note}. A name that matched no skill in the catalogue comes back in `unrecognised_skills` rather than being absorbed into "not installed" — otherwise a typo reads as advice to install something you already have. Per evidence class: whether it is available, through which tools, and if not…

  • grade_case

    [WRITE] Compute and record the conclusion grade — steps 07/08. WHEN: when you think the investigation has reached a conclusion, or to record where it stands before handing it over. There is deliberately NO parameter for the grade. You cannot state a conclusion level; it is recomputed from the ledger on every call. If you disagree with the result, change the ledger — submit the evidence that is missing, or record the gap that is blocking it. The levels: Candidate (a hypothesis exists); Probable (at least two INDEPENDENT sources agree — two calls to the same skill are one source — and nothing…

  • list_casesread-only

    [READ] List investigation cases, newest first. WHEN: to find the id of a case you or someone else opened earlier. Returns the family list envelope {items, returned, limit, total, truncated, hint}; each item is {case_id, summary, state, grade, opened_at}. A case whose folder is damaged appears with state="unreadable" rather than vanishing from the list. Args: limit: Maximum cases in the page, newest first (default 50). There is no offset — 'total' reports every case, so when truncated is true the only way to reach older ones is a larger limit.

  • list_symptom_categoriesread-only

    [READ] List the symptom categories vmware-debug recognises, each with example keywords and a suggested next check (which skill/tool to run). Takes no parameters. Use this when you don't yet know what to look at — it turns "something's wrong" into concrete investigation steps. Then gather the events those checks name and pass them to build_incident_timeline. Returns the family list envelope {items, returned, limit, total, truncated, hint}; each item is {category, example_keywords, suggested_check}. The routing table is a fixed constant, so truncated is always false and total exact — this is eve…

  • open_case

    [WRITE] Open an investigation case — step 01, define the event. WHEN: at the start of an incident you expect to reason about rather than glance at. For a one-off lookup use build_incident_timeline alone. RETURNS: {case_id, path, state, grade, ceiling, ceiling_reasons, next}. Read `ceiling` now — it is the best grade this install can reach at all. GOTCHAS: writes only under $OPS_HOME, never to a VMware system, and never over an existing case. Args: summary: What is wrong, one line. plan_case reads it to infer the symptom category, so name the symptom in the estate's own words …

  • plan_caseread-only

    [READ] What to fetch next for this case — step 02, recomputed each call. WHEN: right after open_case, and again after each round of evidence. It is not a checklist: submit something and the next plan is shorter, lose a source and it routes around it. RETURNS: {category, category_signals, steps, already_covered, held_back, unavailable, ceiling, note}. Steps are interleaved across evidence classes, so you get breadth before depth — corroboration is counted in distinct sources, which is what actually moves the grade. Each step is {evidence_class, skill, tool, purpose, objects, window, degraded}…

  • record_case_gap

    [WRITE] Record something the investigation could NOT obtain. WHEN: any time a fetch failed, was refused, returned nothing, or the data simply does not exist in this environment. This is the tool that keeps a case honest: an unrecorded gap makes it look better supported than it is. RETURNS: {case_id, gap_id, grade, reasons}. GOTCHAS: recording a gap does not punish the case for the evidence it does have — a missing confirmation caps the grade, it does not demote it. Writing gaps down is meant to be free. Args: case_id: The case this gap belongs to (from open_case/list_cases). what: …

  • record_case_hypothesis

    [WRITE] Register a candidate explanation — step 06. Called without `statement` it writes nothing and only reads the hypothesis ledger. WHEN: as soon as you have a theory worth testing, and again to see where each one stands. Pass `statement` to add one; omit it to just read. Every hypothesis gets an id (H1, H2, …). Those ids are what record_case_gap(blocks=[...]) and submit_case_evidence(falsifies=[...]) refer to, and an id that was never registered is REFUSED rather than ignored — a dangling reference blocks nothing and falsifies nothing, which quietly reports a stronger case than you have.…

  • record_case_timeline

    [WRITE] Correlate everything this case has collected — steps 04/05. WHEN: once evidence is in. Unlike build_incident_timeline, this takes no events: it reads the payloads already submitted, so the result is reproducible from the case folder alone months later, on a machine with access to nothing. RETURNS: {event_count, window, binning, classification, spikes, spikes_total, hypotheses, evidence_without_events, evidence_without_events_detail, rejected, note} and writes timeline.md. GOTCHAS: `note` distinguishes three states that all show zero events — no evidence submitted at all, evidence th…

  • submit_case_evidence

    [WRITE] Record one retrieved fact — steps 02/03 of the evidence loop. WHEN: after every read-tool call you intend to reason from. RETURNS: {case_id, evidence_id, payload_events, payload_note, grade, reasons} — the resulting grade, so you need no second call to see whether this changed anything, and what the payload was read as, so a summary submitted in place of a result is visible here rather than as a zero from record_case_timeline later. GOTCHAS: a fetch that failed or came back empty goes to record_case_gap, not here. Args: case_id: The case this fact belongs to (from open_case/lis…

Signals

Stars
1
Forks
0
Open issues
0
Weekly downloads
211
Last commit
Oct 18, 2026 (10 days ago)
Last release
Oct 16, 2026 (12 days ago)
Last package publish
Oct 16, 2026 (12 days ago)

From GitHub (fetched Oct 24, 2026) and the package registry.

Details

Registry name
io.github.zw008/vmware-debug
Version
1.8.7
Auth
No auth
Packages
pypi vmware-debug
License
MIT
First seen
Oct 24, 2026
Last checked
Oct 24, 2026

More from zw008

Cite this page

VMware Debug MCP server. Agent Mart. https://agentmart.dev/connectors/zw008-vmware-debug (last updated 2026-10-24)